Azure Bastion for secure VM access - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an Azure Bastion host in the specified virtual network.

Azure

az network bastion create --name MyBastionHost --resource-group MyResourceGroup --vnet-name [1] --subnet AzureBastionSubnet --location eastus

Drag options to blanks, or click blank then click option'

AMySubnet

BMyVNet

CMyResourceGroup

Deastus

Attempts:

3 left

💡 Hint

Common Mistakes

Using the subnet name instead of the virtual network name.

Using the resource group name instead of the virtual network name.

The --vnet-name parameter requires the name of the virtual network where the Bastion host will be deployed. Here, MyVNet is the correct virtual network name.

2fill in blank

medium

Complete the code to create the required subnet for Azure Bastion named 'AzureBastionSubnet'.

Azure

az network vnet subnet create --resource-group MyResourceGroup --vnet-name MyVNet --name [1] --address-prefixes 10.0.1.0/26

Drag options to blanks, or click blank then click option'

ABastionSubnet

BSubnet1

CAzureBastionSubnet

DGatewaySubnet

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different subnet name than 'AzureBastionSubnet'.

Using the GatewaySubnet which is for VPN gateways.

Azure Bastion requires a subnet named AzureBastionSubnet to function properly.

3fill in blank

hard

Fix the error in the command to connect to a VM using Azure Bastion.

Azure

az network bastion ssh --name MyBastionHost --resource-group MyResourceGroup --target-resource-id [1] --auth-type ssh-key --username azureuser

Drag options to blanks, or click blank then click option'

A/subscriptions/xxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualMachines/MyVM

BMyVM

CMyResourceGroup

D/subscriptions/xxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/virtualMachines/MyVM

Attempts:

3 left

💡 Hint

Common Mistakes

Using only the VM name instead of the full resource ID.

Using the wrong provider in the resource ID.

The --target-resource-id parameter requires the full Azure resource ID of the virtual machine, which includes the subscription, resource group, provider, and VM name.

4fill in blank

hard

Fill both blanks to define a network security group rule allowing Bastion host inbound traffic on port 443.

Azure

az network nsg rule create --resource-group MyResourceGroup --nsg-name MyNSG --name AllowBastionInbound --priority 100 --direction [1] --access Allow --protocol Tcp --destination-port-ranges [2]

Drag options to blanks, or click blank then click option'

AInbound

BOutbound

C443

D3389

Attempts:

3 left

💡 Hint

Common Mistakes

Setting direction to Outbound instead of Inbound.

Using port 3389 which is for RDP, not Bastion.

The rule must allow Inbound traffic on port 443 (HTTPS) for Azure Bastion to work.

5fill in blank

hard

Fill all three blanks to create an Azure Bastion host with a public IP and associate it with the correct subnet.

Azure

az network public-ip create --resource-group MyResourceGroup --name [1] --sku Standard --location eastus
az network bastion create --resource-group MyResourceGroup --name MyBastionHost --public-ip-address [2] --vnet-name MyVNet --location eastus --subnet [3]

Drag options to blanks, or click blank then click option'

AMyBastionPublicIP

CAzureBastionSubnet

DMySubnet

Attempts:

3 left

💡 Hint

Common Mistakes

Using different names for the public IP in the two commands.

Using a subnet name other than 'AzureBastionSubnet'.

The public IP must be created first with a name (e.g., MyBastionPublicIP), then referenced in the Bastion creation command. The Bastion host must be associated with the AzureBastionSubnet.