Harbor pilots still RDP to lock-chamber virtual machines over the Internet because each VM has a public IP. How should the security engineer provide remote access while removing those public IPs?
Select an answer to reveal the explanation.
Short Explanation
Strip the public IPs off those lock VMs and park Bastion in the hub. Pilots still get RDP/SSH, but the session rides TLS through Bastion—no 3389 hanging on the open water.
Full Explanation
Azure Bastion is the managed jump path for RDP and SSH. Place Bastion in a hub (or appropriate shared) network, remove public IP addresses from target VMs, and connect through Bastion so sessions are brokered over TLS without exposing inbound 3389 or 22 from the Internet. A standing NSG Allow from the Internet and a self-managed jump VM with a public IP leave management ports exposed. Azure Firewall DNAT publishing RDP is not Bastion and is not the preferred private remote-access pattern for this scenario.