A contractor tries to deploy Azure Bastion into the same subnet as…

Question

A contractor tries to deploy Azure Bastion into the same subnet as the lock-chamber virtual machines and the deployment fails. What must the security engineer create for Bastion?

Accepted Answer

Create a dedicated subnet named AzureBastionSubnet with at least a /26 prefix and place no other user workloads in that subnet. — Bastion is picky about its parking spot: a subnet literally named AzureBastionSubnet, sized at least /26, and empty of your lock VMs. Drop it next to the chambers and the deploy fails.

Answer

Reuse the GatewaySubnet that already hosts the VPN gateway so Bastion and the gateway share address space.

Answer

Place Bastion NICs in the lock-chamber subnet and rely on an NSG service tag named Bastion to isolate traffic.

Answer

Deploy Bastion into a Virtual WAN secured hub without a dedicated Bastion subnet because Virtual WAN supplies one automatically for every spoke.

A contractor tries to deploy Azure Bastion into the same subnet as the lock-chamber virtual machines and the deployment fails. What must the security engineer create for Bastion?

Short Explanation

Full Explanation