Microsoft Azure Administrator Associate AZ-104 Practice Question

To enable remote management from your on-premises network, you need to create a security rule that allows inbound traffic from your on-premises network to the virtual machine. This is achieved by configuring a Network Security Group (NSG) to permit the necessary inbound traffic on the required ports (such as port 3389 for Remote Desktop Protocol (RDP)). While the virtual machine's Windows Firewall also needs to have the correct ports open, NSG rules are processed first and will block the traffic before it reaches the VM if not configured correctly. Configuring the virtual network's address space to match the on-premises network would cause IP address conflicts and is not a valid solution. Assigning a public IP address to connect over the internet is unnecessary and less secure, as a site-to-site VPN already provides a secure, private connection.