Administrators need native-client administrative RDP through Azure Bastion to hosts with private IPs only. Private routing, target NSGs, and guest sign-in rights are already correct. Which choice meets the native-client transport requirement?

✓ Correct answer

• A dedicated Standard Bastion deployment with the supported native-client connection.

Standard Bastion supports the required native-client connection and reaches VM private IPs. The scenario already supplies routing and guest authorization, so the missing decision is the transport capability. Option explanations: A. A dedicated Standard Bastion deployment with the supported native-client connection.: Standard includes the native-client capability required by the scenario. B. JIT alone, without a private client path or Bastion deployment.: JIT temporarily changes network rules; it does not provide the missing native-client gateway or private path. C. A dedicated Basic Bastion deployment using only its browser connection.: Basic supplies browser connectivity rather than the stated native-client feature. D. Permanent public-IP TCP 3389 access to every host.: Public direct RDP violates the private-IP-only transport requirement. Sources: What is Azure Bastion? — https://learn.microsoft.com/en-us/azure/bastion/bastion-overview

Read the source reference