You have an Azure subscription that contains the virtual machines shown in the following table. 

All the virtual networks are peered. You deploy Azure Bastion to VNET2. Which virtual machines can be protected by the bastion host? 

Answer options:

A. VM1, VM2, VM3, and VM4
B. VM1, VM2, and VM3 only
C. VM2 and VM4 only
D. VM2 only

A

Reference: https://docs.microsoft.com/en-us/azure/bastion/vnet-peering