Designing Network and Hybrid Infrastructure Security

Network and hybrid infrastructure security is about controlling who and what can travel across your digital networks. Think of a network as a system of roads connecting computers. Some roads are public (the internet), some are private (your office network), and some are express lanes that connect your office directly to a cloud provider like Azure (a hybrid connection).

To secure this, you use several key tools. First is the firewall. A firewall is a security guard that inspects every packet of data trying to enter or leave your network. A packet is a small chunk of data, like a single envelope in the mail. The firewall checks the envelope's return address (source IP address), its destination (destination IP address), and the type of content (port number — e.g., web traffic uses port 80, email uses port 25). If the traffic matches a rule you set (e.g., 'allow web traffic from the marketing team to the internet'), the guard lets it through. Otherwise, it gets blocked.

Second is network segmentation. This means splitting your network into smaller, secure zones. For example, you might have one zone for public-facing web servers (a DMZ — demilitarised zone), another for internal employee computers, and a third for databases containing customer data. Even if a hacker breaches the web server, they cannot freely walk into the database zone because there is another firewall between them. This is like having separate locked rooms inside your office, separated by their own keycard doors.

Third is virtual private networks (VPNs). A VPN creates an encrypted tunnel between a remote user's laptop and your company network. Encrypted means the data is scrambled so that even if someone intercepts it on a public Wi-Fi network, they see only gibberish. The tunnel is like a private, guarded corridor from the user's home to the office. For hybrid environments — meaning your company has some servers on-premises (in your building) and some in the cloud — you also use dedicated links like Azure ExpressRoute. This is a private, high-speed fibre connection between your office and Azure that never touches the public internet, avoiding many common attacks.

Fourth is Zero Trust, a critical philosophy for the SC-100 exam. Zero Trust means 'never trust, always verify.' Instead of assuming that anyone inside the network is safe, you require every single request — even from an employee inside your own office — to prove its identity (via Microsoft Entra ID) and pass additional checks (like confirming the device is healthy and has latest updates). It fundamentally replaces the old 'castle and moat' model, where the inside of the network was assumed safe.

Finally, all these pieces are managed through a central tool, often Microsoft Defender for Cloud, which gives you a dashboard showing security alerts, recommended fixes, and compliance status across both your on-premises and cloud networks.

SC-100 tests your ability to design these solutions — choosing the right combination of firewalls, segmentation, encryption, identity checks, and monitoring — not configuring them in detail.

Meet Priya, a security architect at a mid-size retail company called ShopGlobal. ShopGlobal has 200 employees in a physical office in London, a website hosted on Azure (in the cloud), and 50 remote sales staff who travel globally. Priya needs to design a network security solution that protects customer payment data without slowing down operations.

Step 1: Priya identifies all the connection points. She maps out:

Step 2: She designs network segmentation. Using Azure Virtual Network (VNet), she creates three separate networks in the cloud:

Between these subnets, she applies Network Security Groups (NSGs) — these are simple firewall rules that act as door locks. For example, the Database Subnet allows traffic only from the Application Subnet on the database port, blocking everything else.

Step 3: For hybrid connectivity, she sets up Azure ExpressRoute — a private circuit — between the London office and Azure. This ensures that internal file synchronisation and employee authentication traffic never goes over the public internet. This also gives faster speeds and a more reliable connection.

Step 4: For remote employees, Priya uses Azure VPN Gateway. Each remote laptop has a VPN client installed. When the employee connects, the laptop and the Azure VPN Gateway mutually authenticate using certificates (digital ID cards) and create an encrypted tunnel. The employee can now access internal resources as if they were sitting in the office.

Step 5: She enforces Zero Trust using Microsoft Entra ID Conditional Access. Before anyone can access the customer database, they must:

Even if a hacker steals an employee's password, they cannot access the database because their device is not managed.

Step 6: Priya implements Microsoft Defender for Cloud to continuously monitor all these resources. It alerts her if it detects unusual traffic patterns, like a sudden spike in data being sent out of the database subnet — which could indicate a breach. She regularly reviews these alerts and adjusts rules.

Step 7: Finally, she documents the entire architecture so the operations team can maintain it. She writes clear rules about which ports are open, who manages firewall changes, and how often security reviews happen. She also trains employees on why they shouldn't disable the VPN or click suspicious links.

What Priya does daily: she reviews security alerts, updates firewall rules when a new application is deployed, audits access logs (records of who connected where), and participates in incident response drills. She does not configure individual firewalls — she designs the blueprint that others implement.