# Designing Network and Hybrid Infrastructure Security

> Chapter 10 of the Courseiva SC-100 curriculum — https://courseiva.com/learn/sc-100/network-and-hybrid-infrastructure-security

**Official objective:** 4.1 — Design solutions for securing network and hybrid environments

## Introduction

Without proper network and hybrid security, your company's most sensitive data — customer credit cards, internal emails, secret product plans — would be as easy to steal as a note left on a park bench. This chapter solves that problem by teaching you how to protect the digital highways that connect your company's users, devices, and data, whether they live in your office, in the cloud, or on someone's laptop at a coffee shop. Passing SC-100 demands you understand these protections at a design level, not just how to click buttons.

## The 30-Floor Office Building Security Analogy

An office building has 30 floors, each owned by a different company. Your company leases floors 10 through 15. You want to make sure that only your employees can get to your floors, that they can only access the specific rooms they need (the kitchen, not the server room), and that people from other companies can't wander in through a fire escape or a shared elevator.

This is exactly what designing network and hybrid infrastructure security feels like. The building is the internet. Your floors are your company's network, both in your physical office (on-premises) and in the cloud (like Microsoft Azure). The shared elevators and stairwells are the public internet. The fire escape connecting your floor to the ground is a hybrid connection — a direct, private link from your office to the cloud that bypasses the public internet.

Your job, as a security architect, is to decide where to put the security guards (firewalls), who gets which keycard (identity and access policies), and which doors are always locked (network security groups). You also need to make sure the building's internal security system works with the security systems you install on your own floors — this is hybrid security. One lapse — like propping a fire door open — lets anyone in.

## Core explanation

Network and hybrid infrastructure security is about controlling who and what can travel across your digital networks. Think of a network as a system of roads connecting computers. Some roads are public (the internet), some are private (your office network), and some are express lanes that connect your office directly to a cloud provider like Azure (a hybrid connection).

To secure this, you use several key tools. First is the firewall. A firewall is a security guard that inspects every packet of data trying to enter or leave your network. A packet is a small chunk of data, like a single envelope in the mail. The firewall checks the envelope's return address (source IP address), its destination (destination IP address), and the type of content (port number — e.g., web traffic uses port 80, email uses port 25). If the traffic matches a rule you set (e.g., 'allow web traffic from the marketing team to the internet'), the guard lets it through. Otherwise, it gets blocked.

Second is network segmentation. This means splitting your network into smaller, secure zones. For example, you might have one zone for public-facing web servers (a DMZ — demilitarised zone), another for internal employee computers, and a third for databases containing customer data. Even if a hacker breaches the web server, they cannot freely walk into the database zone because there is another firewall between them. This is like having separate locked rooms inside your office, separated by their own keycard doors.

Third is virtual private networks (VPNs). A VPN creates an encrypted tunnel between a remote user's laptop and your company network. Encrypted means the data is scrambled so that even if someone intercepts it on a public Wi-Fi network, they see only gibberish. The tunnel is like a private, guarded corridor from the user's home to the office. For hybrid environments — meaning your company has some servers on-premises (in your building) and some in the cloud — you also use dedicated links like Azure ExpressRoute. This is a private, high-speed fibre connection between your office and Azure that never touches the public internet, avoiding many common attacks.

Fourth is Zero Trust, a critical philosophy for the SC-100 exam. Zero Trust means 'never trust, always verify.' Instead of assuming that anyone inside the network is safe, you require every single request — even from an employee inside your own office — to prove its identity (via Microsoft Entra ID) and pass additional checks (like confirming the device is healthy and has latest updates). It fundamentally replaces the old 'castle and moat' model, where the inside of the network was assumed safe.

Finally, all these pieces are managed through a central tool, often Microsoft Defender for Cloud, which gives you a dashboard showing security alerts, recommended fixes, and compliance status across both your on-premises and cloud networks.

SC-100 tests your ability to design these solutions — choosing the right combination of firewalls, segmentation, encryption, identity checks, and monitoring — not configuring them in detail.

## Real-world context

Meet Priya, a security architect at a mid-size retail company called ShopGlobal. ShopGlobal has 200 employees in a physical office in London, a website hosted on Azure (in the cloud), and 50 remote sales staff who travel globally. Priya needs to design a network security solution that protects customer payment data without slowing down operations.

Step 1: Priya identifies all the connection points. She maps out:
- The office network (on-premises) with servers for internal email and file storage.
- The Azure cloud environment hosting the public website and a customer database.
- The remote employees, each using a company laptop at hotels, cafes, and home.
- The payment processor that needs to receive encrypted transactions.

Step 2: She designs network segmentation. Using Azure Virtual Network (VNet), she creates three separate networks in the cloud:
- A 'Web Subnet' for the public website, accessible from the internet.
- An 'Application Subnet' for the logic that processes orders, not directly reachable from the internet.
- A 'Database Subnet' for the customer database, accessible only from the Application Subnet.

Between these subnets, she applies Network Security Groups (NSGs) — these are simple firewall rules that act as door locks. For example, the Database Subnet allows traffic only from the Application Subnet on the database port, blocking everything else.

Step 3: For hybrid connectivity, she sets up Azure ExpressRoute — a private circuit — between the London office and Azure. This ensures that internal file synchronisation and employee authentication traffic never goes over the public internet. This also gives faster speeds and a more reliable connection.

Step 4: For remote employees, Priya uses Azure VPN Gateway. Each remote laptop has a VPN client installed. When the employee connects, the laptop and the Azure VPN Gateway mutually authenticate using certificates (digital ID cards) and create an encrypted tunnel. The employee can now access internal resources as if they were sitting in the office.

Step 5: She enforces Zero Trust using Microsoft Entra ID Conditional Access. Before anyone can access the customer database, they must:
- Sign in with a strong password and multi-factor authentication (MFA).
- Be on a company-managed device that has the latest antivirus definitions.
- Be connecting from a trusted location (office or VPN).

Even if a hacker steals an employee's password, they cannot access the database because their device is not managed.

Step 6: Priya implements Microsoft Defender for Cloud to continuously monitor all these resources. It alerts her if it detects unusual traffic patterns, like a sudden spike in data being sent out of the database subnet — which could indicate a breach. She regularly reviews these alerts and adjusts rules.

Step 7: Finally, she documents the entire architecture so the operations team can maintain it. She writes clear rules about which ports are open, who manages firewall changes, and how often security reviews happen. She also trains employees on why they shouldn't disable the VPN or click suspicious links.

What Priya does daily: she reviews security alerts, updates firewall rules when a new application is deployed, audits access logs (records of who connected where), and participates in incident response drills. She does not configure individual firewalls — she designs the blueprint that others implement.

## Exam focus

SC-100 (Exam topic: Design solutions for securing network and hybrid environments) is not a hands-on configuration exam. You won't be asked to write a firewall rule. Instead, Microsoft tests your ability to choose the correct design principle from a scenario description.

Specific concepts the exam loves to test:
- Zero Trust principles and how they differ from the castle-and-moat model. Expect at least one question where you must identify which design choice (e.g., requiring MFA for every request) is an example of Zero Trust.
- Network segmentation with Azure Virtual Network and subnets. Questions will present a scenario (e.g., a company with a public website and a sensitive database) and ask which subnet architecture provides the best security. The correct answer almost always involves separate subnets with Network Security Groups restricting traffic between them.
- Hybrid connectivity options: Azure ExpressRoute vs. site-to-site VPN vs. point-to-site VPN. The exam often asks you to recommend one based on requirements like high bandwidth, low latency, or cost. ExpressRoute is the answer for mission-critical, high-speed, private connections. Site-to-site VPN is for moderate needs. Point-to-site is for individual remote users.
- Azure Firewall vs. Network Security Groups vs. Application Security Groups. You must know when to use each. NSGs are for traffic filtering within a virtual network (east-west traffic). Azure Firewall is for outbound internet traffic control and advanced threat intelligence. Application Security Groups simplify grouping of VMs by function.
- Microsoft Entra ID Conditional Access as a network security control. Not just 'network' in the traditional sense — the exam considers identity as part of network security in a Zero Trust model.
- Defender for Cloud's network map and security recommendations. You may be asked which tool provides a visualisation of network topology and identifies unprotected resources.
- DDoS protection: Azure DDoS Protection (Basic and Standard) and how it defends against distributed denial-of-service attacks. Standard is recommended for critical workloads.

Common traps:
- Confusing 'encryption in transit' with 'network segmentation'. The exam may offer a tempting answer that suggests encrypting data travelling between servers is sufficient. It is not — you still need segmentation to limit which servers can talk to each other.
- Choosing a VPN when ExpressRoute is needed. If the question mentions 'low latency', 'high bandwidth', or 'mission-critical', ExpressRoute is correct; VPN will be the distractor.
- Thinking that placing everything in one subnet is simpler and still secure. The exam will always penalise this. Segmentation is mandatory.
- Overlooking the 'identity' part of network security — for example, forgetting that Conditional Access policies can restrict network access based on user sign-in risk.
- Believing that all traffic inside a datacentre is safe. The exam reinforces that Zero Trust applies to internal traffic too.

What to memorise: the core definition of each network security service (NSG, Azure Firewall, ExpressRoute, VPN Gateway) and the scenario it best fits. Practise identifying which combination a given business scenario requires.

## Step by step

1. **Map the digital terrain** — List all endpoints (office network, cloud resources, remote users, third-party services) and the data flows between them. This gives you the 'what is being protected' baseline. Without this step, you cannot design relevant security.
2. **Segment into security zones** — Divide your network into subnets based on function (web, application, database) and trust level. Each zone gets its own Network Security Group rules. This limits how far a breach can spread. For example, a web subnet can talk to the internet but not directly to the database.
3. **Choose hybrid connectivity type** — Decide how your on-premises network connects to the cloud. ExpressRoute for high-volume, latency-sensitive workloads (e.g., real-time data sync). Site-to-site VPN for moderate needs. Point-to-site VPN for individual remote workers. This choice affects cost, speed, and security profile.
4. **Apply Zero Trust access policies** — Using Microsoft Entra ID Conditional Access, define rules that require strong authentication, device compliance, and location checks before granting access to sensitive resources. This ensures that even a valid password is not enough if the device is infected.
5. **Implement continuous monitoring and response** — Deploy Microsoft Defender for Cloud to collect logs, generate alerts, and visualise network traffic. Set up automated responses (e.g., block an IP if it triggers a high-severity alert). Monitoring turns a static architecture into a dynamic defence.

## Comparisons

### Network Security Group (NSG) vs Azure Firewall

**Network Security Group (NSG):**
- Filters traffic within a virtual network (east-west) and between subnets
- Stateless or stateful (you choose), with basic source/destination IP and port rules
- Free with no additional cost (included in virtual network)

**Azure Firewall:**
- Filters traffic to/from the internet (north-south) and provides centralised inspection
- Fully stateful with advanced capabilities like threat intelligence and application filtering
- Paid service with per-hour and per-data processing costs

### Site-to-Site VPN vs Azure ExpressRoute

**Site-to-Site VPN:**
- Uses the public internet to create an encrypted tunnel
- Limited bandwidth (up to ~1.25 Gbps) and variable latency
- Lower cost, suitable for moderate throughput and non-critical data

**Azure ExpressRoute:**
- Uses a dedicated private fibre connection, no public internet
- High bandwidth (up to 10 Gbps or more) with consistent low latency
- Higher cost, ideal for critical, high-volume, and latency-sensitive workloads

### Traditional Perimeter Security (Castle-and-Moat) vs Zero Trust

**Traditional Perimeter Security (Castle-and-Moat):**
- Trusts everything inside the network's perimeter
- Protects the network boundary with firewalls
- Relies on IP addresses and network location to grant access

**Zero Trust:**
- Trusts nothing by default, even inside the network
- Verifies each request based on identity, device health, and context
- Grants access per-resource using policies, not network location

### On-Premises Network vs Cloud Virtual Network (VNet)

**On-Premises Network:**
- Physical servers and cables in a building you own or lease
- You manage all hardware, cabling, and maintenance
- Scaling requires buying and installing new hardware

**Cloud Virtual Network (VNet):**
- Logical, software-defined network in Azure's datacentres
- Microsoft manages the physical hardware; you configure virtual resources
- Scaling is elastic and done instantly via portal/API

## Diagram

_This diagram shows the flow of traffic from remote users and on-premises office into a segmented Azure Virtual Network, protected by VPN, ExpressRoute, Azure Firewall, and Network Security Groups (NSGs)._

```mermaid
flowchart TD
    A[Remote User Laptop] -->|VPN Tunnel| B[Azure VPN Gateway]
    B --> C[Azure Virtual Network]
    C --> D[Web Subnet - Public Site]
    C --> E[Application Subnet]
    C --> F[Database Subnet]
    D -->|NSG rules| E
    E -->|NSG rules| F
    G[On-Premises Office] -->|ExpressRoute| C
    H[Internet] -->|Azure Firewall| D
```

## Common misconceptions

- **Misconception:** A firewall alone is enough to secure a network. **Reality:** Firewalls are one layer. You also need segmentation, identity-based access, monitoring, and encryption. A firewall only inspects traffic — it does not authenticate users or detect all threats. (Beginners often think of security as a single wall, influenced by how pop culture portrays cybersecurity as one big lock.)
- **Misconception:** Once data is encrypted, you don't need network segmentation. **Reality:** Encryption protects data from being read if intercepted, but it does not prevent a compromised server from connecting to other servers and causing damage. Segmentation limits the blast radius. (People tend to equate secrecy with safety, not realising that a hacker inside the network can still move laterally and delete or modify data without needing to read its contents.)
- **Misconception:** A hybrid connection (like ExpressRoute) is automatically secure because it is private. **Reality:** It is more secure than the public internet, but you still must configure firewalls, access controls, and monitoring on both ends. The physical circuit is just the cable — you still need to secure what travels on it. (The term 'private connection' feels like a magic cloak of safety, but security policies and configuration are what create safety, not the medium itself.)
- **Misconception:** Cloud providers automatically secure all your network traffic. **Reality:** Cloud providers secure the physical infrastructure, but you are responsible for configuring network security groups, identity policies, encryption, and monitoring. This is the shared responsibility model. (People assume 'the cloud' is abstract and managed by someone else entirely. In reality, you have many configuration duties.)
- **Misconception:** A VPN makes all traffic safe because it is encrypted. **Reality:** A VPN encrypts traffic between the user and the network, but it does not protect against malware on the user's device, insider threats, or attacks that target the destination server after decryption. (VPN marketing often oversimplifies security, leading users to treat it as a silver bullet for all remote access risks.)

## Key takeaways

- Network security relies on defence in depth: firewalls, segmentation, encryption, identity verification, and monitoring working together, not any single tool.
- Zero Trust means never automatically trust any request, even from inside your network; always verify identity and device health before granting access.
- Network segmentation using subnets and Network Security Groups limits the damage if one part of your network is compromised.
- Hybrid connections like Azure ExpressRoute offer private, high-speed, and reliable links between your on-premises network and the cloud, but still need their own firewall rules.
- Microsoft Entra ID Conditional Access is a critical network security control because it enforces access policies based on user identity and device state, not just IP address.
- Exam questions often ask you to choose between ExpressRoute, site-to-site VPN, and point-to-site VPN; match the option to the business's speed, latency, and cost requirements.

## FAQ

**What is the difference between a VPN and a private connection like ExpressRoute?**

A VPN encrypts traffic over the public internet, while ExpressRoute uses a dedicated physical cable between your office and Azure, bypassing the internet entirely. ExpressRoute is faster and more reliable but costs more.

**Do I need both a firewall and network security groups?**

Yes. Network Security Groups (NSGs) control traffic within a virtual network (east-west), while a firewall like Azure Firewall controls traffic to and from the internet (north-south) and provides advanced features like threat intelligence. They are complementary.

**Is a VPN enough to secure remote workers?**

No. A VPN protects the data in transit, but you still need device health checks (via Conditional Access) and malware protection on the laptop. A hacker who gains control of the laptop will have full VPN access to your network.

**What does Zero Trust mean in simple terms?**

Trust no one automatically, even if they are already inside your network. Every request must prove its identity and pass a security check. It is like having a security guard at every door, even inside the building.

**Can I connect my office directly to the cloud without using a VPN?**

Yes, using Azure ExpressRoute. It provides a direct private connection between your office router and Azure's network. This bypasses the public internet entirely, offering better performance and security for critical workloads.

**What happens if I put all my resources in one subnet without segmentation?**

If a hacker compromises one resource (like a web server), they can freely move to any other resource in that subnet, including your database. Segmentation isolates them, so a breach stays contained.

## Check your understanding

1. **What is the primary difference between how Network Security Groups (NSGs) and Azure Firewall control traffic?**

   Answer: NSGs control traffic within a virtual network (east-west), while Azure Firewall controls traffic to/from the internet (north-south) and provides advanced features like threat intelligence.

2. **In a scenario where a company requires a high-bandwidth, low-latency connection between its office and Azure for critical data replication, which hybrid connectivity option should be chosen?**

   Answer: Azure ExpressRoute, because it provides a dedicated private connection with high bandwidth and consistent low latency, unlike VPN which uses the public internet.

3. **What is the core principle of Zero Trust that differentiates it from traditional perimeter-based security?**

   Answer: Zero Trust never automatically trusts any request, even from inside the network; it requires continuous verification of identity and device health before granting access.

4. **Why is network segmentation considered a critical security measure even when all traffic is encrypted?**

   Answer: Encryption protects data from being read if intercepted, but does not prevent a compromised server from connecting to other systems; segmentation limits the attack's spread.

5. **Which Microsoft tool should a security architect use to continuously monitor network traffic, generate alerts, and provide a visual topology of a hybrid environment?**

   Answer: Microsoft Defender for Cloud, which offers security recommendations, network maps, and threat detection across on-premises and cloud resources.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/sc-100/network-and-hybrid-infrastructure-security