AZ-104 Implement and Manage Virtual Networking Practice Question
You are designing an Azure virtual network for a three-tier application. The frontend, application, and database tiers each require their own subnet. You need to ensure that the frontend tier can communicate with the application tier, but the database tier must be isolated from direct inbound traffic from the internet. Which three of the following actions should you include in your design? (Choose three.)
⚠ Common exam trap
Watch out — candidates often think they need to create separate virtual networks or use complex routing/firewall rules for isolation, when in fact a single VNet with subnets and an NSG on the database subnet is sufficient to meet the requirement of isolating the database from the internet while allowing frontend-to-application communication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a network security group (NSG) to the database subnet that denies all inbound traffic from the internet.
Assigning a network security group (NSG) to the database subnet that denies all inbound traffic from the internet is correct because NSGs act as a distributed, stateful firewall at the subnet or NIC level. By default, NSGs allow all inbound traffic from within the virtual network, so you must explicitly add a deny rule for internet traffic (source 'Internet') to isolate the database tier. This ensures the database subnet is protected from direct inbound internet traffic while still allowing traffic from the application tier via the default allow rule for virtual network traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign a network security group (NSG) to the database subnet that denies all inbound traffic from the internet.
Why this is correct
Assigning an NSG to the database subnet is a correct control because it applies stateful, rule-based filtering at the subnet boundary, and a default-deny rule for inbound internet traffic blocks any attempt to reach the database directly from a public IP. You can then explicitly allow only the application tier's private IP address space on port 1433 (or your database port), implementing least-privilege access. This is a core defense-in-depth measure for a multi-tier workload.
- ✓
Create a single virtual network with three subnets: frontend, application, and database.
Why this is correct
A single virtual network with three subnets is correct because Azure VNets natively support multiple subnets within the same address space, and traffic between subnets is automatically routed without any peering or gateway. This structure lets you apply distinct NSGs to each tier—frontend, application, and database—while keeping the entire workload inside one private, contiguous IP plan. It also simplifies management because route tables and diagnostic settings can be applied at the subnet level.
- ✗
Configure a virtual network peering to connect the frontend and database subnets.
Why it's wrong here
Virtual network peering is the wrong tool here because peering connects two separate virtual networks, not subnets within the same VNet. Subnets in a single VNet already have implicit connectivity and do not require any peering relationship; attempting to peer subnets is conceptually invalid and not supported in Azure. If the goal were to connect separate VNets, peering would be relevant, but for tier separation within one VNet it is unnecessary and misleading.
- ✗
Use Azure Firewall to inspect traffic between the frontend and application tiers.
Why it's wrong here
Using Azure Firewall to inspect traffic between the frontend and application tiers is not the correct answer for this design because Azure Firewall is a managed, layer-3/7 service intended for centralized inspection across VNets or at the perimeter, not for simple intra-VNet subnet-to-subnet filtering. For east-west traffic between subnets inside the same VNet, network security groups are typically sufficient and more cost-effective. Deploying a firewall here would add complexity and require user-defined routes to force traffic, which is unnecessary for a three-tier application.
- ✗
Route traffic from the application tier to the database tier using a user-defined route (UDR) pointing to the Azure Firewall.
Why it's wrong here
Routing application-to-database traffic through a UDR that points to Azure Firewall is wrong in this scenario because it introduces unnecessary chaining and cost; the database subnet should be protected by NSGs that only permit the application tier, not by forcing all traffic through a stateful firewall. A UDR is useful for forced tunneling or when you need an NVA/appliance, but Azure's default system routes already provide connectivity between subnets within the VNet. Also, if the UDR's next hop is a firewall, the firewall must have SNAT and high availability considerations, complicating a simple architecture.
- ✓
Place all three tiers in the same virtual network using separate subnets.
Why this is correct
Placing all three tiers in the same VNet using separate subnets is a correct and recommended pattern because it provides network isolation at layer 3 while preserving private communication. Each subnet can have its own NSG and service endpoints—for example, restricting database traffic to only the application subnet and allowing internet traffic only to the frontend. This approach avoids the overhead and complexity of VNet peering or transit routing, and it keeps the application's address space cohesive and easy to manage.
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
Key term
Network security
Network security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, ensuring the confidentiality, integrity, and availability of data and resources.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.