AZ-305 Design infrastructure solutions Practice Question
A company is designing a virtual network architecture for a three-tier application (web, application, database). They want network isolation between tiers and secure access from the internet to the web tier only. Which Azure networking solution should they use?
⚠ Common exam trap
The trap here is that candidates often over-engineer the solution by choosing Azure Firewall or an NVA for basic isolation, not realizing that NSGs with subnets are the native, cost-effective, and fully supported method for network segmentation within a single Azure VNet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Virtual Network with subnets for each tier and Network Security Groups.
Deploying each tier in its own subnet within an Azure Virtual Network and applying Network Security Groups (NSGs) allows granular inbound/outbound rule enforcement. NSGs can restrict traffic so that only the web tier is reachable from the internet (via a public IP or Azure Load Balancer), while the application and database tiers are isolated from direct internet access and can only communicate with the adjacent tier as defined by NSG rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Virtual Network with subnets for each tier and Network Security Groups.
Why this is correct
This approach uses separate subnets for the web, application, and data tiers, establishing Layer-3 network boundaries within the virtual network. Network Security Groups (NSGs) are stateful, built-in filters that you associate with each subnet to enforce inbound and outbound rules, such as allowing internet traffic only to the web tier on ports 80/443 and permitting the web subnet to talk to the app subnet on a specific application port. Because NSGs are natively supported and incur no extra cost, this is the most efficient and standard method for isolating tiers and controlling east-west traffic without introducing additional appliances or routing complexity.
- ✗
Azure Virtual Network with a single subnet and application security groups.
Why it's wrong here
A single subnet offers no Layer-3 separation between tiers; all virtual machines remain in the same broadcast domain and share the same route table and subnet-level policies. Application Security Groups (ASGs) only group VM NICs by workload attributes (for example, 'Web' or 'App') and require explicit NSG rules referencing those ASGs to filter traffic between them, which is essentially logical tag-based control rather than a physical or network boundary. Additionally, ASGs cannot replace subnet segregation for capabilities like service endpoints, route tables, or VNet peering filters, and misconfigurations can leave unexpected traffic flows. This makes the solution less secure and harder to manage at scale, which is why it is incorrect for a three-tier architecture.
- ✗
Azure Virtual Network with subnets and Azure Firewall.
Why it's wrong here
Azure Virtual Network with subnets provides logical segmentation, but Azure Firewall primarily offers centralised network security policy enforcement and traffic filtering for perimeter security or across virtual network boundaries. While it can filter inter-subnet traffic with User Defined Routes, it is not the most direct mechanism for granular network isolation *between tiers* within a single virtual network. This is typically achieved more precisely using Network Security Groups (NSGs) on each subnet to control ingress and egress traffic flows. Azure Firewall is highly effective for securing internet access and managing outbound traffic from the application.
- ✗
Azure Virtual Network with subnets and a network virtual appliance (NVA).
Why it's wrong here
While subnets provide basic isolation, an NVA requires complex routing and manual management to enforce granular traffic filtering between tiers. This approach is typically utilised when organisations require third-party security features or deep packet inspection that native Azure Network Security Groups do not offer. In this scenario, the requirement for tier isolation and internet access control is satisfied by using subnets combined with Network Security Groups (NSGs) rather than external appliances.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.