A company is designing a virtual network architecture for a three-tier application (web, application, database). They want network isolation between tiers and secure access from the internet to the web tier only. Which Azure networking solution should they use?

Azure Virtual Network with a single subnet and application security groups.

A single subnet does not provide network-level isolation between tiers. Application Security Groups (ASGs) can help, but they are not a substitute for subnet-level security boundaries.

Azure Virtual Network with subnets and Azure Firewall.

Azure Firewall is a managed, cloud-native network security service for perimeter protection. While it can filter traffic, placing it between subnets adds unnecessary cost and complexity for internal tier isolation; NSGs are more appropriate.

Azure Virtual Network with subnets and a network virtual appliance (NVA).

An NVA can provide advanced inspection but is unnecessary for the stated requirement for simple tier isolation. NSGs are simpler and more cost-effective for this scenario.

What does this AZ-305 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Azure Virtual Network with subnets for each tier and Network Security Groups. — Network Security Groups (NSGs) on subnets provide fine-grained traffic control between tiers. By placing each tier in its own subnet and associating NSGs, you can restrict inbound traffic to the web subnet from the internet and only allow specific traffic between tiers. Application security groups can also be used but are not a replacement for subnet-level isolation. Azure Firewall or NVAs are typically used for perimeter security, not internal segmentation.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.