AZ-305 Design infrastructure solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Azure Front Door, service endpoints, and Azure SQL Database with firewall rules.

  Why it's wrong here

  Azure Front Door is a global Layer 7 CDN/load balancer, not a regional gateway designed for a single three-tier application; it adds unnecessary latency and cost unless you need multi-region web acceleration. Service endpoints for Azure SQL Database still rely on the database's public endpoint and only restrict source IPs to the VNet, leaving the service vulnerable to data exfiltration if a compromised resource inside the VNet is able to reach it. Firewall rules on the SQL logical server complement service endpoints but do not replace Private Endpoints, which attach a private NIC to the VNet and remove public exposure entirely. Therefore, this architecture fails to meet the security and segmentation requirements of a private three-tier application.

• ✓

  Use Azure Application Gateway with WAF, network security groups (NSGs) on subnets, and Azure Private Endpoints for the database.

  Why this is correct

  Azure Application Gateway with WAF provides the required Layer 7 internet-facing ingress, offering TLS offload, path-based routing, and OWASP Top 10 protection, which is superior to a simple load balancer for a three-tier app. Network security groups (NSGs) applied to each subnet establish explicit allow/deny rules between the web, application, and data tiers, enabling least-privilege communication and preventing lateral movement if one tier is compromised. Azure Private Endpoints for the database place the Azure SQL Database into the VNet with a private IP address, ensuring traffic never traverses the public internet and can be further secured with NSGs on the subnet or with Network Security Perimeter controls. This combination of L7 WAF protection, subnet segmentation, and private connectivity is the industry best practice for a secure three-tier architecture on Azure.

• ✗

  Use Azure Load Balancer, Azure Firewall, and Azure SQL Database with public endpoint.

  Why it's wrong here

  Azure Load Balancer operates at Layer 4 only, providing NAT and distribution rules over TCP/UDP without any awareness of HTTP paths or application-level inspection; it cannot protect against SQL injection or other web application attacks the way WAF does. Azure Firewall is a stateful network firewall that can enforce east-west and north-south rules, but it does not replace NSGs for fine-grained subnet-level filtering, and without a WAF the web tier remains exposed to application-layer threats. Exposing the Azure SQL Database via a public endpoint is a fundamental security anti-pattern because it makes the database reachable from the internet, forcing reliance on firewall IP rules that are static and often misconfigured. Consequently, this design lacks both required L7 protection for the web front end and private, secure connectivity to the data tier.

• ✗

  Use a single virtual network with three subnets, no NSGs, and Azure SQL Database with VNet injection.

  Why it's wrong here

  Creating a single virtual network with three subnets and no NSGs removes all traffic filtering between tiers, allowing any resource in the web tier to freely communicate with the data tier, which violates the security principle of least privilege and greatly increases the blast radius of a compromised VM. VNet injection is supported for Azure SQL Managed Instance, but not for standard Azure SQL Database elastic pools or single databases; standard SQL Database uses logical server connectivity and cannot be directly injected into a subnet, so this premise is technically invalid. If you attempt to use this pattern without NSGs or a network virtual appliance, there is no mechanism to enforce security rules, and the database may inadvertently be exposed via service endpoints or firewall misconfigurations. Thus, the design lacks both the required traffic control and the correct PaaS connectivity model, making it unsuitable for a production three-tier environment.

Go deeper

Related to this question