Network Segmentation with NSGs and Subnets
You are designing a network security solution for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must be isolated. Which TWO configurations should you implement?
Quick Answer
The correct answer is to deploy each tier in a separate subnet and use Network Security Groups (NSGs) to restrict traffic between those subnets. This configuration works because NSGs act as a built-in, stateful firewall that allows you to define granular inbound and outbound rules at the subnet or network interface level, while separate subnets provide the logical isolation needed to enforce those rules effectively. On the Microsoft Azure Security Engineer Associate AZ-500 exam, network segmentation using NSGs and subnets is a core concept for designing secure multi-tier applications, and the most common trap is assuming a single subnet with multiple NSGs is sufficient—it is not, because NSGs cannot isolate traffic within the same subnet. A key memory tip is "separate subnets, separate rules": think of each tier as its own security zone, with the NSG as the gatekeeper between them.
⚠ Common exam trap
Test-takers frequently assume separate VNets are required for isolation, but Azure's subnet-level NSGs provide the same isolation with lower complexity and cost, making separate subnets the correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use network security groups (NSGs) on each subnet
Network security groups (NSGs) provide stateful filtering of inbound and outbound traffic at the subnet or NIC level. By placing each tier in a separate subnet and applying distinct NSG rules, you can allow inbound HTTP/HTTPS traffic from the internet to the web tier subnet while blocking all inbound traffic from the internet to the application and database subnets. This ensures the application and database tiers are isolated from direct internet access while still allowing necessary traffic between tiers via internal IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use network security groups (NSGs) on each subnet
Why this is correct
NSGs filter traffic between subnets.
- ✗
Deploy each tier in a separate VNet
Why it's wrong here
Possible but overkill; subnets within a VNet are sufficient.
- ✓
Deploy each tier in a separate subnet
Why this is correct
Separate subnets allow NSG rules to control traffic.
- ✗
Use VNet peering to connect the tiers
Why it's wrong here
Peering is for connecting separate VNets, not for isolation within a VNet.
- ✗
Place all VMs in the same subnet
Why it's wrong here
Same subnet allows unrestricted traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are designing a network security strategy for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must only be accessible from the web tier. Which Azure solution should you use to isolate the tiers?
medium- A.Azure DDoS Protection
- B.Azure Firewall with application rules
- ✓ C.Network security groups (NSGs) on each subnet
- D.Azure Private Link
Why C: Network security groups (NSGs) on each subnet are the correct solution because they provide stateful, layer-3/layer-4 traffic filtering at the subnet level. By placing the web tier in a subnet with an NSG that allows inbound HTTP/HTTPS from the internet, and placing the application and database tiers in separate subnets with NSGs that only allow inbound traffic from the web tier subnet (using source IP ranges or service tags), you effectively isolate the tiers while permitting the required east-west traffic.
Variation 2. You are designing a secure network for a three-tier application. The web tier must be accessible from the internet on port 443. The application tier should only be reachable from the web tier. The database tier should only be reachable from the application tier. Which Azure service should you use to enforce these restrictions?
easy- A.Azure VPN Gateway.
- ✓ B.Network security groups (NSGs) on each subnet.
- C.Azure Front Door.
- D.Azure Firewall in the hub.
Why B: Network security groups (NSGs) allow you to define inbound and outbound security rules at the subnet or NIC level. By placing each tier in its own subnet and applying NSG rules, you can restrict traffic so that only the web tier (port 443) is exposed to the internet, the application tier accepts traffic only from the web tier subnet, and the database tier accepts traffic only from the application tier subnet. This provides granular, stateful filtering that directly enforces the required east-west and north-south restrictions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.