Network Segmentation with NSGs and Subnets
You are designing a network security solution for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must be isolated. Which TWO configurations should you implement?
Quick Answer
The correct answer is to deploy each tier in a separate subnet and use Network Security Groups (NSGs) to restrict traffic between those subnets. This configuration works because NSGs act as a built-in, stateful firewall that allows you to define granular inbound and outbound rules at the subnet or network interface level, while separate subnets provide the logical isolation needed to enforce those rules effectively. On the Microsoft Azure Security Engineer Associate AZ-500 exam, network segmentation using NSGs and subnets is a core concept for designing secure multi-tier applications, and the most common trap is assuming a single subnet with multiple NSGs is sufficient—it is not, because NSGs cannot isolate traffic within the same subnet. A key memory tip is "separate subnets, separate rules": think of each tier as its own security zone, with the NSG as the gatekeeper between them.
⚠ Common exam trap
Test-takers frequently assume separate VNets are required for isolation, but Azure's subnet-level NSGs provide the same isolation with lower complexity and cost, making separate subnets the correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use network security groups (NSGs) on each subnet
Option C is correct because placing each tier in its own subnet provides the network segmentation needed to isolate the application and database tiers from the internet-facing web tier, allowing you to apply distinct security rules per tier. Option A is correct because network security groups (NSGs) applied to each subnet let you enforce inbound and outbound rules that permit internet traffic only to the web tier while restricting the app and database tiers to internal traffic. Together, separate subnets plus per-subnet NSGs deliver the required multi-tier isolation. Option B is not needed because separate VNets add complexity and require peering for tier-to-tier communication, which is unnecessary for isolation. Option D is incorrect because VNet peering connects VNets rather than isolating tiers within a single VNet. Option E is incorrect because placing all VMs in one subnet removes the segmentation boundary needed to isolate the app and database tiers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use network security groups (NSGs) on each subnet
Why this is correct
Network security groups apply stateful allow and deny rules at the subnet and NIC level, so the web tier accepts internet traffic while application and database subnets reject unsolicited inbound flows. This enforces the required tier isolation directly.
- ✗
Deploy each tier in a separate VNet
Why it's wrong here
Separate VNets per tier do not by themselves isolate traffic; without peering or NSGs the tiers cannot communicate at all, and the web tier still needs controlled access to the application tier. It is tempting because VNets feel like strong boundaries, but subnets plus NSGs deliver the required tiered isolation.
- ✓
Deploy each tier in a separate subnet
Why this is correct
Separate subnets give each tier its own address boundary, which is the prerequisite for applying distinct network security group rules and route controls per tier. Without this segmentation, the web tier and database tier would share one rule scope, preventing isolation.
- ✗
Use VNet peering to connect the tiers
Why it's wrong here
VNet peering links virtual networks for full bidirectional traffic, which would let the application and database tiers reach each other and the web tier, defeating the isolation requirement. It is tempting because peering is the standard way to connect separate VNets, but isolation here needs NSGs and separate subnets, not peering.
- ✗
Place all VMs in the same subnet
Why it's wrong here
A single subnet gives every VM direct layer-2 reachability, so the application and database tiers cannot be isolated from the internet-facing web tier. It is tempting because one subnet simplifies addressing, but tier isolation requires separate subnets with NSG rules controlling traffic between them.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are designing a network security strategy for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must only be accessible from the web tier. Which Azure solution should you use to isolate the tiers?
medium- A.Azure DDoS Protection
- B.Azure Firewall with application rules
- ✓ C.Network security groups (NSGs) on each subnet
- D.Azure Private Link
Why C: Network security groups (NSGs) on each subnet are the correct solution because they provide stateful, layer-3/layer-4 traffic filtering at the subnet level. By placing the web tier in a subnet with an NSG that allows inbound HTTP/HTTPS from the internet, and placing the application and database tiers in separate subnets with NSGs that only allow inbound traffic from the web tier subnet (using source IP ranges or service tags), you effectively isolate the tiers while permitting the required east-west traffic.
Variation 2. You are designing a secure network for a three-tier application. The web tier must be accessible from the internet on port 443. The application tier should only be reachable from the web tier. The database tier should only be reachable from the application tier. Which Azure service should you use to enforce these restrictions?
easy- A.Azure VPN Gateway.
- ✓ B.Network security groups (NSGs) on each subnet.
- C.Azure Front Door.
- D.Azure Firewall in the hub.
Why B: Network security groups (NSGs) allow you to define inbound and outbound security rules at the subnet or NIC level. By placing each tier in its own subnet and applying NSG rules, you can restrict traffic so that only the web tier (port 443) is exposed to the internet, the application tier accepts traffic only from the web tier subnet, and the database tier accepts traffic only from the application tier subnet. This provides granular, stateful filtering that directly enforces the required east-west and north-south restrictions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.