AZ-500 Secure networking Practice Question

You are designing a secure network architecture for a three-tier application. The web tier must be accessible from the internet, while the application and database tiers must only be accessible from the web tier. Which Azure service should you use to isolate the tiers most securely?

⚠ Common exam trap

A common mix-up: candidates choose Azure Firewall or Front Door because they associate 'security' with those services, but the question specifically asks for isolating tiers within a VNet, which is a classic network segmentation task best solved by NSGs on subnets, not by perimeter or edge security appliances.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Network security groups (NSGs) on subnets

Network security groups (NSGs) on subnets are the correct choice because they provide stateful, layer-3/layer-4 traffic filtering at the subnet level, allowing you to explicitly deny all inbound traffic to the application and database subnets except from the web tier's subnet or private IP range. This creates a micro-segmentation boundary that enforces the principle of least privilege without introducing additional latency or routing complexity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Azure Firewall with application rules
Why it's wrong here
Azure Firewall with application rules is an unnecessary escalation for three-tier internal isolation. Application rules filter outbound HTTP/S FQDN traffic from a central appliance, but east-west traffic between tiers is typically IP/port-based and can be controlled with subnet-scoped NSGs without forcing all packets through a managed firewall that incurs cost and latency. For a three-tier VNet, native NSGs deliver the same network segmentation with less operational overhead.
✗
Azure Front Door with Web Application Firewall
Why it's wrong here
Azure Front Door with Web Application Firewall is a global Layer 7 HTTP/S edge service designed to accelerate and protect internet-facing web applications. It cannot inspect or filter traffic between subnets inside a virtual network because it operates externally at the edge and is not injected into the VNet data path. Applying it here would ignore the east-west traffic that needs isolation and provide no benefit for internal tier separation.
✓
Network security groups (NSGs) on subnets
Why this is correct
Network security groups on subnets are the correct control because they provide stateful filtering directly within the VNet using source/destination IP, port, and protocol. By associating an NSG to the web, app, and data subnets, you can enforce explicit allow rules for the necessary traffic (e.g., web to app on port 443) and add deny rules to block all other cross-tier traffic. This is the native, no-cost technique Azure provides for network segmentation, and it operates at both subnet and NIC levels for fine-grained control.
✗
VNet peering between tiers
Why it's wrong here
VNet peering only establishes connectivity between virtual networks, allowing IP traffic between them; it has no filtering or isolation capability by itself. In a three-tier architecture the tiers are normally separate subnets in the same VNet, so peering is not even the right mechanism to connect them. Even if peering were used across VNets, you would still need explicit NSGs or network virtual appliances on both sides to enforce the required isolation.

Visual reference

Go deeper

AZ-500 Secure networking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question