AZ-500 Secure networking Practice Question
You are designing network security for a multi-tier application deployed in Azure. The application consists of a front-end web tier, a middle-tier API, and a back-end database. All tiers must be isolated from the internet except the front-end, which must accept HTTPS traffic from the internet. You need to ensure that no traffic can bypass the network security controls. What should you implement?
⚠ Common exam trap
Test-takers frequently assume NSGs alone are sufficient for full traffic control, but they fail to recognize that NSGs cannot enforce mandatory inspection or prevent traffic from bypassing controls when routes are not explicitly forced through a central firewall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Azure Firewall in a hub virtual network and route all traffic between tiers through the firewall for inspection.
Deploying Azure Firewall in a hub virtual network and routing all traffic between tiers through the firewall for inspection ensures that no traffic can bypass network security controls. This design enforces a forced tunneling architecture where all inter-tier traffic (e.g., from front-end to API to database) must traverse the firewall, allowing centralized inspection, logging, and filtering. This meets the requirement for complete isolation and control, as NSGs alone cannot prevent traffic from bypassing inspection if routes are not explicitly forced.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all tiers in the same virtual network and use Azure Front Door with WAF for the web tier, and rely on NSGs for internal traffic.
Why it's wrong here
Placing all tiers in the same virtual network with Azure Front Door WAF only protects the internet-facing web endpoint; Front Door is a global L7 load balancer and CDN that does not inspect east-west traffic between application tiers. Relying on NSGs alone for internal traffic is insufficient because NSGs provide subnet-level allow/deny rules without centralized threat detection, advanced logging, or application-aware filtering. If the web tier is compromised, lateral movement to other tiers is limited only by NSG rules that may be misconfigured or overly broad.
- ✗
Deploy Network Security Groups (NSGs) on each subnet and allow only necessary traffic between tiers.
Why it's wrong here
While NSGs provide subnet-level filtering, they can be bypassed if a VM in the front-end tier is compromised and initiates outbound traffic to the middle tier; NSGs are not stateful for outbound east-west traffic by default.
- ✓
Deploy Azure Firewall in a hub virtual network and route all traffic between tiers through the firewall for inspection.
Why this is correct
This is the correct approach because Azure Firewall is a managed, stateful firewall service designed for centralized inspection and control of all traffic, including east-west traffic between tiers. By placing Azure Firewall in a hub virtual network and configuring user-defined routes to force all inter-tier traffic through it, you create a security choke point that enforces consistent policies, provides FQDN filtering, and generates comprehensive logs for auditing. This gives you a single, centrally managed security boundary across the entire application.
- ✗
Use Azure Application Gateway with Web Application Firewall (WAF) in front of the web tier, and use NSGs for the other tiers.
Why it's wrong here
While Azure Application Gateway's WAF effectively shields the web tier from inbound internet threats, it has no architectural capability to inspect or govern traffic that flows from the web tier to the API tier or between other internal tiers. NSGs on the remaining tiers offer stateful, rule-based filtering but are decentralized, lack centralized logging and visibility, and do not provide the advanced threat detection or FQDN-level controls that a dedicated firewall offers. This design leaves east-west traffic largely unprotected and fails to enforce a consistent security policy.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.