SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your company is adopting a Zero Trust network architecture. You need to implement microsegmentation for workloads running in Azure. Which Azure service should you use?
⚠ Common exam trap
Many candidates confuse Azure Firewall (a perimeter security service) with NSGs (a microsegmentation tool), mistakenly thinking a centralized firewall can achieve the same east-west traffic isolation that NSGs provide at the subnet/NIC level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Network Security Groups (NSGs)
Azure Network Security Groups (NSGs) are the correct service for implementing microsegmentation because they allow you to create granular, stateful filtering rules based on source/destination IP addresses, ports, and protocols at the subnet or individual virtual machine (NIC) level. This enables east-west traffic segmentation between workloads within the same virtual network, which is a core principle of Zero Trust network architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Network Security Groups (NSGs)
Why this is correct
Azure Network Security Groups (NSGs) are fundamental for implementing a Zero Trust network architecture by enabling microsegmentation. NSGs allow administrators to define granular inbound and outbound security rules that filter network traffic to and from Azure resources within a virtual network, such as VMs and subnets. This capability ensures that only explicitly authorized traffic can flow between specific workloads, enforcing the 'never trust, always verify' principle at the network layer and significantly reducing the attack surface.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a cloud-native, intelligent network security service that provides centralized network security policy and protection for all your virtual networks. While crucial for perimeter defense, threat intelligence, and egress filtering, it primarily operates at a broader network level. It is not designed to provide the fine-grained, internal microsegmentation between individual virtual machines or application components that is a cornerstone of a Zero Trust architecture.
- ✗
Azure App Service
Why it's wrong here
Azure App Service is a fully managed Platform-as-a-Service (PaaS) offering designed for building, deploying, and scaling web applications, APIs, and mobile backends. Its primary function is to host application code and manage the underlying infrastructure, abstracting away server management. App Service does not provide network security controls or mechanisms for defining granular traffic rules between internal network segments, which are essential for implementing Zero Trust principles.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global, scalable entry-point that leverages the Microsoft global edge network to create fast, secure, and widely scalable web applications. It functions as a global load balancer, site accelerator, and Web Application Firewall (WAF) for external-facing applications. While it enhances application security at the edge, it does not offer the internal network segmentation capabilities or granular access controls required to enforce Zero Trust principles within an organization's private network infrastructure.
Visual reference
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Denial-of-service
A Denial-of-service (DoS) attack is an attempt to make a computer, network, or online service unavailable to its intended users by overwhelming it with fake traffic or requests.
Key term
Terminal Access Controller Access Control System Plus
TACACS+ is a network security protocol that separates authentication, authorization, and accounting to control who can access network devices and what they can do.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.