Your organization is migrating a complex multi-tier application to Azure. You need to ensure that the web tier can only communicate with the app tier, and the app tier can only communicate with the database tier. All other traffic should be denied. What is the most granular and efficient way to implement this within a VNet?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Network Security Groups (NSGs) with Application Security Groups (ASGs)

ASGs allow you to group servers with similar functions (like 'Web' or 'DB') and write NSG rules that use those groups as source/destination, simplifying complex security policies....

๐Ÿ“‹Part of Microsoft Certified: Azure Solutions Architect Expert (AZ-305) ยท Azure Certification Practice
Real Exam ScenarioNetwork Security Groups (NSG)

Your organization is migrating a complex multi-tier application to Azure. You need to ensure that the web tier can only communicate with the app tier, and the app tier can only communicate with the database tier. All other traffic should be denied. What is the most granular and efficient way to implement this within a VNet?

โœ“ Correct Answer & ExplanationNetwork Security Groups (NSG)

Correct Answer

Network Security Groups (NSGs) with Application Security Groups (ASGs)

Why This Answer Is Correct

ASGs allow you to group servers with similar functions (like 'Web' or 'DB') and write NSG rules that use those groups as source/destination, simplifying complex security policies.

๐Ÿ“š What This Question Tests

This question evaluates your knowledge of Network Security Groups (NSG) โ€” a core concept tested in Microsoft Certified: Azure Solutions Architect Expert (AZ-305). Understanding Network Security Groups (NSG) is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.