AZ-500 Question 44
Select 2Your organization hosts a multi-tier application in Azure, with a front-end subnet for web servers and a back-end subnet for databases in the same virtual network. You need to allow inbound HTTP traffic from the internet to the front-end subnet while ensuring the back-end subnet only accepts traffic from the front-end subnet. Which two actions should you take to meet these requirements?
- A
Create an NSG for the front-end subnet that allows inbound HTTP traffic from any source.
- B
Deploy an Azure Application Gateway to the back-end subnet to restrict inbound traffic from the internet.
- C
Create an NSG for the back-end subnet that allows inbound traffic only from the front-end subnet and denies all other inbound access.
- D
Enable Network Virtual Appliance (NVA) forwarding for inbound internet traffic directly to the back-end subnet.
Show answer and explanation
Correct answers: A, C
Explanation
To secure a multi-tier architecture in Azure, each subnet should have its own NSG tailored to its role. The front-end NSG allows HTTP/HTTPS from the internet, while the back-end NSG restricts inbound traffic to only the front-end subnet. These practices align with Microsoft’s Azure Network Security guidance (https://learn.microsoft.com/azure/networking/security-overview).
- A. Correct.
Option 1 is correct. You must enable inbound HTTP traffic from the public internet specifically on the subnet where your web servers (front-end tier) reside. Configuring an NSG with an allow rule for port 80 (HTTP) from any source to the front-end subnet meets this requirement.
- B. Incorrect.
Option 2 is incorrect. While Application Gateway can be used for web traffic and load balancing, simply placing it in the back-end subnet doesn’t restrict internet traffic as required. App Gateway typically sits in front of the front-end subnet, not the back-end database subnet.
- C. Correct.
Option 3 is correct. To protect the database subnet, you need an NSG that only permits traffic from the front-end subnet’s IP ranges while denying direct inbound traffic from anywhere else. This ensures that the backend remains isolated from external sources.
- D. Incorrect.
Option 4 is incorrect. Enabling NVA forwarding for inbound traffic doesn’t, by itself, prevent direct inbound internet connections to the back-end subnet. You must still filter or block inbound internet traffic at an NSG or firewall. Simply forwarding traffic does not enforce the requested isolation.