Quick Note — Recommend a Solution to Optimize Network Security
AZ-305 › Unit 4: Design infrastructure solutions › Design network solutions › Recommend a solution to optimize network security
Quick Note — Recommend a Solution to Optimize Network Security
A large regulated bank's annual penetration test report lands on the architect's desk. The findings are extensive: VMs in production with NSGs allowing the internet ($0.0.0.0/0$) inbound on common admin ports such as RDP 3389 and SSH 22; no central egress filtering or auditing of outbound traffic; storage accounts and SQL databases with public endpoints reachable from anywhere on the internet with only allow-list firewall rules; a flat VNet topology with no internal segmentation, so any compromised VM can reach every other VM laterally.…
Retrieval target
- Recommend a Solution to Optimize Network Security
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Network Security Group (NSG) | A stateful packet filter attached to a subnet or NIC. Each NSG holds a prioritised list of allow / deny rules over 5-tuples (source IP, source port, dest IP, dest port, protocol). Applied to traffic entering or leaving the subnet / NIC. Default rules block all inbound from non-VNet sources and allow all outbound to internet — override per workload. |
Application Security Group (ASG) | A named group of VM NICs that you reference inside NSG rules instead of IP addresses (Allow tcp 443 from ASG-Web → ASG-App). Membership is dynamic — add / remove NICs without rewriting NSG rules. Eliminates the IP-address brittleness of NSG rules; the recommended way to model app tiers in a VNet. |
Azure Firewall — Basic / Standard / Premium | Microsoft's managed stateful L4-L7 firewall for VNets. Tiers: Basic — small workloads, 250 Mbps, no IDPS. Standard — full L3-L7 filtering, FQDN tags, threat-intel, 30 Gbps. Premium — adds TLS inspection, IDPS (Suricata signatures), URL filtering, Web categories. Pick Premium for prod with deep-packet-inspection requirements. |
WAF Policy (App Gateway / Front Door) | A reusable policy of OWASP rule sets + custom rules that the platform applies to incoming HTTP. Built-in rule sets: OWASP CRS $3.x$ (cross-site scripting, SQL injection, file inclusion, etc.) and MS-Bot-Manager-RuleSet. Modes: Detection (log only) and Prevention (block + log). Attachable to App Gateway and Front Door; reusable across multiple front-ends. |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.