Quick Note — Recommend a Solution to Optimize Network Security
AZ-305 › Unit 4: Design infrastructure solutions › Design network solutions › Recommend a solution to optimize network security
Quick Note — Recommend a Solution to Optimize Network Security
A large regulated bank's annual penetration test report lands on the architect's desk. The findings are extensive: VMs in production with NSGs allowing the internet ($0.0.0.0/0$) inbound on common admin ports such as RDP 3389 and SSH 22; no central egress filtering or auditing of outbound traffic; storage accounts and SQL databases with public endpoints reachable from anywhere on the internet with only allow-list firewall rules; a flat VNet topology with no internal segmentation, so any compromised VM can reach every other VM laterally.…
Retrieval target
- Recommend a Solution to Optimize Network Security
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Network Security Group (NSG) | A stateful packet filter attached to a subnet or NIC. Each NSG holds a prioritised list of allow / deny rules over 5-tuples (source IP, source port, dest IP, dest port, protocol). Applied to traffic entering or leaving the subnet / NIC. Default rules block all inbound from non-VNet sources and allow all outbound to internet — override per workload. |
Application Security Group (ASG) | A named group of VM NICs that you reference inside NSG rules instead of IP addresses (Allow tcp 443 from ASG-Web → ASG-App). Membership is dynamic — add / remove NICs without rewriting NSG rules. Eliminates the IP-address brittleness of NSG rules; the recommended way to model app tiers in a VNet. |
Azure Firewall — Basic / Standard / Premium | Microsoft's managed stateful L4-L7 firewall for VNets. Tiers: Basic — small workloads, 250 Mbps, no IDPS. Standard — full L3-L7 filtering, FQDN tags, threat-intel, Web categories (FQDN-based web content filtering), 30 Gbps. Premium — adds TLS inspection, IDPS (Suricata signatures), URL filtering (full path, needs TLS inspection), and web categories matched on the entire URL. Pick Premium when the requirement is TLS inspection, IDPS or full-path URL filtering; blocking a whole web category (gambling, social media) is already covered by Standard. |
WAF Policy (App Gateway / Front Door) | A reusable policy of Azure-managed rule sets + custom rules that the platform applies to incoming HTTP. Built-in rule sets: the Default Rule Set (DRS) $2.2 — the recommended set for new policies, baselined on OWASP CRS $3.3.4$ (cross-site scripting, SQL injection, file inclusion, etc.) plus Microsoft threat-intelligence rules — and the Bot Manager rule set. Front Door offers DRS only; Application Gateway WAF_v2 can still select OWASP CRS $3.2/$3.1/$3.0, but Learn files those under a legacy heading. Modes: Detection (log only) and Prevention (block + log). Attachable to App Gateway and Front Door; reusable across multiple front-ends. |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.