Question

A company is designing an Azure virtual network to host a three-tier application (web, application, and database tiers). Security requires that the database tier only be reachable from the application tier, and never directly from the internet-facing web tier or public internet. Which core infrastructure security approach best achieves this isolation between tiers?

Accepted Answer

Use network segmentation with separate subnets and network security groups to control traffic flow between tiers

Answer

Deploy all three tiers into a single subnet and rely on Azure DDoS Protection

Answer

Enable Azure Bastion to provide secure administrative access to the database tier

Answer

Store the database connection strings in Azure Key Vault to prevent unauthorized access