Case Study 2 - Contoso, Ltd Overview Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market. Contoso products are…

To effectively segment and secure a three-tier application in Azure, a single virtual network should be used, with each application tier placed into its own dedicated subnet.

Submitted by manish99· Mar 4, 2026Deploy and manage Azure compute resources

Question

Case Study 2 - Contoso, Ltd Overview Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market. Contoso products are manufactured by using blueprint files that the company authors and maintains. Existing Environment Currently, Contoso uses multiple types of servers for business operations, including the following: - File servers - Domain controllers - Microsoft SQL Server servers Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory. You have a public-facing application named App1. App1 is comprised of the following three tiers: - A SQL database - A web front end - A processing middle tier Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only. Requirements Planned Changes Contoso plans to implement the following changes to the infrastructure: - Move all the tiers of App1 to Azure. - Move the existing product blueprint files to Azure Blob storage. - Create a hybrid directory to support an upcoming Microsoft Office 365 migration project. Technical Requirements Contoso must meet the following technical requirements: - Move all the virtual machines for App1 to Azure. - Minimize the number of open ports between the App1 tiers. - Ensure that all the virtual machines for App1 are protected by backups. - Copy the blueprint files to Azure over the Internet. - Ensure that the blueprint files are stored in the archive storage tier. - Ensure that partner access to the blueprint files is secured and temporary. - Prevent user passwords or hashes of passwords from being stored in Azure. - Use unmanaged standard storage for the hard disks of the virtualmachines. - Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity. - Minimize administrative effort whenever possible. User Requirements Contoso identifies the following requirements for users: - Ensure that only users who are part of a group named Pilot can join devices to Azure AD. - Designate a new user named Admin1 as the service administrator of the Azure subscription. - Ensure that a new user named User3 can create network objects for the Azure subscription. Hotspot Question You need to recommend a solution for App1. The solution must meet the technical requirements. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

Number of virtual networks:
123
Number of subnets per virtual network:
123

Explanation

To effectively segment and secure a three-tier application in Azure, a single virtual network should be used, with each application tier placed into its own dedicated subnet.

Approach. The correct interaction is to select '1' for 'Number of virtual networks' and '3' for 'Number of subnets per virtual network'.

Number of virtual networks: 1 Contoso's App1 is described as a single application with three tiers that need to communicate. For a single application deployment, the best practice in Azure is to contain all its tiers within a single Azure Virtual Network (VNet). This simplifies network architecture, routing, and management, and avoids the complexity and potential latency/cost of VNet peering that would be required if multiple VNets were used for a single application.

Number of subnets per virtual network: 3 App1 consists of three distinct tiers: a SQL database, a web front end, and a processing middle tier. The technical requirement is to 'Minimize the number of open ports between the App1 tiers'. To achieve granular network security and control traffic flow between these tiers effectively (e.g., using Network Security Groups - NSGs), each tier should be placed in its own dedicated subnet. This allows for specific inbound and outbound rules to be applied to each subnet, ensuring that only necessary communication paths (i.e., minimal open ports) exist between the Web, Middle, and Database tiers.

Common mistakes.

common_mistake. 1. Choosing multiple virtual networks (2 or 3): While technically possible to separate tiers into different VNets and connect them via VNet peering, this adds unnecessary complexity, management overhead, and potential costs for a single application. It doesn't align with simplifying the infrastructure for a unified application deployment unless there are strong reasons for complete network isolation (e.g., different administrative domains, compliance boundaries, separate subscription ownership), which are not indicated here.

Choosing 1 subnet: Placing all three tiers into a single subnet would make it extremely difficult to 'Minimize the number of open ports between the App1 tiers' using subnet-level Network Security Groups (NSGs). NSGs primarily filter traffic between subnets or into/out of a VNet. Within the same subnet, traffic between VMs would not be filtered by NSG rules applied to the subnet itself, thus compromising the security segmentation requirement.
Choosing 2 subnets: This choice would force at least two of the application's three distinct tiers into the same subnet, violating the principle of isolating each tier for optimal security, manageability, and traffic control. This would make it harder to apply fine-grained security policies between those specific tiers.

Concept tested. Azure Virtual Network (VNet) design, subnetting best practices for multi-tier applications, network segmentation for security (implied NSG usage), and meeting application-specific networking requirements in Azure.

Reference. null

Topics

#Azure application migration#N-tier application design#Azure Virtual Machines#Azure network security

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice