You plan to deploy an SAP landscape on Azure that will use SAP HANA on Azure (Large Instances). You need to ensure that outbound traffic from the application tier can flow only to the database tier…

Question

Exhibit

Options

• Aapplication security groups
• Bnetwork security groups (NSGs)
• CAzure Firewall
• Dnetwork virtual appliances (NVAs)

• A
  83% (15)
• B
  6% (1)
• C
  11% (2)

Explanation

Application Security Groups (ASGs) are the right choice because they let you logically group Azure VMs by their role in the SAP landscape (e.g., an "AppTier" ASG and a "DBTier" ASG), then write NSG rules that reference those groups as source and destination - allowing outbound traffic from the app tier to reach only the database tier without hardcoding IP addresses.

NSGs (B) are the enforcement engine that uses ASGs; on their own they require IP-based rules, which become brittle as the environment scales - ASGs provide the logical grouping that makes NSG rules tier-aware. Azure Firewall (C) is a managed network-level firewall designed for perimeter/hub-spoke scenarios and is overkill (and costly) for controlling intra-environment, tier-to-tier traffic. NVAs (D) are third-party virtual appliances that serve a similar broad perimeter role and introduce unnecessary complexity for this targeted requirement.

Memory tip: Think of ASGs as "name tags for VMs by job title" - you tag the app servers with one group and DB servers with another, then write one clean rule: AppTier → DBTier allowed. When you see a question about controlling traffic between application tiers (not perimeter/internet), ASGs are the Azure-native answer.

No community discussion yet for this question.