AZ-120 · Question #215
Drag and Drop Question You have an on-premises network and an Azure subscription. You plan to deploy a standard three-tier SAP architecture to a new Azure virtual network. You need to configure…
The correct answer is 3; 1. Azure NSG & Subnet Question - Explanation The Architecture A standard 3-tier SAP architecture has: Presentation tier (SAP GUI / web clients) Application tier (SAP app servers) Database tier (SAP HANA or similar) --- Correct Answer Breakdown | Target | Answer | Meaning |…
Question
Drag and Drop Question You have an on-premises network and an Azure subscription. You plan to deploy a standard three-tier SAP architecture to a new Azure virtual network. You need to configure network isolation for the virtual network. The solution must meet the following requirements:
- Allow client access from the on-premises network to the presentation
servers.
- Only allow the application servers to communicate with the database
servers.
- Only allow the presentation servers to access the application
servers.
- Block all other inbound traffic.
What is the minimum number of network security groups (NSGs) and subnets required? To answer, drag the appropriate number to the correct targets. Each number may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:
Exhibit
Answer Area
Drag items
Correct arrangement
- 3
- 1
Explanation
Azure NSG & Subnet Question - Explanation
The Architecture
A standard 3-tier SAP architecture has:
- Presentation tier (SAP GUI / web clients)
- Application tier (SAP app servers)
- Database tier (SAP HANA or similar)
Correct Answer Breakdown
| Target | Answer | Meaning |
|---|---|---|
| Subnets | 3 | One per tier |
| NSGs | 1 | One shared NSG, applied to all subnets |
Why 3 Subnets?
You need exactly 3 subnets - one per tier - because subnets are the foundational boundary that lets you write source/destination rules that distinguish tiers. Without separate subnets, you can't address the tiers independently in NSG rules.
10.0.1.0/24→ Presentation10.0.2.0/24→ Application10.0.3.0/24→ Database
You cannot do this with fewer subnets while still enforcing the isolation requirements.
Why Only 1 NSG?
This is the key insight. In Azure, a single NSG can be associated with multiple subnets, and because NSG inbound rules evaluate both source IP and destination IP, the same ruleset behaves differently depending on which subnet it's protecting.
One NSG with these inbound rules:
| Priority | Source | Destination | Action |
|---|---|---|---|
| 100 | On-premises CIDR | 10.0.1.0/24 (presentation) | Allow |
| 200 | 10.0.1.0/24 (presentation) | 10.0.2.0/24 (application) | Allow |
| 300 | 10.0.2.0/24 (application) | 10.0.3.0/24 (database) | Allow |
| 65500 | Any | Any | Deny (implicit) |
Applied to the Presentation subnet: Only Rule 100 can match inbound traffic (destination = presentation CIDR). Rules 200 and 300 target different destinations - they don't match inbound to presentation. Only on-premises traffic gets in.
Applied to the Application subnet: Only Rule 200 can match (destination = application CIDR). On-premises and database traffic is implicitly denied. Only presentation servers get in.
Applied to the Database subnet: Only Rule 300 can match (destination = database CIDR). Everything else is denied. Only application servers get in.
One NSG, three subnets, full isolation - all requirements met.
Common Mistakes
Mistake 1: Assuming you need 3 NSGs (one per subnet) The conventional approach is 1 NSG per subnet, which works fine - but it's not the minimum. The exam tests whether you know that an NSG with specific source+destination CIDR rules can be reused across subnets.
Mistake 2: Answering 1 subnet Some candidates think one subnet + NIC-level NSGs could work. Technically possible, but you'd still need multiple NSGs, and it eliminates the architectural boundary between tiers, which violates best practices and the spirit of the question.
Mistake 3: Confusing NSG scope NSGs can be applied at the subnet level or the NIC level - but not at the VNet level. A single NSG applied to the VNet won't work; it must be applied per-subnet or per-NIC.
Topics
Community Discussion
No community discussion yet for this question.