A night-shift design review stacks NSG, Azure Firewall, and Application Gateway on the same flow without clear roles. How should the security engineer assign jobs?
Select an answer to reveal the explanation.
Short Explanation
NSG = local 5-tuple bouncer, Firewall = hub egress/DNAT/FQDN/threat intel, Application Gateway = regional L7 reverse proxy. Stack them on purpose, not by accident.
Full Explanation
NSGs filter at subnet/NIC scope using 5-tuples. Azure Firewall centralizes spoke egress inspection, DNAT, FQDN application rules, and threat intelligence. Application Gateway is a regional Layer-7 HTTP(S) reverse proxy (with WAF as a related capability). Collapsing all roles into one product or swapping their jobs produces incorrect architectures. Bastion is a separate Domain 3 admin-access control and is not required to answer this service-selection item.