A municipal design places the citizen web tier and the database tier in separate segments inside one Azure Virtual Network. What Azure networking concept provides that segmentation?
Select an answer to reveal the explanation.
Short Explanation
Subnets are the lanes inside a VNet — web in one lane, data in another. Availability sets and management groups are about VMs and org hierarchy, not IP segment lines. Slice the VNet with subnets.
Full Explanation
Subnets divide a Virtual Network into separate address ranges so application tiers can be segmented inside one VNet. Placing a citizen web tier in one subnet and a database tier in another is the classic municipal pattern: shared private network fabric, clearer NSG boundaries, and cleaner routing between layers without inventing separate VNets for every tier. Availability sets improve VM fault and update domain distribution within a datacenter footprint; they do not replace subnets for IP segmentation. Management groups organize subscriptions for governance hierarchy; they do not assign private IPs to application tiers. Azure Files permissions control share access for folders, not VNet address segmentation. Subnet design should leave growth room for each municipal tier as new services arrive. Exam caveat: subnetting helps micro-segmentation, but without NSGs and related controls the tiers may still talk more freely than intended—address slicing is necessary but not sufficient by itself. Operational check: inspect the VNet’s subnet list, confirm web and database address ranges do not overlap, and validate NSG rules allow only the required east-west ports between those municipal tiers.