Microsoft Cybersecurity Architect (SC-100)Design security for infrastructureEasy
A startup is deploying a new microservices-based application in Azure. Each microservice needs to communicate with other services securely over a private network, and all outbound traffic from the microservices must be inspected and filtered. The startup operates on a tight budget and needs a cost-effective solution that is easy to deploy and manage. Which network architecture pattern is most appropriate for this scenario?
- ADirect peering with Azure ExpressRoute
- BMesh network topology with service mesh (e.g., Istio)
- CFlat network topology with Network Security Groups (NSGs)
- DHub-and-spoke network topology with Azure Firewall
Show answer & explanationAnswer & explanation
Correct answer: D. Hub-and-spoke network topology with Azure Firewall
A hub-and-spoke topology centralizes network security with Azure Firewall in the hub, allowing all outbound traffic to be inspected and filtered, while spokes host microservices communicating privately. This provides centralized control and security at a reasonable cost for a startup.
Why the other options are wrong
- A. ExpressRoute provides private connectivity to on-premises, not a network architecture for microservices within Azure.
- B. A service mesh offers advanced microservice communication features but is often complex and costly for a startup's initial deployment.
- C. A flat network with NSGs lacks centralized inspection and is harder to manage for microservices.
Hub-and-Spoke Network Topology
A hub-and-spoke network topology is a common Azure architecture where a central virtual network (the hub) acts as a central point of connectivity to on-premises networks and hosts shared services like firewalls, while spoke virtual networks peer with the hub to host application workloads.
- Centralizes network security (e.g., Azure Firewall) in the hub.
- Enables private communication between spokes via the hub.
- Simplifies network management and reduces costs.
- Ideal for enterprise-scale deployments and microservices.
Memory trick: Hub is Home, Spokes are Apps, Mesh is Many Ways.