4.1.4. Network Segmentation with Azure Virtual Networks
💡 First Principle: A virtual network (VNet) is Azure's software-defined boundary for private networking, and segmenting it into multiple subnets limits how far an attacker (or a misconfiguration) can spread if one part of the network is compromised — the cloud equivalent of not leaving every door in a building unlocked just because the front gate is secured.
By placing different resource tiers (web servers, application servers, databases) in separate subnets, and controlling traffic between them with NSGs or Azure Firewall, an organization limits lateral movement — a compromised web server in one subnet can't automatically reach the database subnet unless a rule explicitly allows it.
⚠️ Exam Trap: Creating a VNet by itself does not provide segmentation — segmentation comes from deliberately dividing it into multiple subnets and controlling traffic flow between them.
Reflection Question: If a company puts every resource — web servers, application servers, and databases — into a single flat subnet with no internal restrictions, what specific defense-in-depth benefit are they giving up?
