Protection
This section explores several technologies that help provide isolation and protection. There are often multiple options, and the right option varies based on existing knowledge and requirements.
Network Security Groups and Application Security Groups
A virtual network can be thought of as a trust boundary. Each virtual network is completely isolated from other virtual networks, unless you choose to connect them. Within the virtual network, each virtual subnet is automatically connected to every other virtual subnet through Azure-provided gateway functionality. This is represented as the first usable IP address in each subnet.
In some scenarios, virtual subnets should be isolated from one another and potentially even within subnets for micro-segmentation. Consider your datacenter. You likely have a separate network that connects to the Internet, your DMZ. There will be another network for your datacenter, another network for high-impact servers, and so on. Between these different...
