Network Diagram PBQs: Exam AZ-500: Microsoft Azure Security Technologies

You are a security engineer configuring an Azure VNet with three subnets for a line-of-business application. The Web Subnet hosts internet-facing resources protected by NSGs. The Application Subnet hosts backend services that should not be directly reachable from the internet. The Data Subnet isolates database resources with the strictest access controls. An Azure Firewall and a web application VM are already deployed. Assign the remaining resources to the correct subnets based on network security best practices.