Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Subnets let you carve a single virtual network into smaller, logically separated segments, each with its own IP address range. Because each subnet can have its own network security group and route table, you can apply different security rules to the web and database tiers while keeping them in the same virtual network. Virtual network peering connects entire VNets, not segments inside one. Azure Firewall application rules filter outbound traffic but do not create separate segments. User-defined routes customize routing but do not, by themselves, create security boundaries between tiers.