NTMSAzure Light Mode
Cloud & IT Engineering Academy
CoursesWhatsApp
NTMS Architecture Lab

NTMS Architecture Lab

Explore how real enterprise cloud environments are designed, connected, secured, and operated.

NTMS Architecture Explorer (Azure Light View)

Think in Architecture. Not Just Services.

Click any Azure resource component node in the topology below to inspect its enterprise function, traffic flow, security controls, and troubleshooting steps.

Explore All Blueprints

Azure Firewall Premium

Hub Security • Azure Resource Spec
Learn in Mapped Course →
Enterprise Function

Acts as the central network security virtual appliance in the Hub VNet, performing stateful Layer 4-7 traffic inspection, Intrusion Detection and Prevention (IDPS), TLS inspection, and outbound FQDN filtering.

Traffic Flow Path

All traffic between Spoke VNets (East-West) and outbound internet traffic (North-South) is forced through the Azure Firewall via User-Defined Routes (UDR).

Security & Governance Controls
  • •IDPS signature rules set to Deny mode
  • •Network Rules for IP/Port protocol restriction
  • •Application Rules restricting outbound FQDNs to allowed domains
Common Engineering Mistakes
  • •Forgetting to enable IP forwarding on NVA NICs
  • •Not configuring 0.0.0.0/0 route in UDR, causing internet traffic to bypass firewall
  • •Overlapping NSG rules overriding firewall intent

Production Blueprint Library

Architectural blueprints taught step-by-step in NTMS live cohorts.

Azure Enterprise Hub & Spoke Network

Multi-subscription network isolation with central firewall & UDR routing

Hub VNetAzure Firewall PremiumVPN GatewaySpoke VNetsUDR Route TablesPrivate Endpoints
Traffic Flow:

Public ingress passes through Azure Firewall; inter-spoke East-West traffic is forced through central IDPS inspection; database queries route via Private Endpoints.

Security Controls:
  • Azure Firewall Layer 7 Application Rules
  • NSG Subnet Isolation
  • Disabled Public IPs on Compute

Secure Auto-Scaling Web Application Platform

Multi-tier web platform with Application Gateway WAF and VM Scale Sets

Application Gateway WAF v2VM Scale Sets (VMSS)Internal Load BalancerAzure Key VaultLog Analytics Workspace
Traffic Flow:

HTTPS clients hit WAF v2; WAF terminates TLS and forwards traffic to auto-scaling VMSS instances in private subnets.

Security Controls:
  • OWASP Top 10 WAF rules
  • Key Vault Secretless Managed Identity
  • Log Analytics Telemetry

Hybrid Cloud Identity & Storage Blueprint

Datacenter extension with S2S VPN tunnel & Entra Connect sync

Simulated On-Prem RouterS2S IPsec VPN GatewayEntra ConnectAzure Storage SyncRecovery Services Vault
Traffic Flow:

On-premises users authenticate via Entra Connect hybrid identity and store files synced securely to Azure Blob Storage over IPsec VPN.

Security Controls:
  • IPsec IKEv2 AES-256 Encryption
  • Conditional Access MFA
  • Storage Account Soft Delete

Zero Trust Security Operations Center (SOC)

Threat detection & automated incident response with Microsoft Sentinel

Microsoft SentinelMicrosoft Defender for CloudKQL Detection RulesLogic Apps PlaybooksEntra ID Protection
Traffic Flow:

Security logs stream from Azure Firewall, Entra ID, and VMs into Sentinel; KQL rules detect malicious logons and trigger automated playbook IP isolation.

Security Controls:
  • KQL Real-time Alerting
  • Risk-based Conditional Access
  • Automated Logic Apps Playbook Remediation