A network security engineer needs to implement segmentation but is under strict compliance requirements to place security enforcement as close as possible to the private applications hosted in Azure.
Which deployment style is valid and meets the requirements in this scenario?