Azure West Malaysia region hosts a secure three-tier architecture with network segmentation across DMZ and private subnets. CSV files in Azure File Storage flow through Private Link to a Standard_D2s_v3 Data Collector VM, which feeds a Standard_D4s_v3 MS SQL Server VM that processes data into Azure SQL Database. Internet users access the web tier through Application Gateway with WAF Policy protecting a Standard_D2s_v3 Web Server VM in the DMZ subnet, while both data and database VMs retrieve secrets from Key Vault. This architecture demonstrates defense-in-depth with NSG-protected subnets, private endpoints for storage access, centralized secret management, and WAF protection for public-facing workloads. Fork this diagram on Diagrams.so to customize VM SKUs, add Azure Bastion for secure management access, or integrate Azure Monitor and Log Analytics Workspace for comprehensive observability.