Azure Firewall

A managed, cloud-based network security service that protects Azure VNets.
Unlike NSGs, which are simple allow/deny rules, Azure Firewall is stateful and supports advanced policies.

Key Features:

• Centralized traffic control across multiple VNets.

• Application rules (filter by FQDN, domains).

• Network rules (filter by IP/ports/protocols).

• Threat intelligence-based filtering (block known malicious IPs/domains).

• Built-in logging and monitoring with Azure Monitor.

• Highly available and scalable.

Network Security Groups (NSG) vs Firewall

• NSG = Lightweight, subnet/NIC-level filtering.

• Firewall = Centralized, advanced filtering with application awareness.
  Exam trick: If the requirement is “block traffic from specific domains”, you need Firewall, not NSG.

Azure DDoS Protection

Azure provides Distributed Denial of Service (DDoS) protection to defend against volumetric attacks.

Two Tiers:

• Basic (free): Always enabled, protects Azure backbone by default.

• Standard (paid): Provides additional features such as:

  • Adaptive tuning based on traffic patterns.

  • Real-time attack telemetry.

  • Attack mitigation reports.

  • Cost protection (credits against data transfer charges during attacks).

Confusion Buster 🚨

• Firewall vs DDoS Protection

  • Firewall = filters traffic based on rules and signatures.

  • DDoS Protection = mitigates large-scale flooding attacks.

  • Exam trick: If the question says “protect against malicious IPs or URLs” → Firewall. If it says “mitigate volumetric network flooding” → DDoS.

Simple Example

A financial company hosts applications in Azure.

• They deploy Azure Firewall to block outbound traffic to unapproved domains.

• They enable DDoS Standard on their VNet to ensure uptime during potential denial-of-service attacks.

Exam Tip

• Basic DDoS = always on, no configuration needed.

• Standard DDoS = paid, per VNet, with extra features (telemetry, cost protection).

• If a scenario mentions “centralized security across multiple VNets”, the answer is Azure Firewall.

What to Expect in the Exam

• Direct Q: “Which service protects against volumetric network attacks?” → DDoS Protection.

• Scenario: “Company must block access to specific websites.” → Azure Firewall (Application rule).

• Trick Q: “NSGs can inspect traffic based on FQDN.” (False — only Firewall can).