What is an NSG?

A Network Security Group (NSG) acts like a mini-firewall that filters traffic to and from Azure resources.
It works at the subnet or network interface (NIC) level to allow or deny inbound/outbound traffic based on rules.

Key Features of NSGs

• Control traffic at Layer 3 (IP) and Layer 4 (port, protocol).

• Rules are stateless → if inbound traffic is allowed, the response is automatically allowed.

• Can be applied to:

  • A subnet (rules apply to all resources inside).

  • A NIC (rules apply only to that VM/resource).

NSG Rules

Each rule has:

• Priority: Lower number = higher priority.

• Direction: Inbound or Outbound.

• Action: Allow or Deny.

• Protocol: TCP, UDP, or Any.

• Source & Destination: IP, CIDR range, tag (e.g., Internet, VirtualNetwork).

• Port Range: Specific port(s) or all.

Default Rules

Every NSG comes with built-in rules (lowest priority numbers):

• Allow VNet inbound (100).

• Allow Azure Load Balancer inbound (65000).

• Deny all inbound (65500).

• Allow VNet outbound (65000).

• Deny all outbound (65500).

These cannot be removed, but you can override them with higher-priority rules.

Confusion Buster 🚨

• NSG vs Azure Firewall

  • NSG = filters traffic within a VNet (basic rule-based security).

  • Firewall = centralized, fully managed security service with advanced features (FQDN filtering, logging, application rules).

• Exam trick: If the question says “block traffic between subnets or from Internet” → NSG. If it says “centralized security, multiple VNets, advanced rules” → Firewall.

Simple Example

A company has:

• Subnet A → Web servers.

• Subnet B → Databases.
  They apply an NSG to Subnet B allowing inbound only from Subnet A on port 1433 (SQL). All other inbound traffic is blocked.

Exam Tip

• If the requirement is basic traffic filtering, pick NSG.

• If the requirement is centralized inspection or advanced security, pick Firewall.

• Remember rule priority → exam often tests which rule “wins” when conflicts occur.

What to Expect in the Exam

• Direct Q: “Which Azure feature filters traffic at subnet or NIC level?” → NSG.

• Scenario: “Allow only web tier to access DB tier on port 1433.” → NSG rule.

• Trick Q: “Azure Firewall and NSGs perform the same function.” (False).