Why Network Security Matters

Even if identities are secure, attackers may still target the network layer. Azure provides multiple tools to protect workloads from unauthorized access, malware, and denial-of-service attacks. The exam expects you to know which control to apply at which layer.

1. Network Security Groups (NSGs)

Definition:
Act like virtual firewalls at subnet or NIC level to control inbound/outbound traffic.

Features:

• Allow/Deny rules based on source, destination, port, protocol.

• Applied at subnet or NIC level.

• Default rules (deny inbound, allow outbound) can’t be deleted.

Use Cases:

• Restrict web subnet to HTTP/HTTPS only.

• Allow DB subnet to accept traffic only from app subnet.

2. Application Security Groups (ASGs)

Definition:
Logical grouping of VMs for easier NSG management.

Features:

• Define rules once per ASG instead of per IP.

• Combine with NSGs to simplify rule sets.

Use Cases:

• Group all “WebServers” and allow only HTTP/HTTPS from “AppServers.”

3. Azure Firewall

Definition:
Fully managed, stateful firewall service with centralized policy management.

Features:

• Layer 3–7 filtering (IP, FQDN, protocols).

• Threat intelligence → block known malicious IPs.

• Outbound SNAT (useful for VMs needing static public IP).

• Integrates with Azure Monitor for logging.

Use Cases:

• Centralized security for hub-spoke network.

• Outbound internet filtering.

• Enforcing corporate traffic inspection policies.

4. Private Endpoints

Definition:
Private IP addresses within your VNet that connect to PaaS services (e.g., Blob, SQL, Cosmos DB) securely.

Benefits:

• Traffic stays on Microsoft backbone (not internet).

• Prevents public exposure of services.

• Works with NSGs + Firewalls.

Use Cases:

• Connect to SQL DB privately from VNet.

• Secure storage accounts (block public access).

5. Azure DDoS Protection

Definition:
Protects against Distributed Denial of Service (DDoS) attacks.

Tiers:

• Basic → built-in for all Azure resources.

• Standard → advanced protection, telemetry, and cost protection guarantee.

Features:

• Mitigates volumetric, protocol, and application-layer attacks.

• Integration with Azure Monitor for alerts.

Use Cases:

• Public-facing web apps.

• Enterprises subject to compliance requiring DDoS defense.

Example Enterprise Scenario

A retail platform requires:

• Web tier exposed only on HTTPS.

• DB tier must never be exposed publicly.

• All traffic to storage accounts must stay private.

• System must withstand DDoS attacks.

Correct design:

• Apply NSGs to allow HTTPS inbound only.

• Use Private Endpoints for DB + storage.

• Place Azure Firewall in hub-spoke network for outbound filtering.

• Enable DDoS Protection Standard for public web front-end.

Confusion Buster

• NSG vs Azure Firewall

  • NSG = basic allow/deny filtering (stateless, subnet/NIC).

  • Firewall = advanced, centralized, stateful.

• ASG vs NSG

  • ASG = logical grouping of VMs.

  • NSG = rules applied at subnet/NIC level.

• Private Endpoint vs Service Endpoint

  • Private Endpoint = private IP, service is never public.

  • Service Endpoint = keeps public endpoint, but restricts access to VNet.

• DDoS Basic vs Standard

  • Basic = default protection.

  • Standard = SLA + telemetry + financial guarantee.

Exam Tips

• “Which feature blocks malicious outbound IPs?” → Azure Firewall Threat Intelligence.

• “Which feature allows private IP access to Azure SQL?” → Private Endpoint.

• “Which service protects against volumetric attacks?” → DDoS Standard.

• “Which is easier for grouping VM rules dynamically?” → ASGs.

• “Which service is required for central outbound traffic filtering?” → Azure Firewall.

What to Expect in the Exam

• Direct Q: “Which feature secures storage accounts by removing public access?” → Private Endpoints.

• Scenario Q: “Company needs centralized firewall policy for hub-spoke design.” → Azure Firewall.

• Scenario Q: “VMs in web tier should accept traffic only from app tier.” → NSG with ASG.

• Scenario Q: “Enterprise requires SLA-backed protection against DDoS.” → DDoS Protection Standard.

• Trick Q: “NSGs provide outbound SNAT and threat intelligence blocking.” → False (Azure Firewall does).