A basic Azure firewall that filters network traffic to and from Azure resources within a VNet. It contains inbound and outbound rules that allow or deny traffic based on IP, port, and protocol.
Fundamental for network security in AZ-104. It can be attached to subnets or individual network interfaces. Rules have a numeric priority (lower number = higher priority). Roughly equivalent to an AWS security group, but with a different deny model.
Network Security Group (NSG) is a concept that can show up on the exam. Check the full guide to see it in context.