AZ-104

Deep Dive

D4 · Networking

Network Security Groups

Azure offers multiple layers of network security: NSG (basic L4 firewall), Azure Firewall (full L4-L7), WAF (web application protection), and DDoS Protection. The AZ-104 places special emphasis on NSG, ASG, and Azure Firewall.

Contents

NSG — Network Security Groups
ASG — Application Security Groups
Azure Firewall
DDoS Protection
Web Application Firewall (WAF)
When to use each service

NSG — Network Security Groups

A Network Security Group (NSG) is a stateful layer-4 firewall that filters TCP/UDP traffic by source/destination IP, port, and protocol. It is associated with subnets and/or VM NICs.

Anatomy of an NSG rule

Priority

100–4096. Lower number = higher priority. Evaluated in ascending order. The first matching rule wins.

Protocol

TCP, UDP, ICMP, ESP, AH, or * (all)

Direction

Inbound or Outbound

Source/Destination

IP, CIDR range, Service Tag, or ASG

Port

Specific port, range (3389-3390), list (80,443), or * (all)

Action

Allow or Deny

Default rules (always present, cannot be deleted)

65000AllowAllows all traffic within the VNet (inbound)

65001AllowAllows Azure Load Balancer health probes

65500DenyBlocks everything else (inbound)

65000AllowAllows all outbound traffic to the VNet

65001AllowAllows outbound access to the internet

65500DenyBlocks everything else (outbound)

Key concepts for the exam

→ NSG is stateful: if it allows inbound traffic on port 443, the outbound response is allowed automatically
→ Can be associated with a subnet (best practice) and/or a NIC — both are evaluated
→ A subnet or NIC can have only one NSG associated with it
→ An NSG can be associated with multiple subnets/NICs

ASG — Application Security Groups

Application Security Groups (ASG) let you group VMs by application role (e.g. WebServers, DBServers) and use those groups as the source/destination in NSG rules — instead of individual IPs.

This eliminates manual IP management: when you add a new VM to the ASG, the NSG rules apply automatically.

Without ASG — IP-based rules

Inbound Allow 10.0.0.4 → 10.0.1.5:1433 (SQL)

Inbound Allow 10.0.0.5 → 10.0.1.5:1433 (SQL)

Inbound Allow 10.0.0.6 → 10.0.1.5:1433 (SQL)

→ Adding a new web VM = a new manual rule

With ASG — semantic rules

Inbound Allow ASG:WebServers → ASG:DBServers:1433

→ Adding a new web VM = adding it to the ASG WebServers

→ The rules apply automatically

Azure Firewall

Azure Firewall is a managed PaaS network firewall spanning layers 4-7. Unlike NSGs (basic L4), Azure Firewall can filter by FQDN, web categories, URL, and inspect traffic in depth. It is deployed in its own subnet (AzureFirewallSubnet).

Feature	Standard	Premium
Network rules (IP/port/protocol)	✓	✓
Application rules (FQDN)	✓	✓
FQDN tags (Windows Update, etc.)	✓	✓
Threat Intelligence (blocks malicious IPs/domains)	✓	✓
DNS Proxy	✓	✓
TLS inspection (IDPS)	—	✓
IDPS (Intrusion Detection & Prevention)	—	✓
URL filtering (not just FQDN)	—	✓
Web categories	—	✓

Network rules

L4 filtering by source/destination IP, protocol, and port. Similar to NSG but centralized. Processed before application rules.

Application rules

L7 filtering by FQDN or FQDN tags. Lets you control which URLs/domains can be accessed from the VNet to the internet.

DNAT Rules

Destination NAT — translates a Firewall public IP to an internal private IP. Useful for exposing internal services to the internet.

DDoS Protection

DDoS Network Protection (Basic → now included)

Basic protection that is always active across all of Azure's infrastructure. Automatically mitigates common volumetric attacks.

•No additional cost
•Basic coverage against network attacks
•No mitigation SLA guarantees
•No detailed reporting or telemetry

DDoS IP/Network Protection (Standard)

Advanced protection with mitigation policies customized per public IP, real-time telemetry, and a guaranteed SLA.

•Financial availability SLA
•Adaptive ML-based mitigation based on your traffic patterns
•Real-time alerts and metrics in Azure Monitor
•Access to DDoS Rapid Response (emergency support)
•Charged per protected VNet + credit in case of confirmed impact

Web Application Firewall (WAF)

WAF protects web applications from OWASP attacks (SQL injection, XSS, CSRF, etc.). It is integrated as a feature within other Azure services — it is not a standalone service.

Application Gateway + WAF

Web applications in a single region. WAF sits in front of the backend. OWASP Core Rule Set (CRS) rules. Detection mode (log only) or Prevention mode (blocks).

Azure Front Door + WAF

Global multi-region apps. The WAF sits at Front Door's PoPs at a global level. Bot protection, rate limiting, geo-filtering.

Azure CDN + WAF

Protection for globally distributed static content. WAF at the CDN level to block malicious traffic at the edge.

When to use each security service

Service	Layer	Scope	Cost	When to use
NSG	L4	Subnet / NIC	Free	Basic TCP/UDP filtering across a VNet. Always use it.
ASG	L4	Subnet / NIC	Free	Simplify NSGs when there are many VM groups by role.
Azure Firewall	L4-L7	Whole VNet (hub)	High (fixed + data)	Centralized control, FQDN filtering, N-S and E-W traffic.
WAF	L7	Specific web endpoint	Medium	Protect web apps from OWASP attacks (SQL injection, XSS).
DDoS Standard	L3-L4	Public IPs / VNet	High	Critical production environments with exposed public IPs.

Did you get this topic?

Test what you just learned

You have three web application VMs (10.0.1.4, .5, .6) that need to access a SQL server (10.0.2.10) on port 1433. New web VMs will be added frequently. What is the best way to configure the NSG?

Ready to test "Network Security Groups"?

Put what you learned to the test with original AZ-104 exam questions.

Start AZ-104 mock exam

Unlimited mock exams with the Pro plan

PreviousVirtual Networks (VNet)Networking NextLoad BalancingNetworking