Topic 1 of 8
Network security in Azure
DDoS Protection, Azure Firewall, Web Application Firewall, virtual networks, and network security groups protect the network at different layers. The exam mostly asks which layer each one works at and which to choose for a given scenario.
Contents
DDoS attacks
A distributed denial-of-service (DDoS) attack aims to overwhelm app and server resources so they stop responding or slow down for legitimate users. It usually targets any public endpoint reachable over the internet. The three most common types:
Volumetric
Floods the network layer with seemingly legitimate traffic and exhausts bandwidth: real traffic can't get through.
Protocol
Exhausts server resources with fake requests that exploit weaknesses in layer 3 (network) and layer 4 (transport) protocols.
Application layer
Targets web application packets to disrupt data transmission between hosts.
Azure DDoS Protection
It analyzes network traffic and discards anything that looks like an attack. It protects at layers 3 (network) and 4 (transport). When it detects an attack, it redirects traffic through the service, runs several checks, drops the malicious traffic, and forwards the rest. Within minutes it notifies you with Azure Monitor metrics.
Always-on monitoring
Traffic patterns watched 24×7 with immediate, automatic mitigation.
Adaptive tuning
Traffic profiles that learn how your app behaves and update over time.
Analytics and alerts
Telemetry in Azure Monitor, reports every 5 minutes during the attack and a summary at the end. Logs to Event Hubs, Monitor logs, Storage, or Sentinel.
Isn't Azure's default protection enough?
Default infrastructure protection has thresholds higher than most apps can handle and provides no telemetry or alerting: a volume the platform considers harmless can take your app down. DDoS Protection gives dedicated monitoring and thresholds tuned to your traffic.
| DDoS Network Protection | DDoS IP Protection | |
|---|---|---|
| What it protects | A virtual network's resources, with no app changes | Specific public IPs |
| Model | Per virtual network | Pay per protected IP |
| Technical capabilities | Full | The same core capabilities |
| DDoS rapid response (DRR) | Yes | No |
| Cost protection and WAF discount | Yes | No |
The DRR team helps during an active attack and does the post-attack analysis. Best practices: combine DDoS Protection (layers 3-4) with a WAF (layer 7), design for resilience, enable alerts, and have a response plan before the attack.
Azure Firewall
A firewall is a device (hardware, software, or both) that controls incoming and outgoing traffic with rules, as a barrier between a trusted network and untrusted networks like the internet. Azure Firewall is a managed, cloud-based network security service for your Azure workloads.
It can be deployed in any virtual network, but ideally in a centralized virtual network that other virtual and on-premises networks route through, to control traffic across subscriptions from one point. It scales with traffic, so you don't budget for peaks. Traffic goes through the rules when you route it to the firewall as the subnet's default gateway.
Stateful
Tracks the state of active connections and decides using the traffic's context.
High availability
Built in, and it can span several availability zones.
Network and application filtering
Rules by IP, port, and protocol, and by application protocols like HTTP/S to control FQDNs.
SNAT and DNAT
SNAT translates private IPs to a public IP to reach the internet; DNAT translates a public IP to private IPs to come in from the internet.
Threat intelligence
Alerts on and denies traffic to or from known malicious IPs and domains.
Logging and integration
Logs to Azure Monitor, Log Analytics, or Event Hubs; integrates with Azure Policy and Defender for Cloud.
Azure Firewall tiers
| Tier | For | Highlights |
|---|---|---|
| Basic | SMBs | Affordable essential protection. Threat intelligence in alert mode only; fixed scale with two instances; about 250 Mbps |
| Standard | Enterprise production (most used) | Layer 3 to 7 filtering; alerts on and blocks malicious IPs and domains with intelligence updated in real time |
| Premium | Regulated and highly sensitive environments | Signature-based IDPS: more than 67,000 signatures in more than 50 categories, against malware, phishing, coin mining, and trojans |
- Azure Firewall Manager centralizes rule policies for firewalls across subscriptions or regions, in virtual networks or in Virtual WAN (Secure Virtual Hub).
- With Security Copilot, you investigate in natural language the malicious traffic intercepted by IDPS or threat intelligence; it requires structured IDPS logs in Log Analytics and the plugin turned on.
Web Application Firewall (WAF)
Preventing attacks in each app's code takes constant maintenance, patching, and monitoring. WAF provides centralized protection against common vulnerabilities: it simplifies management, improves response time, and lets you patch a vulnerability in one place instead of in every app. It's based on the OWASP core rule set.
SQL injection
Malicious SQL code in input fields to read, modify, or delete database data.
Cross-site scripting (XSS)
Malicious scripts in pages other users view to steal session tokens or credentials.
HTTP floods
Large volumes of HTTP requests: layer 7 DDoS, which DDoS Protection alone doesn't cover.
Remote file inclusion
Tricking the app into including and executing a malicious remote file.
| Where it deploys | Used for |
|---|---|
| Azure Application Gateway | Regional protection, deep HTTP inspection, and complex routing; apps in a single region |
| Application Gateway for Containers | Containerized workloads |
| Azure Front Door | Global protection; blocks close to the attack's source, for distributed apps |
| Azure Content Delivery Network | Static and dynamic content served through the CDN |
Segmentation with virtual networks
Segmenting means dividing into smaller pieces, just as a company's departments have their own offices. On the network it groups related assets, isolates resources, and applies governance policies. It supports Zero Trust (assume breach) and defense in depth: if a segment is compromised, it's contained and doesn't spread laterally. Every boundary between segments is a chance to inspect and filter traffic.
Virtual network (VNet)
The basic building block of a private network in Azure, like a datacenter network with Azure's scale and isolation. You can create several per region and subscription. By default, no traffic is allowed across VNets or inbound: it must be enabled explicitly.
Subnets
Segments inside a VNet with their own requirements and controls, for example web servers in one and databases in another.
Peering
Connects two VNets as if they were one, even across regions (global peering). Traffic goes over the Azure backbone, not the internet.
VNet capabilities:
- Outbound internet by default; inbound is controlled with public IPs or load balancers
- Private communication between resources in the same VNet
- Connection to on-premises networks with site-to-site VPN, point-to-site VPN, or ExpressRoute
- Filtering with NSGs and Azure Firewall between subnets
- Automatic routing and custom routes
Network security groups (NSG)
They filter traffic to and from resources in a VNet, such as a VM, with inbound and outbound rules. Each subnet and network interface supports only one NSG, but the same NSG can be associated with many.
Rule properties
- Unique name
- Priority: lower number = processed first; on a match, processing stops
- Source and destination: IP, range, service tag, or ASG
- Protocol: TCP, UDP, ICMP, or Any
- Direction: inbound or outbound
- Port range
- Action: allow or deny
Default rules
Three inbound and three outbound, which can't be removed but can be overridden with higher-priority rules.
Inbound: AllowVNetInBound · AllowAzureLoadBalancerInBound · DenyAllInBound
Outbound: AllowVNetOutBound · AllowInternetOutBound · DenyAllOutBound
Practical result: with the default rules, only traffic from the VNet itself or an Azure load balancer gets in; everything else is denied. Rules are evaluated with five pieces of information: source, source port, destination, destination port, and protocol.
Application security groups (ASG)
They group VMs by app structure (WebServers, AppServers, DbServers) to use as source or destination in rules instead of IPs. When you add a VM to the ASG, the existing rules apply to it automatically.
NSG vs. Azure Firewall
An NSG provides distributed network-layer filtering within each subscription's VNets. Azure Firewall is a stateful, centralized firewall that protects network and application traffic across subscriptions and VNets. They complement each other for defense in depth.
What each service protects
| Service | Layer | Scope |
|---|---|---|
| DDoS Protection | 3 and 4 | A VNet's public endpoints or specific IPs |
| WAF | 7 | Web apps behind Gateway, Front Door, or CDN |
| Azure Firewall | 3 to 7 (by tier) | Central, across VNets and subscriptions |
| NSG | Network (IP, port, protocol) | Subnet or network interface |
Exam scenarios
| Situation | Service | Why |
|---|---|---|
| A flood of traffic saturates a public app's bandwidth | Azure DDoS Protection | A volumetric attack at layers 3 and 4. |
| An HTTP flood attack against a website | WAF | Layer 7 DDoS, which DDoS Protection alone doesn't cover. |
| SQL injection in a web app's form | WAF | A rule from the OWASP core rule set. |
| Centrally control traffic for all VNets across several subscriptions | Azure Firewall in a central network | A stateful, centralized firewall. |
| Signature-based intrusion detection for a regulated environment | Azure Firewall Premium | It includes IDPS. |
| Restrict traffic between the web subnet and the database subnet | NSG | Distributed filtering within the VNet. |
| Connect two VNets in different regions without going over the internet | Global peering | It uses the Azure backbone. |
| Apply the same rules to every firewall in the organization | Azure Firewall Manager | Centralized policies across subscriptions. |
Common exam traps
❓ Does Azure DDoS Protection stop an HTTP flood against a web app?
Not on its own. It protects layers 3 and 4. HTTP floods are layer 7 and are stopped by WAF.
❓ You want the DDoS rapid response team during an attack. Which tier?
DDoS Network Protection. IP Protection doesn't include DRR, cost protection, or WAF discounts.
❓ An NSG rule with priority 200 allows port 22 and another with priority 100 denies it. What happens?
It's denied. The lower number (100) wins and processing stops at the first match.
❓ Which Azure Firewall tier includes signature-based IDPS?
Premium. Basic uses threat intelligence in alert mode only, and Standard filters layers 3 to 7.
❓ Can an NSG's default rules be deleted?
No. They're overridden by creating rules with higher priority (a lower number).
❓ Do two VNets communicate with each other by default?
No. It has to be enabled explicitly, for example with peering.
❓ Can a subnet have two NSGs associated?
No. Each subnet and interface supports one NSG, though one NSG can be associated with many.
Did you get this topic?
Test what you just learned
An online store suffers a SQL injection attack and, at the same time, a volumetric traffic flood on its public IP. Which combination protects it?
Ready to test "Network security in Azure"?
Original questions, each with a full explanation.
Start a mock exam