Network Security

• NSG rules match on a 5-tuple and fire in priority order, lowest number first
• NSGs are stateful, so you only write a rule for the initiating direction
• An NSG attaches to a subnet, a NIC, or both, and can be reused
• When a subnet NSG and a NIC NSG both apply, traffic must pass both
• Default NSG rules allow VNet and load-balancer traffic and deny inbound internet
• Service tags name Microsoft-managed IP sets so you don't track changing prefixes
• Group VM NICs into an ASG and reference the group instead of IPs in NSG rules
• All NICs in an ASG, and an ASG used as both ends of a rule, must be in the same VNet
• Effective security rules merge the subnet and NIC NSGs into the list Azure applies
• Network Watcher IP flow verify tells you which rule allowed or blocked a 5-tuple
• Azure Bastion gives portal RDP/SSH over TLS with no public IP on the VM
• Bastion needs a subnet named exactly AzureBastionSubnet
• Bastion SKUs gate features, and the dedicated host bills per hour while provisioned
• A service endpoint extends the subnet identity to a PaaS service over the backbone
• Service endpoints don't extend to on-premises traffic
• A private endpoint projects one PaaS resource into your VNet as a private IP
• A private endpoint needs DNS to resolve the service name to its private IP
• Choose private endpoint for on-prem or per-resource isolation; service endpoint for in-VNet, no-cost
• An NSG filters the 5-tuple only: it cannot inspect application-layer content
• A service endpoint swaps the source IP from public to the VM's private IP
• A service endpoint policy limits a subnet to specific Azure Storage accounts
• Azure Firewall processes DNAT, then Network, then Application rules
• FQDN tags let an application rule reach Microsoft services with no maintenance
• Azure Firewall threat intelligence defaults to Alert-only, not block

Unlock with Premium — includes all practice exams and the complete study guide.