Domain 2 of 4 · Chapter 3 of 3

Implement security for Azure network services

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing SC-500 premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Where each network control sits in the path
  • How NSG rules are evaluated
  • Centralized policy with Virtual Network Manager
  • How Azure Firewall decides on a flow
  • Choosing an Azure Firewall SKU for inspection
  • Centralized firewall policy for secured virtual hubs
  • Securing VPN gateway connections
  • Private connectivity with Azure Private Link
  • Microsoft Entra Private Access for internal apps
  • Diagnosing effective rules with Network Watcher
  • Exam pattern recognition

The four control points compared

PropertyCentral admin rulesSubnet and NIC rulesPrivate pathsRouted inspection
Azure serviceVirtual Network Manager security admin configurationNetwork security groups with application security groupsPrivate endpoints, Private Link Service, VPN Gateway, Microsoft Entra Private AccessAzure Firewall with Firewall Policy, standalone or in a secured virtual hub
Attaches toVirtual networks in a targeted network groupSubnets and network interfacesA subnet, a gateway, or a published applicationA hub virtual network or a Virtual WAN hub
Matches onPriority, protocol, direction, address prefixesFive-tuple, with service tags or application security groups as source or destinationResource identity, and user or group identity for Private AccessAddresses, ports, protocols, FQDNs, and TLS payload with Premium
Evaluation positionFirst, before NSGs: Allow defers to them, Always Allow and Deny terminateSecond: first match by priority, and subnet plus NIC must both allowThird: decides whether a usable route to the destination exists at allLast, and only on traffic routing sends it: DNAT, then network, then application rules
Outside its reachPrivate endpoints, and intent-managed networks unless support is enabledLayer 7 URL and TLS payload inspectionAuthorization inside the service, which keeps its own access controlsAny flow no route steers to the firewall

Decision tree

Must it cover every virtualnetwork, now and later?YesVirtual Network Managersecurity admin ruleNoDoes the match need an FQDN,a URL, or the TLS payload?YesAzure Firewallwith Firewall PolicyNoMust the PaaS resource bereachable without a public path?YesPrivate endpointAzure Private LinkNoAre remote users reaching aninternal app without a VPN?YesMicrosoft Entra Private Accesswith Conditional AccessNoNetwork security group rulewith application security groupsAlways confirm the result with IP flow verify,then read effective security rules
Cheat sheet

Cheat sheet

  • NSGs stop at the first matching rule and preserve established flow state
  • Traffic must be allowed by every applicable subnet and NIC NSG
  • Application security groups make NSG rules follow workload roles instead of IP lists
  • Effective security rules reveal the aggregate policy on a running VM interface
  • IP flow verify identifies the rule that allows or denies a proposed VM flow
  • Higher-priority custom NSG rules override undeletable defaults
  • Security admin configurations apply global rules to targeted network groups
  • Allow defers to NSGs while Always Allow and Deny terminate admin-rule evaluation
  • Dynamic network-group membership extends deployed admin policy to matching virtual networks
  • A region accepts one deployed security admin configuration
  • Security admin rules exclude private endpoints and can skip intent-managed networks
  • Azure Firewall Manager distributes consistent policy across secured virtual hubs
  • Each secured Virtual WAN hub needs its own firewall instance
  • Virtual WAN routing intent steers private and internet traffic to hub security
  • A site-to-site VPN custom IPsec/IKE policy must be compatible on both peers
  • Microsoft Entra point-to-site VPN authentication uses OpenVPN and Azure VPN Client
  • A secured-hub firewall needs the zone-aware deployment path for zone resilience
  • Hierarchical Firewall Policies combine central enforcement with local additions
  • Private Access application segments define reachable destinations and ports
  • Private Access requires connectors, assignment, and traffic forwarding together
  • Quick Access provides broad migration coverage while per-app access enforces segmentation
  • Conditional Access is linked to the Private Access enterprise application
  • Remote Private Access traffic requires the Global Secure Access Client
  • A private endpoint maps a VNet address to a specific Private Link resource subresource
  • Private endpoint clients must resolve the service FQDN to the endpoint's private IP
  • Private endpoint approval and public-endpoint isolation are separate controls
  • Private Link Service publishes a load-balanced private service through controlled consumer approvals
  • Azure Firewall rule families match destination identity and traffic direction
  • Azure Firewall gives DNAT and network processing precedence over application rules
  • Firewall Premium combines TLS decryption with IDPS for encrypted threat inspection
  • Private endpoint network policies activate subnet traffic controls
  • Network-rule FQDN filtering requires DNS Proxy and exact hostnames
  • Azure Firewall denies traffic that survives its hierarchy without an allow
  • Azure Firewall SNAT behavior depends on the rule family and destination range
  • Threat-intelligence blocking requires Azure Firewall Standard or higher

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. https://learn.microsoft.com/en-us/azure/virtual-network-manager/overview
  2. Network security groups overview
  3. https://learn.microsoft.com/en-us/azure/firewall/overview
  4. https://learn.microsoft.com/en-us/azure/role-based-access-control/overview
  5. How network security groups filter network traffic
  6. Application security groups
  7. Security admin rules in Azure Virtual Network Manager
  8. Network groups in Azure Virtual Network Manager
  9. Configuration deployments in Azure Virtual Network Manager
  10. Azure Firewall rule processing logic
  11. https://learn.microsoft.com/en-us/azure/firewall/dns-settings
  12. FQDN filtering in Azure Firewall network rules
  13. Azure Firewall Policy rule sets
  14. Azure Firewall SNAT private IP address ranges
  15. https://learn.microsoft.com/en-us/azure/firewall/features-by-sku
  16. Azure Firewall threat intelligence-based filtering
  17. Azure Firewall Premium features
  18. https://learn.microsoft.com/en-us/azure/firewall-manager/overview
  19. https://learn.microsoft.com/en-us/azure/firewall-manager/secured-virtual-hub
  20. Azure Firewall Manager: hub virtual networks and secured virtual hubs
  21. Azure Firewall Manager policy overview
  22. Configure routing intent and policies for Virtual WAN hubs
  23. https://learn.microsoft.com/en-us/azure/virtual-wan/howto-firewall
  24. Configure a custom IPsec/IKE policy for a VPN Gateway connection
  25. https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about
  26. Microsoft Entra ID authentication for point-to-site OpenVPN connections
  27. What is an Azure private endpoint?
  28. Azure private endpoint DNS configuration
  29. Manage network policies for private endpoints
  30. What is Azure Private Link service?
  31. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview
  32. Microsoft Entra Private Access concepts
  33. https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors
  34. https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-windows-client
  35. https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-quick-access
  36. Configure per-app access for Microsoft Entra Private Access
  37. https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-overview
  38. IP flow verify overview (Azure Network Watcher)
  39. https://learn.microsoft.com/en-us/cli/azure/network/watcher
  40. https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-network-configuration-diagnostics-overview
  41. Diagnose a virtual machine network traffic filter problem with effective security rules