Network security
CoreNetwork security groups and application security groups
Stateful traffic rules, subnet/NIC scope, workload grouping, and effective rules.
Key points
- NSGs contain prioritized stateful inbound and outbound allow or deny rules.
- Subnet and NIC NSGs both apply, and every applicable layer must allow the flow.
- ASGs provide workload-oriented source or destination membership for NSG rules.
Best-known use cases
- Allow a web ASG to reach a database ASG on one port.
- Deny unwanted inbound traffic at a subnet boundary.
What candidates often confuse it with
- NSG vs ASG: filter and rules vs logical NIC grouping used in rules.
- NSG vs route table: allow or deny vs next-hop selection.
Key takeaway
Use NSGs to filter exact flows and ASGs to express workload membership without hard-coded addresses.
Related services
- Azure Bastion
Relevant exam tasks
- D4.2.S1 — Create and configure network security groups (NSGs) and application security groups
- D4.2.S2 — Evaluate effective security rules in NSGs
- D4.2.S3 — Implement Azure Bastion