Implement and manage virtual networking
NSGs, ASGs, Effective Rules, and Bastion
CoreApply traffic rules at the correct subnet or NIC, group workloads with ASGs, evaluate effective rules, and administer privately through Bastion.
Aligned to the current AZ-104 study guide, verified August 21, 2026.
Why this matters
Network security succeeds only when rules are attached at the correct boundary and their combined effect permits the intended flow without exposing VM administration publicly.
Must Know
- An NSG contains prioritized inbound and outbound allow or deny rules and can associate with a subnet, a NIC, or both.
- NSGs are stateful: return traffic for an allowed established flow is handled without a separate mirror rule.
- An ASG groups NICs by workload role so NSG rules can name application groups instead of fixed IP addresses.
- Effective security rules combine subnet and NIC NSGs; traffic must be allowed by every applicable layer.
- Azure Bastion provides managed RDP or SSH access to VMs over private IPs without assigning public IPs to target VMs.
Compare and Distinguish
- NSG vs ASG: traffic-filtering rule collection vs logical source or destination group referenced by an NSG rule.
- NSG vs UDR: permit or deny a flow vs select its next hop.
- Effective NSG rules vs effective routes: actual combined filtering vs actual combined path selection.
- Bastion vs public IP administration: managed access through the Azure service and VM private IP vs direct internet exposure of a VM endpoint.
Scenario examples
- Scenario: Web-tier VMs change addresses but always need access to database-tier VMs on one port. Think: Put NICs in ASGs and reference the groups in an NSG rule.
- Scenario: A NIC NSG allows HTTPS but the subnet NSG denies it at a higher applicable decision. Think: Inspect effective security rules and change the intended filtering layer.
- Scenario: Administrators need browser-based SSH without VM public IPs. Think: Deploy and use Azure Bastion with the required VNet connectivity.
Exam traps
- An ASG does not filter anything until an NSG rule references it.
- An allow on the NIC cannot override a deny imposed by the subnet NSG.
- Bastion removes the need for target public IPs but does not eliminate VM credentials, RBAC, or reachable management ports on the private path.
Key takeaways
- Apply NSGs at deliberate subnet or NIC boundaries and read their effective combined result.
- Use ASGs for workload-oriented rules and Bastion for private administrative access.
How it works
- Azure evaluates applicable inbound or outbound NSG rules by priority until the first match and tracks allowed connection state.
- Bastion terminates the managed administrative session and connects onward to the target VM’s private address.
Objects and administrative surfaces
- NSG — ordered rules using source, destination, protocol, port, priority, and action.
- Subnet and NIC — NSG associations whose applicable rules combine for a VM flow.
- VNet and Bastion deployment — dedicated service placement and private reachability to target VMs.
When to use it
- Use subnet NSGs for a shared tier boundary and NIC NSGs only when an individual interface needs an additional deliberate policy.
- Use Bastion when private VM administration is required without operating a jump host or exposing target public addresses.
Security and governance implications
- Avoid broad management-port rules from the internet and review high-priority allow rules for unintended reach.
- Name ASGs by workload role and keep rule ownership clear as NIC memberships change.
How to reason about this
- Identify the exact five-tuple and direction, then inspect subnet and NIC effective rules, route, target listener, and guest firewall.
- For Bastion failure, check service provisioning, target private reachability, NSG permissions, user RBAC, and guest credentials.
More detail
- Create NSGs and ASGs, associate them correctly, and interpret default plus custom rules for a specific NIC flow.
- Implement Bastion as a VNet service and retain appropriate RBAC and guest authentication for the target VM.
Ready for the quiz?
- What object actually contains allow and deny rules?
- Why can a NIC-level allow still produce a denied connection?
- Which feature lets an administrator reach a private VM without a VM public IP?
Related objectives
- D4.2.S1 — Create and configure network security groups (NSGs) and application security groups
- D4.2.S2 — Evaluate effective security rules in NSGs
- D4.2.S3 — Implement Azure Bastion