GregLab | Exam Prep

Secure storage, databases, and networking

Azure Network Security Controls

Core

Build enforceable network boundaries with segmentation, centralized policy, hybrid connectivity, identity-aware private access, Private Link, firewall inspection, and path diagnostics.

Aligned to the live SC-500 guide, which publishes no skills-measured date; guide and product behavior verified September 23, 2026.

Why this matters

Azure network controls overlap but are not interchangeable. The right answer depends on traffic direction, scope, protocol, identity, whether a service is consumed or published, and where policy must be centralized.

Must Know

  • NSGs filter traffic at subnet or network-interface scope; ASGs group VM network interfaces so rules can use application roles instead of individual IP addresses.
  • Azure Virtual Network Manager can centrally apply security admin rules and network group policy across managed virtual networks; evaluate its scope and precedence separately from local NSGs.
  • Virtual WAN centralizes branch, VPN, ExpressRoute, routing, and secured-hub designs. A VPN still needs correct gateway, tunnel, route, and cryptographic settings on both sides.
  • Microsoft Entra Private Access provides identity-aware access to configured private applications; it is not a general replacement for every site-to-site network connection.
  • A private endpoint is a consumer-side network interface for a PaaS resource. A Private Link service publishes a provider service behind a Standard load balancer for private consumption.
  • Azure Firewall is a stateful managed firewall with network, application, and NAT rules; forced tunneling and routing determine whether traffic actually traverses it.
  • Network Watcher effective security rules, IP flow verify, next hop, connection troubleshoot, and packet capture answer different path questions.

Compare and Distinguish

  • NSGs provide distributed layer 3/4 filtering; Azure Firewall adds centralized stateful inspection and application-aware policy.
  • A private endpoint consumes a service privately; a Private Link service exposes a provider-owned service privately.
  • VPN supplies a network tunnel; Entra Private Access grants identity-aware access to specific private applications.

Scenario examples

  • Scenario: All managed virtual networks must deny one malicious range even if local administrators change NSGs. Think: use a centrally scoped security admin rule.
  • Scenario: Consumers in other virtual networks need private access to a custom service behind a load balancer. Think: publish a Private Link service and approve private endpoints.
  • Scenario: A packet is denied despite an apparently permissive NSG. Think: inspect effective rules, next hop, routes, and the opposite traffic direction.

Exam traps

  • An ASG is a grouping primitive used by NSG rules; it does not filter traffic by itself.
  • Creating a private endpoint without correct private DNS may leave clients resolving the public address.
  • Azure Firewall cannot inspect traffic that routing sends around it.
  • IP flow verify evaluates a selected flow against effective rules; it does not establish a VPN tunnel or repair routing.

Key takeaways

  • Choose controls from traffic path, direction, ownership, scope, and inspection needs.
  • Private connectivity still requires DNS, routing, approval, and service authorization.
  • Use Network Watcher evidence before changing multiple controls at once.
How it works
  • Azure computes routes and effective security rules at interfaces and subnets, then forwards traffic through any configured gateways or firewalls.
  • Private Link maps a private consumer address to a service while Microsoft Entra and the service still enforce access.
Objects and administrative surfaces
  • NSGs, ASGs, security rules, effective rules, route tables, and network interfaces.
  • Virtual Network Manager network groups and security admin configurations; Virtual WAN hubs, gateways, connections, and route tables.
  • Private endpoints, private DNS zones, Private Link services, Azure Firewall policies, and Network Watcher diagnostics.
When to use it
  • Use centralized security admin rules for organization-wide guardrails and NSGs for workload segmentation.
  • Use Network Watcher to test a specific suspected rule, route, or connection before broad policy changes.
Security and governance implications
  • Separate central network-policy ownership from workload rule administration and protect firewall policy changes.
  • Review broad inbound rules, public endpoints, unapproved private connections, route changes, and stale VPN credentials.
Troubleshooting signals
  • Check DNS, route, effective rule in both directions, appliance health, and target authorization in sequence.
  • For VPN failure, compare peer addresses, IKE/IPsec parameters, shared key or certificate, BGP, and route propagation on both ends.
More detail
  • Author minimal NSG rules with ASGs and verify effective outcomes.
  • Apply centralized Virtual Network Manager policy and secure Virtual WAN connectivity.
  • Select VPN, Entra Private Access, private endpoint, or Private Link service for the access pattern.
  • Route through Azure Firewall and diagnose decisions with Network Watcher.

Ready for the quiz?

  • When is a Private Link service required instead of a private endpoint alone?
  • Which tool shows the combined NSG rules effective on a network interface?
  • Why can an Azure Firewall policy exist without seeing the intended traffic?

Related objectives

  • D2.3.S1 — Implement and manage network security groups (NSGs) and application security groups (ASGs)
  • D2.3.S2 — Implement and configure network access policies by using Azure Virtual Network Manager
  • D2.3.S3 — Configure security for an Azure Virtual WAN
  • D2.3.S4 — Implement and configure security for virtual private network (VPN) connections
  • D2.3.S5 — Implement and configure Microsoft Entra Private Access
  • D2.3.S6 — Configure Azure private endpoints to secure access to Azure platform as a service (PaaS) resources
  • D2.3.S7 — Configure Azure Private Link services to secure access to network resources
  • D2.3.S8 — Implement and configure Azure Firewall
  • D2.3.S9 — Evaluate effective security rules by using Azure Network Watcher diagnostics

Learn more

Free Microsoft Certified: Cloud and AI Security Engineer Associate prep

Build focused SC-500 quizzes from skill areas, topics, and product references.

Practice with exam-style multiple-choice and multiple-response questions, score breakdowns, explanations, and a compact reference for this lane's official exam domains.

Read Topics Build a quiz

Exam Weights

Exam snapshot

SC-500 at a glance

Level
Intermediate / Associate
Duration
120 minutes
Questions
No fixed live question count published
Formats
No guaranteed question-type mix; the proctored exam may include interactive components
Scoring
Scaled score; 700 minimum passing score

Quiz builder

Choose your practice set

Mode

Exam fidelity: Microsoft does not publish a fixed live question count or guarantee a question-type mix for SC-500. This lane contains multiple-choice and multiple-response exam-style practice. Practice percentages do not reproduce Microsoft's scaled scoring, and difficulty labels describe this site's Intermediate Associate-level cloud and AI security-engineering complexity rather than a Microsoft-published question rating.

Reference

SC-500 topics and reference map

Study links

SC-500 resources