📖 What is Network Security Group (NSG)?
Network Security Group (NSG) is a filter for network traffic that contains a list of security rules that allow or deny inbound and outbound traffic. These rules are applied to network interfaces or subnets to protect Azure resources from unauthorized access.
"Remember that NSG rules are processed by priority; the lower the number, the higher the priority."
📚 Certification: Microsoft Azure Fundamentals (AZ-900)
🔑 What are the Key Concepts of Network Security Group (NSG)?
- ▸ Rule Priority: Rules are processed in order from lowest to highest number; once a match is found, processing stops and that rule is applied.
- ▸ Application Scope: NSGs can be associated with either an individual network interface (NIC) or an entire subnet to provide flexible, layered security boundaries.
- ▸ Traffic Direction: NSGs manage both inbound traffic entering the resource and outbound traffic leaving the resource using two separate sets of security rules.
- ▸ Default Rules: Every NSG includes default rules that allow communication within the virtual network and outbound internet access, which can be overridden by custom rules.
- ▸ Five-Tuple Matching: Rules filter traffic based on five specific criteria: source, source port, destination, destination port, and the protocol used (TCP or UDP).
🎯 How does Network Security Group (NSG) appear on the AZ-900 Exam?
You may be asked to identify the correct tool for blocking specific ports, such as port 80 or 443, to prevent unauthorized web traffic from reaching a virtual machine.
A scenario might describe a need to secure an entire group of virtual machines simultaneously; you should recognize that applying an NSG at the subnet level is the most efficient solution.
Expect questions where you must determine which rule takes precedence when multiple rules overlap, requiring you to identify the rule with the lowest priority number as the winning rule.
❓ Frequently Asked Questions
Can an NSG be applied to both a subnet and a network interface at the same time?
Yes. For inbound traffic, the subnet NSG is processed first, then the NIC NSG. For outbound traffic, the NIC NSG is processed first, followed by the subnet NSG.
What happens if no custom rules match the traffic being sent to a resource?
The traffic is evaluated against the default security rules. If no default rule allows the traffic, it is blocked by the final 'deny all' rule.