The AZ-700 exam tests which service covers which security layer in an Azure network. NSG catches what firewalls at the VM level need to block, Azure Firewall handles centralized inspection that NSG cannot perform, WAF stops web-layer attacks that Azure Firewall does not parse, and DDoS Protection absorbs massive volumetric floods before they reach your workloads. Just as a single security guard cannot protect an entire skyscraper, Azure distributes network security responsibilities across multiple layers.
NSG and ASG — Guards at the Subnet and NIC Level
Think of an apartment complex where each building entrance has a card reader that only lets in residents with the right access card. That is exactly what an NSG (Network Security Group) does. An NSG is a list of allow/deny rules attached to a subnet or a network interface (NIC). Each rule evaluates a 5-tuple: source IP, destination IP, source port, destination port, and protocol.
Rules are processed in priority order, and lower numbers mean higher priority. Default rules allow intra-VNet traffic and deny inbound internet traffic. When you add ASG (Application Security Group) to the mix, you no longer need to manage individual IP lists. Create an ASG named WebServers, add your VMs to it, and reference that ASG name in NSG rules instead of specific IP addresses. In large environments with dozens of VMs, this abstraction keeps your rules readable and maintainable.
Azure Bastion — Browser-Based VM Access Without a Public IP
If every visitor to a secure office must pass through a staffed reception desk and use a dedicated access corridor, the server room door never needs to be exposed to the public hallway. Azure Bastion plays that reception role. It is a fully managed jump host that lets you open SSH or RDP sessions directly from the Azure Portal browser without assigning a public IP to your VM.
Previously, teams would spin up a jump server VM and expose it with a public IP, which itself became an attack surface. Azure Bastion eliminates that exposure. Deploy it into a dedicated subnet called AzureBastionSubnet inside your VNet, and every VM in that VNet becomes accessible through a secure browser session that Azure manages, patches, and keeps highly available.
Azure Firewall — Centralized Network-Level Firewall
Imagine a logistics hub where every package must pass through a single inspection checkpoint before leaving the facility. Azure Firewall is that checkpoint. It is a stateful, fully managed firewall service that sits at the center of your network and inspects traffic flowing between VNets, between VNets and the internet, and across peered networks.
The Standard tier provides network rules, application rules, FQDN filtering, and threat intelligence-based filtering. The Premium tier adds IDPS (Intrusion Detection and Prevention System), TLS Inspection, and URL category filtering. When an organization manages multiple VNets or subscriptions and needs consistent policy enforcement everywhere, Azure Firewall Manager lets you create and deploy Firewall Policies centrally, pushing the same rules to every Azure Firewall instance across the organization.
WAF — Blocking Web-Layer Attacks
A store entrance security guard can check bags, but they cannot read the code someone types into a web address bar to try to trick the server into leaking data. WAF (Web Application Firewall) handles exactly that kind of threat. It operates at the HTTP/HTTPS layer and uses OWASP Core Rule Set (CRS) to detect and block patterns like SQL Injection, Cross-Site Scripting (XSS), and other OWASP Top 10 attacks.
In Azure, you can deploy WAF in two places. Application Gateway WAF v2 works at the regional level, sitting in front of your backend pool and inspecting all inbound HTTP traffic to your app. Azure Front Door WAF operates at the global edge, making it ideal for applications distributed across multiple regions. Front Door Premium also includes Bot Protection. If your web application serves a single region, Application Gateway WAF is the right fit. If users come from around the world and you need global edge enforcement, Front Door WAF is the choice.
DDoS Protection — Absorbing Volumetric Traffic Floods
Picture a highway suddenly jammed by hundreds of thousands of cars trying to enter a single toll gate, making it impossible for legitimate vehicles to get through. That is a DDoS attack in network terms. Azure DDoS Protection absorbs these large-scale volumetric attacks at the Azure network layer before they can overwhelm your resources.
Two tiers are available. DDoS Network Protection activates at the VNet level and includes SLA-backed cost credits for scaling costs incurred during an attack, access to a dedicated DDoS Rapid Response team, and detailed post-attack analytics. DDoS IP Protection applies to individual public IP addresses and is a lighter option for protecting specific endpoints rather than an entire VNet. It is worth noting that Azure infrastructure itself includes basic DDoS mitigation at no cost, but SLA guarantees and cost credits only apply from Network Protection upward.
NSG vs Azure Firewall vs WAF — Which Layer Does Each Cover
These three services operate at different layers and are not interchangeable.
| Service | Layer | Primary Role | |---|---|---| | NSG | L3/L4 (Subnet, NIC) | Allow/deny by IP, port, protocol | | Azure Firewall | L3-L7 (Central VNet) | FQDN, URL, threat intelligence, stateful | | WAF | L7 (HTTP/HTTPS) | OWASP attack patterns, SQL Injection, XSS | | DDoS Protection | L3/L4 (Public IP) | Volumetric flood absorption |
NSG handles granular port control, Azure Firewall provides centralized traffic inspection, and WAF defends web applications from application-layer attacks. On the exam: "block SQL Injection on a web app" points to WAF, "centrally inspect traffic between VNets" points to Azure Firewall, "restrict subnet access by IP and port" points to NSG.
!NSG versus Azure Firewall versus WAF versus DDoS Protection
Practical Traps — Scenario Decision Points
A common mistake is assuming that deploying Azure Firewall makes NSG unnecessary. These two services complement each other rather than replace one another. Azure Firewall enforces centralized policy across the network, while NSG provides granular, fine-grained control at the subnet and NIC level. Best practice is to use both layers together.
Another frequent confusion is between WAF and Azure Firewall. Azure Firewall Premium includes IDPS, but web-specific attacks like SQL Injection and XSS require HTTP payload parsing, which is WAF's domain. When choosing between Application Gateway WAF and Front Door WAF, ask whether the workload is regional or globally distributed. Finally, the signal for Azure Bastion is clear: whenever a question says the VM must not have a public IP but SSH or RDP access is still required, Azure Bastion is the answer.
Exam Key Takeaways
"Apply port rules to a subnet" -- NSG "Reference a group of VMs in rules without listing IPs" -- ASG "SSH/RDP via browser without a public IP on the VM" -- Azure Bastion "Centrally inspect VNet-to-VNet traffic, FQDN filtering" -- Azure Firewall "IDPS, TLS Inspection, URL category filtering" -- Azure Firewall Premium "Centralize firewall policy across multiple subscriptions and VNets" -- Azure Firewall Manager "Block SQL Injection, XSS, OWASP Top 10 on a web app" -- WAF "Regional web app WAF in front of a backend pool" -- Application Gateway WAF v2 "Global edge WAF with Bot Protection" -- Azure Front Door WAF (Premium) "VNet-level DDoS with SLA cost credits" -- DDoS Network Protection "Per-public-IP DDoS protection" -- DDoS IP Protection "Network traffic control vs web attack defense" -- Azure Firewall vs WAF
NSG = granular port/IP control, Azure Firewall = centralized network firewall, WAF = web-layer attack defense, DDoS Protection = volumetric flood absorption