Network Security Groups
Stateful layer 4 allow and deny rules attached to subnets and NICs, evaluated with platform default rules.
Readiness
0%
2h 10m baseline
Exam memorization points
- Rules are evaluated by priority from 100 to 4096, lowest number first, and processing stops at the first match.
- Each rule matches source, source port, destination, destination port, protocol and direction, plus a name and an allow/deny action.
- Default rules that cannot be modified but can be overridden: AllowVNetInBound (65000), AllowAzureLoadBalancerInBound (65001), DenyAllInBound (65500), AllowVnetOutBound (65000), AllowInternetOutBound (65001), DenyAllOutBound (65500).
- NSGs are stateful, so return traffic for an allowed flow is permitted automatically.
- An NSG can be associated with a subnet, a NIC, or both. Both are evaluated: inbound subnet then NIC, outbound NIC then subnet.
- Service tags such as VirtualNetwork, Internet, AzureLoadBalancer, Storage, Sql and AzureCloud keep rules readable and maintainable.
Traps & distractors
- Adding return-traffic rules. Stateful evaluation already handles the reply direction.
- Assuming a higher priority number wins - lower numbers are processed first.
- Blocking the load balancer health probe by removing the default AzureLoadBalancer rule, which makes backends appear unhealthy.
- Forgetting that the VirtualNetwork service tag includes peered virtual networks and the Azure load balancer, not only the local subnet.
- Believing an NSG can be attached directly to a VM object. Attach to the subnet or the NIC.
Suggested lab
Filter traffic and verify with IP flow verify
Prove which rule allowed or denied a specific flow.
- 1Create an NSG with rules allowing 443 and 22 from a specific source tag and denying everything else at priority 4096.
- 2Associate the NSG with the workload subnet, then with a NIC, and note that both are evaluated.
- 3Use Network Watcher IP flow verify to test inbound 443 and inbound 8080 and read the matching rule name.
- 4Add an application security group, place two NICs in it and write an NSG rule that targets the ASG.
- 5Enable flow logs and query the allowed and denied flows in Log Analytics.
Microsoft Learn
- Network security groups overviewdoc
- Search Microsoft Learn: NSG security rules priority service tags application security groupssearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
High priority
Strong exam value. Schedule this week.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight78% × 25% = 19.4
This topic's domain carries 17.5% of the exam objectives.
- Dependency leverage0% × 20% = 0.0
Nothing else in the graph depends on this topic.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Leaf topic - nothing depends on it.
Baseline study time
2h 10m
Complexity
3 / 5
Remaining to target
1h 51m
Status weight
0%
Topics: nsg, security rule, priority, stateful, service tag, asg, flow log
Weak neighbours in Networking