Instiq
Chapter 4 · Implement and Manage Virtual Networking·v2.0.0·Updated 6/16/2026·~9 min

What's changed: Deepened AZ-104 Chapter 4 to Associate depth (tables, scenarios, FAQ, traps; localized figures)

4.2Network Security Groups (NSG)

Key points

Understand allowing/denying inbound/outbound traffic with NSGs, evaluation by priority, 5-tuple rules, and applying NSGs to subnets/NICs.

A network security group (NSG) decides what traffic to allow or block. Apply it to a subnet or NIC, and control inbound/outbound with rules.

4.2.1NSG rules

Diagram showing NSG rules evaluated by priority (lower number first)—e.g., "100 Allow TCP443 from Internet", "200 Allow TCP3306 from web subnet", and the default "4096 Deny all"—with rules defined by a 5-tuple (src/dst/port/proto/dir) and NSGs being stateful.
NSG rules and priority
  • Rules: allow/deny by source, destination, port, protocol, direction (a 5-tuple).
  • Priority: lower numbers are evaluated first; the first match wins.
  • Applied to: a subnet or NIC. NSGs are stateful (return traffic auto-allowed).
Exam point

Common on AZ-104: allow/block a port = NSG rule, lower priority number evaluated first, NSGs are stateful, applied to subnet or NIC. By default inbound is largely denied while intra-VNet is allowed.

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started freeLog in