What's changed: Deepened AZ-700 Chapter 4 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
4.1Securing Networks (NSG, Firewall, WAF, DDoS)
From a network engineer’s view, understand combining NSG/ASG (L3/L4 filtering), Azure Firewall (centralized stateful), WAF (L7 defense), and DDoS Protection (volumetric mitigation) in a layered design.
Network defense is not a single feature; you layer mechanisms with different roles per layer. Choose services by which layer and scope you protect.
4.1.1Layered defense combination
- NSG/ASG: L3/L4 filtering at subnet/NIC; ASGs group VMs by role.
- Azure Firewall: centralized, stateful; FQDN-based app rules and threat intelligence.
- WAF: defends L7 attacks (SQLi/XSS); runs on Application Gateway/Front Door.
- DDoS Protection: mitigates volumetric attacks.
Common on AZ-700: distinguish layers/scopes—L3/L4 = NSG/ASG, centralized stateful FQDN = Azure Firewall, L7 = WAF, volumetric = DDoS Protection. NSG + Firewall together (fine-grained + central perimeter) is standard.
These also appear in AZ-500, but AZ-700 emphasizes network design—where to place them and how to route through them.
AZ-700 emphasizes each service’s placement and routing. Azure Firewall goes in the hub VNet’s dedicated AzureFirewallSubnet, and spoke UDRs (0.0.0.0/0 → firewall private IP) consolidate East-West/North-South inspection. Its SKUs are Standard (baseline) and Premium (TLS inspection, IDPS, URL filtering), managed centrally across firewalls via Firewall Manager and Firewall Policy. A WAF binds to Application Gateway (regional) or Front Door (global edge), blocking L7 attacks with OWASP managed rules plus custom rules. For DDoS, beyond the default infrastructure protection you choose DDoS Network Protection (per-VNet) or DDoS IP Protection (per public IP). NSG/ASG are the innermost L3/L4 filter and are used together with the firewall (central perimeter). Tightening PaaS paths with service endpoints/private endpoints further shrinks the attack surface. The design knack is combining by OSI layer and scope (NIC/subnet / VNet / global).
| Defense | OSI layer | Scope | Key role |
|---|---|---|---|
| NSG / ASG | L3/L4 | Subnet / NIC | Allow/deny by IP/port |
| Azure Firewall | L3–L7 | VNet (hub) | Central, stateful, FQDN, IDPS (Premium) |
| WAF | L7 | App GW (regional) / Front Door (global) | Block SQLi/XSS, etc. |
| DDoS Protection | L3/L4 scale | VNet / public IP | Mitigate volumetric |
Scenario: centrally inspect all spoke traffic in hub-and-spoke while protecting public web from L7 attacks. → Place Azure Firewall in the hub’s AzureFirewallSubnet and point each spoke’s UDR 0.0.0.0/0 → firewall for central inspection. Protect public web with a WAF on Front Door/Application Gateway, and keep intra-VNet least-privilege with NSG/ASG.
FAQ: Q. With NSGs, do I still need Azure Firewall? → A. Different roles—NSGs are distributed L3/L4 allow/deny; Firewall is central, stateful, FQDN/IDPS. Most designs use both. Q. WAF on App Gateway or Front Door? → A. App Gateway for regional, Front Door for global delivery.
Trap: “DDoS Protection blocks SQL injection” is wrong—L7 app attacks are the WAF’s job; DDoS mitigates volumetric. Also “NSGs can do FQDN-based egress control” is wrong—FQDN rules are Azure Firewall application rules; NSGs are IP/port only.
4.1.2Section summary
- Layered defense = NSG/ASG (L3/L4) + Firewall (central) + WAF (L7) + DDoS (volumetric)
- Choose the right service by layer and scope
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which performs L3/L4 (IP/port) filtering at subnet/NIC level?
Q2. Which stateful service centrally manages VNet traffic with FQDN-based rules?
Q3. Which mitigates volumetric attacks that flood a service to take it down?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.