What's changed: Deepened AZ-700 Chapter 4 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
4.1Securing Networks (NSG, Firewall, WAF, DDoS)
From a network engineer’s view, understand combining NSG/ASG (L3/L4 filtering), Azure Firewall (centralized stateful), WAF (L7 defense), and DDoS Protection (volumetric mitigation) in a layered design.
Network defense is not a single feature; you layer mechanisms with different roles per layer. Choose services by which layer and scope you protect.
4.1.1Layered defense combination
- NSG/ASG: L3/L4 filtering at subnet/NIC; ASGs group VMs by role.
- Azure Firewall: centralized, stateful; FQDN-based app rules and threat intelligence.
- WAF: defends L7 attacks (SQLi/XSS); runs on Application Gateway/Front Door.
- DDoS Protection: mitigates volumetric attacks.
Common on AZ-700: distinguish layers/scopes—L3/L4 = NSG/ASG, centralized stateful FQDN = Azure Firewall, L7 = WAF, volumetric = DDoS Protection. NSG + Firewall together (fine-grained + central perimeter) is standard.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.