What's changed: Added per-section figures (cert-figure-retrofit). New SC-500 Chapter 2 (Domain 2 "Secure storage, databases, and networking": storage = firewall/private endpoint/Entra authorization-SAS/Defender for Storage; Azure SQL = Entra auth/auditing/TDE-Always Encrypted/Defender for Databases; networking = NSG-ASG/Virtual Network Manager/Virtual WAN-VPN/Entra Private Access/private endpoint-Private Link; Azure Firewall = application/network/DNAT rules, threat intel/IDPS, Firewall Policy/Network Watcher diagnostics)
2.2Controlling Azure network access
Learn network security groups (NSGs) and application security groups (ASGs), network access policies via Azure Virtual Network Manager, security for Virtual WAN and VPN, Microsoft Entra Private Access, and protecting PaaS with private endpoints and Private Link services.
At the network layer the principle is to minimize reachable paths. Control VM/subnet traffic with NSGs/ASGs, manage rules across many VNets centrally with Azure Virtual Network Manager, and make PaaS reachability private with private endpoints. Replace remote access with VPN or identity-based Entra Private Access.
2.2.1NSGs and ASGs
A network security group (NSG) is a set of stateful allow/deny rules applied to a subnet or NIC. Rules are evaluated by priority (lower number first), and the first match wins. An application security group (ASG) groups VMs by application role (e.g., web/app/db), letting you write rules by ASG name instead of IPs—keeping rules simple and dynamic. You can express intent like "allow only web tier → DB tier" without depending on IP addresses.
2.2.2Azure Virtual Network Manager
Azure Virtual Network Manager (AVNM) groups many VNets as network groups and applies connectivity (hub-and-spoke/mesh) and security admin rules centrally. Security admin rules are higher-priority rules evaluated before NSGs, letting the organization enforce guardrails like "always deny this port" that individual teams cannot override with their NSGs. Use it for consistent network security at scale.
2.2.3Virtual WAN, VPN, and Entra Private Access
- Azure Virtual WAN: a wide-area networking hub uniting sites, VNets, and remote users; a secured virtual hub (with Azure Firewall) centralizes inspection/protection.
- VPN (S2S/P2S): encrypted tunnels from on-premises or personal devices; secured with certificate/Entra authentication and conditional access.
- Microsoft Entra Private Access: replaces VPN by granting identity-based, per-app access (Zero Trust) to internal apps—reaching only the needed apps, not the whole network.
2.2.4Private endpoints and Private Link services
A private endpoint assigns a private IP inside your VNet to a PaaS resource (Storage, SQL, Key Vault, etc.) so it is reachable without traversing the public internet. Conversely, a Private Link service privately publishes a service you host (e.g., behind a Standard Load Balancer) to other tenants/VNets. Remember: "consuming PaaS privately = private endpoint"; "providing your own service privately = Private Link service."
| Goal | Feature | Key point |
|---|---|---|
| Control subnet/NIC traffic | NSG (+ ASG to group by role) | Stateful; priority order; first match |
| Centrally manage many VNets | Azure Virtual Network Manager | Security admin rules evaluated before NSGs; non-overridable |
| Remote access (Zero Trust) | Entra Private Access | VPN alternative; per-app; identity-based |
| Consume PaaS privately | Private endpoint | Private IP in your VNet for the PaaS |
| Provide your service privately | Private Link service | Provider-side publishing (inverse of consumer) |
Watch the mix-ups: (1) private endpoint (consume PaaS privately = consumer side) vs Private Link service (publish your own service privately = provider side)—opposite directions. (2) NSG (team-managed) vs AVNM security admin rules (org-enforced, evaluated before NSGs, non-overridable). (3) VPN (network reachability) vs Entra Private Access (per-app, identity-based Zero Trust).
Map requirement → feature: "org-wide, force-deny a port that teams cannot override" = AVNM security admin rules; "group VMs by web/app/db role to simplify rules" = ASG; "use Storage over a private IP" = private endpoint; "replace VPN with per-app identity-based access" = Entra Private Access.
2.2.5Section summary
- NSG = stateful, priority order, first match; ASG = group by role, IP-independent
- AVNM = central management of many VNets; security admin rules precede NSGs and cannot be overridden
- Remote: VPN → Entra Private Access (per-app/identity-based); PaaS via private endpoint; provide via Private Link service
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which correctly describes how NSG rules are evaluated?
Q2. Which service centrally manages many VNets and enforces org-wide guardrail rules that teams cannot override with NSGs?
Q3. Which feature groups VMs by application role (web/app/db) so NSG rules can be written without depending on IP addresses?
Q4. Which provides identity-based, per-app (Zero Trust) access to internal apps as an alternative to VPN?
Q5. Which mechanism privately publishes a service you host in your VNet to other tenants or VNets?
Q6. Which is used to consume PaaS resources like Storage or SQL via a private IP in your VNet, avoiding the public internet?