What's changed: Added per-section figures (cert-figure-retrofit). New SC-500 Chapter 2 (Domain 2 "Secure storage, databases, and networking": storage = firewall/private endpoint/Entra authorization-SAS/Defender for Storage; Azure SQL = Entra auth/auditing/TDE-Always Encrypted/Defender for Databases; networking = NSG-ASG/Virtual Network Manager/Virtual WAN-VPN/Entra Private Access/private endpoint-Private Link; Azure Firewall = application/network/DNAT rules, threat intel/IDPS, Firewall Policy/Network Watcher diagnostics)
2.3Azure Firewall and evaluating effective security rules
Learn centralized traffic inspection and protection with Azure Firewall (application/network rules, threat intelligence, DNAT, Firewall Policy) and how to evaluate effective security rules and troubleshoot using Azure Network Watcher diagnostics.
Whereas NSGs handle "simple allow/deny at subnet/NIC," Azure Firewall is a stateful managed firewall at the VNet boundary providing advanced centralized inspection (FQDN/application rules, threat-intelligence-based blocking, inbound DNAT). Because configuration grows complex, consolidate rules into an Azure Firewall Policy shared and tiered across firewalls. When troubleshooting, use Azure Network Watcher diagnostics to see "which rules actually apply."
2.3.1Azure Firewall rules and capabilities
- Application rules: control outbound HTTP/S by FQDN (e.g., *.windowsupdate.com).
- Network rules: control by IP/port/protocol (more advanced and centralized than NSGs).
- DNAT rules: translate/forward inbound traffic to internal resources (protect published endpoints).
- Threat intelligence: alert/deny traffic to known-malicious IPs/domains; IDPS (Premium) adds intrusion detection/prevention.
- Firewall Policy: centrally manage rules with parent/child inheritance (org standard + team-specific).
2.3.2Evaluating effective rules with Network Watcher
Problems like "I wrote a rule but traffic is blocked / still flows" arise from overlapping layers (AVNM security admin rules → NSG → Azure Firewall). Azure Network Watcher shows effective security rules ("the combined NSG rules actually applied to a NIC") and, via connection troubleshoot / IP flow verify, explains why a specific flow is allowed or denied. VNet flow logs (NSG flow logs are being retired, so migrate to the successor VNet flow logs) record traffic for investigation and ingestion into Sentinel.
| Aspect | NSG | Azure Firewall |
|---|---|---|
| Placement | Subnet/NIC | VNet boundary (centralized) |
| Control | IP/port (stateful) | FQDN/app, IP/port, DNAT, threat intel/IDPS |
| Management | Per resource | Centralized/inherited via Firewall Policy |
| Evaluate/diagnose | Network Watcher effective rules / IP flow verify | Firewall logs + Network Watcher connection troubleshoot |
Watch the mix-ups: (1) NSG (basic allow/deny at subnet/NIC) vs Azure Firewall (centralized inspection with FQDN/threat intel/DNAT/IDPS) are different roles—use both. (2) When a rule "doesn’t work," check effective rules via Network Watcher effective security rules / IP flow verify (untangle the AVNM→NSG→Firewall overlap). (3) flow logs (recording) vs rule evaluation (root cause) are different.
Map requirement → feature: "limit outbound to allowed domains (FQDN)" = Azure Firewall application rules; "block traffic to known-malicious IPs" = threat intelligence/IDPS; "centrally manage/inherit rules across firewalls" = Firewall Policy; "see the rules actually applied to a NIC" = Network Watcher effective security rules.
2.3.3Section summary
- Azure Firewall = centralized inspection at the VNet boundary (application/network/DNAT rules, threat intel/IDPS); managed/inherited via Firewall Policy
- NSG and Firewall play different roles and are used together; verify effective rules with Network Watcher
- Network Watcher = effective security rules, IP flow verify, connection troubleshoot, flow logs
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To limit outbound traffic to allowed FQDNs (e.g., *.windowsupdate.com), which Azure Firewall rule type do you use?
Q2. Which Azure Firewall capability alerts or denies traffic to known-malicious IPs and domains?
Q3. To centrally manage common rules across multiple Azure Firewalls with parent/child inheritance, which do you use?
Q4. Which shows the combined NSG rules actually applied to a NIC and diagnoses why a flow is allowed/denied?
Q5. Which statement about NSGs and Azure Firewall is correct?
Q6. Which Azure Firewall rule translates and forwards inbound traffic to internal resources to protect published endpoints?