What's changed: Added an awareness note on Microsoft Security Copilot (generative-AI security operations, Ignite 2025) to the Sentinel section, reflecting the AI-assist trend (no structural change to official skills measured).
3.3Azure Network and Infrastructure Security
Understand Azure’s foundational security features—network security groups (NSG), Azure Firewall, DDoS Protection, and Azure Key Vault.
The "network" and "infrastructure" layers of defense in depth are supported by traffic control and key management features. Learn the key ones.
3.3.1Key features
- Network security group (NSG): a basic rule set to allow/deny traffic by source/destination, port, and protocol at the subnet or NIC level.
- Azure Firewall: a managed, stateful network firewall for centralized control, including threat-intelligence-based blocking.
- Azure DDoS Protection: detects and absorbs DDoS attacks that flood a service to take it down, protecting apps.
- Azure Key Vault: securely stores and manages keys, secrets (e.g., connection strings), and certificates, so they need not be embedded in apps.
These map to the defense-in-depth layers from the previous chapter. NSG and Azure Firewall control traffic at the network/perimeter layer, DDoS Protection absorbs volumetric attacks at the perimeter, and Key Vault protects secrets at the data/secrets layer. Note the scale/feature difference: NSG is "simple allow/deny at subnet/NIC," while Azure Firewall is "centralized, advanced filtering for the whole org."
| Feature | Layer | Role |
|---|---|---|
| NSG | Network | Allow/deny at subnet/NIC |
| Azure Firewall | Perimeter/network | Centralized managed firewall |
| DDoS Protection | Perimeter | Absorb volumetric attacks |
| Key Vault | Data/secrets | Store keys/secrets/certs |
Scenario: foundational defense for a web app. Put Azure Firewall and DDoS Protection at the internet-facing entry for central defense. Use NSG per subnet for fine control ("web tier allows only 443; DB tier only from the app tier"). Store the DB connection string in Key Vault and fetch it via a managed identity (previous chapter) without holding keys. Defense in depth, implemented with Azure features.
Watch the mix-ups: (1) NSG (simple allow/deny at subnet/NIC) vs Azure Firewall (centralized, advanced managed FW)—different scale/features. (2) DDoS Protection safeguards availability (the A in CIA). (3) Store keys in Key Vault, never embed in apps (commonly paired with managed identities).
Q. NSG or Azure Firewall? NSG for fine subnet/NIC control; Azure Firewall for centralized, advanced filtering—often used together. Q. What does Key Vault protect? It centrally manages keys/secrets/certs, lowering leak risk (confidentiality). Q. What is a DDoS attack? Flooding a service with traffic to overload and down it; DDoS Protection absorbs it (availability).
Common mappings: allow/deny at subnet/NIC = NSG, centralized managed firewall = Azure Firewall, absorb DDoS = DDoS Protection (availability), store keys/secrets = Key Vault (confidentiality). Map them to defense-in-depth layers.
3.3.2Section summary
- NSG (allow/deny) / Azure Firewall (managed FW)
- DDoS Protection (absorb attacks) / Key Vault (store keys/secrets)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which rules allow/deny traffic at the subnet or network interface level?
Q2. Which Azure service securely stores and manages keys, secrets, and certificates?
Q3. Which protects against attacks that flood a service with traffic to take it down?