MSDEVBUILD / azure

Network Security Groups

Internet Office VNet 10.0.0.0/16 web subnet data subnet ✓NSG LOAD BAL. VNet 2 🗄️Storage (PaaS) Azure DNS ✕ A network security group allows or blocks traffic like a firewall
The NSG checks every visitor against its rules. Unwanted traffic is turned away at the door.

😟 THE PROBLEM

A VM with RDP open to the internet is attacked by bots within hours.

😊 THE SOLUTION

Use NSG rules to allow only the traffic you need.

  • Bots guessing passwords on port 3389✓ Deny RDP from the internet
  • Database open to all subnets✓ Allow only the web subnet
  • No idea what is allowed✓ Clear, prioritised rule list
🛠️ Solved with: Network security groups
Try it yourself in the Azure simulator No Azure account needed. Launch a VM and save money 🖥️ Try it ❯
Module 2: Architecture & Services ⏱ 5 min read Updated 11 Nov 2026 Beyond the exam: real-world knowledge

Quick answer

A network security group (NSG) is a basic firewall for Azure virtual networks. It contains security rules that allow or deny inbound and outbound traffic based on source, destination, port and protocol. You attach an NSG to a subnet or a network interface, and rules are evaluated in priority order.

Exam objective: 2.2.5 Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute. (Skills measured as of July 20, 2026)

Start with a question

Who decides which visitors can knock on your server’s door?

A network security group: a list of rules saying who may come in, on which door (port), and who must be turned away.

Explain it like I’m 10

The technical explanation

PriorityNamePortSourceAction
100Allow-HTTPS443InternetAllow
200Allow-SSH-from-office22203.0.113.0/24Allow
65500DenyAllInBound (default)AnyAnyDeny

Real-world business scenario

Enterprise

A small software company

The problem
A test VM had RDP open to the internet and was attacked by password-guessing bots within hours.
What they used
Removed the open rule, allowed RDP only from the office IP range, and later moved to Azure Bastion.
Why that choice
NSG rules limit who can reach management ports.
The result
Brute-force attempts stopped immediately.

When to use it and when not to

✓ Use it when…

  • Segment subnets (web, app, data).
  • Restrict management ports to known IPs.

✕ Think twice when…

  • Relying on NSGs alone for advanced inspection. Add Azure Firewall or a WAF where needed.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is a network security group?

Model answer

It is a list of firewall rules for Azure networks. Each rule allows or blocks traffic based on where it comes from, where it goes, the port and the protocol.

Intermediate How are NSG rules evaluated?

Model answer

By priority. The lowest number is checked first, and processing stops at the first rule that matches. Default rules allow traffic within the VNet and from the Azure load balancer, and deny other inbound traffic from the internet.

Experienced developer NSG or Azure Firewall?

Model answer

NSGs are free, distributed, layer 3 and 4 filters on subnets and NICs, ideal for segmentation. Azure Firewall is a managed, stateful, centralised firewall with FQDN filtering, threat intelligence and logging, used in a hub to control traffic between networks and the internet. Most designs use both.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

What does a network security group do?

Question 2

Question 2 of 3

Where can a network security group be associated?

Question 3

Question 3 of 3

An NSG has an allow rule at priority 300 and a deny rule at priority 200 for the same traffic. What happens?

Quick revision

Key points

  • NSGs filter traffic with allow and deny rules.
  • Rules use source, destination, port, protocol and priority.
  • Attach to subnets or network interfaces.
  • Lower priority numbers are evaluated first.

Important terminology

NSG
A set of allow and deny rules that filter network traffic to and from Azure resources.
Security rule
A rule with priority, source, destination, port, protocol and action (allow or deny).
Priority
A number from 100 to 4096; lower numbers are processed first.

Common mistakes

  • Opening RDP (3389) or SSH (22) to the whole internet.

Exam tips

  • "Allow or deny inbound traffic to VMs by port" = network security group.

Five quick revision questions

  1. 1.What does an NSG do?Show

    Allows or denies network traffic with rules.

  2. 2.Where can you attach an NSG?Show

    To a subnet or a network interface.

  3. 3.Which rule is evaluated first, priority 100 or 200?Show

    100.

  4. 4.Name four rule properties.Show

    Source, destination, port and protocol (plus priority and action).

  5. 5.Is inbound internet traffic allowed by default?Show

    No, default rules deny it unless you add an allow rule.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Azure VPN Gateway