What are Network Security Groups (NSGs) in AZ 104?

If you are genuinely interested in learning about Network Security Groups, this blog is the ideal starting point. We will dive into Network Security Groups (NSGs) and their significance in the AZ-104: Microsoft Azure Administrator certification. By understanding NSG fundamentals, configuration, best practices, and troubleshooting, you’ll be well-prepared for Microsoft AZ-104 exam questions and real-world Azure deployments.

Table of Contents

Understanding Network Security Groups (NSGs) in Azure

Role of NSGs in Microsoft Azure Administrator AZ 104

How NSGs Work in Azure Networking?

Each NSG contains a collection of security rules with:

Default rules allow essential Azure traffic; custom rules override these.
NSGs are stateless: return traffic must be explicitly permitted.

Key Features and Components of NSGs

NSGs in AZ-104: Microsoft Azure Administrator Exam

NSGs Topics Covered in the AZ-104 Exam

Demonstrate NSG creation and configuration.
Associate NSGs with subnets and NICs.
Design rule sets for secure traffic flow.
Monitor and troubleshoot NSGs using Flow Logs and Network Watcher.
Explain the difference between NSGs and Azure Firewall.

Best Practices for NSGs in Azure

Understanding and implementing NSG best practices is essential for securing your Azure environment and is a key topic in the AZ-104 exam. Here are the top practices in detail:

1. Least Privilege: Only Open Required Ports

Allow only the minimum set of inbound and outbound traffic necessary for your application or service to function by following the principle of least privilege.
It is highly recommended to review and audit NSG rules in specified intervals to eliminate unnecessary access.
Also, access can be restricted to a specific range of IPs or Azure Bastion in combination with Just-In-Time(JIT) to avoid common loopholes like leaving port 3389 (RDP) or port 22 (SSH) open for public access.

2. Layered Rules: Use Subnet and NIC-Level NSGs for Defense in Depth

To defend in depth, it is important to implement NSGs at the subnet and the network interface (NIC) level. This provides control traffic for all the resources and control over individual VM traffic, respectively.
Use this layered approach to apply broad policies at the subnet level and more specific ones at the NIC level when needed.

3. Naming Conventions: Indicate Scope and Environment

To improve clarity and easily manage the NSGs, naming conventions matter. You will need to include elements like resource type, environment, region, and application name consistently.

Example: nsg-prod-westus-webapp01

This practice makes it easier to identify the purpose and location of each NSG, especially in large-scale environments.

4. Document and manage a Change Log for Audit Purposes

When there are NSG rule modifications, maintaining a clear and updated log is important for audit trails, troubleshooting, and compliance. Using tools like Azure Activity Logs, Log Analytics helps to keep track of the changes.

5. Use ARM Templates or Terraform for Repeatable NSG Deployments

Azure Resource Manager (ARM) templates or Terraform, which is Infrastructure as Code (IaC), help deploy Network Security Groups (NSGs) in a consistent and repeatable manner.
This also helps in the reduction of human error, ensures scalability, enforces version control, and integrates NSG deployment into your CI/CD pipelines, provisioning rapid and secure infrastructure.

Configuring NSGs for Microsoft Azure Administrator AZ 104

Creating and Managing NSGs in Azure

Via Azure Portal:
1. Navigate to Network Security Groups > Create.
2. Specify name, resource group, and region.
3. Add security rules (inbound/outbound) after creation.

You can use PowerShell or CLI to achieve it.

Inbound and Outbound Security Rules in NSGs

Inbound Rules:
- Control traffic to Azure resources.
- Example: Allow HTTP (port 80) from any source.
Outbound Rules:
- Control traffic from Azure resources.
- Example: Deny all outbound internet traffic except required endpoints.
Example Rule Definition:
- Priority: 300
- Source: 10.0.0.0/24
- Destination: VirtualNetwork
- Protocol: TCP
- Port Range: 443
- Action: Allow

Associating NSGs with Azure Resources

Subnet Association:
- Applies to all NICs within the subnet.
- Use for broad traffic control.
NIC Association:
- Granular control at VM level.
- Rules from both the subnet and NIC NSGs are combined.
Effective Security Rules:
- Azure Portal shows aggregated rules.
- Helps identify rule conflicts or gaps.

AZ 104 Practice Test: NSGs Questions & Concepts

Common NSG-Related Questions in the AZ 104 Practice Exam

How do you implement deny rules for specific ports?
What is the evaluation order for NSG rules?
How does an NSG differ from Azure Firewall?
How can you view NSG Flow Logs?
What tags simplify rule configuration for Azure services?

Real-World NSG Scenarios in the AZ-104 Certification

Scenario 1: Restrict RDP access to the on-premises IP range only.
Scenario 2: Block all outbound internet traffic except for Azure Update endpoints.
Scenario 3: Isolate a multi-tier application using subnet NSGs.
Scenario 4: Secure Azure Kubernetes Service (AKS) nodes by limiting API server inbound traffic.

Troubleshooting NSGs in Microsoft AZ 104

NSG Rule Evaluation & Flow Logs in Azure

NSG Flow Logs:
- Enable via Network Watcher > NSG flow logs.
- Store logs in a Storage Account or Log Analytics workspace.
Effective Security Rules:
- Azure Portal aggregates rules from the subnet and NIC NSGs.
- Use to verify which rule is applied to traffic.
Network Watcher Connection Troubleshoot:
- Diagnose packet drops and latency issues.

Common Issues & How to Resolve Them

Unexpected Traffic Block:
- Check NSG rule priority and direction.
- Review default rules and custom overrides.
Cannot access VM:
- Verify the inbound rule for the correct port and source.
- Ensure no conflicting deny rules exist.
Flow Logs Not Capturing Data:
- Confirm NSG is linked to a resource in the same region as Network Watcher.
- Check log retention and storage account permissions.

Conclusion: Mastering NSGs for the AZ104 Certificate

Next Steps in Preparing for the AZ-104 Exam

Practice NSG deployments in a live Azure subscription.
Complete multiple AZ-104 practice tests focusing on NSG sections.
Review the exam AZ 104 Microsoft Azure Administrator official study guide.

Additional Resources for Exam AZ-104 Microsoft Azure Administrator

Azure NSG Overview
Azure Administrator
Microsoft Learn: AZ-104 Learning Path

In this blog, we explored the core concepts, setup process, best practices, and troubleshooting tips for Network Security Groups (NSGs) — all essential for mastering the AZ-104: Microsoft Azure Administrator Exam. Now it’s your turn! Start practicing NSGs in your Azure lab environment to build hands-on confidence. Whether you’re securing virtual networks or preparing for exam day, applying what you’ve learned is key. Stay consistent, stay curious, and take that next big step toward becoming an Azure-certified pro!

Also Read: Data Privacy in iGaming – Essential Practices for Platform Owners