Name the protected object
Network security is not one interchangeable capability. A requirement can concern a subnet connection, a web request, a large-scale availability threat, an administrator’s VM connection, or a stored application secret. Start by naming that object and the decision needed. Several controls can be complementary in a larger design. The foundational exercise asks which capability directly addresses a specified requirement, rather than recommending a complete architecture or proving that one control is sufficient.
Separate filtering purposes
A network security group supplies basic stateful packet filtering with source and destination addresses, ports and protocol. Azure Firewall is a network firewall service. A web application firewall provides centralized protection against common web-application exploits. DDoS protection addresses distributed-denial-of-service threats against Azure resources. These descriptions distinguish protection purposes; they do not imply that every attack neatly belongs to one product or that packet rules perform all web-content inspection. Keep the requested criteria and protected surface in the comparison.
Connectivity and stored secrets
Azure Bastion provides managed RDP/SSH connectivity to Azure VMs using their private addresses; a VM need not have a public IP address for that Bastion connection. An NSG can regulate traffic, but a traffic rule does not itself provide that managed connection service. Key Vault addresses controlled storage of secrets and management of keys/certificates. A secret-management requirement is not met merely by choosing a network filter, even though network controls may participate in the wider design.
Worked example
Fictional teaching case: a small observatory reviews two proposals. One controls which subnet connections are allowed using addresses, ports and protocol. The other gives operators a managed VM-administration path without adding public IP addresses to the VMs. Match the first to the NSG filtering model and the second to Bastion connectivity. Then challenge the first answer as a substitute for the second: allowing suitable packets is not the service that establishes the managed administrative connection. The comparison succeeds because the outputs of the two jobs are different.
Transfer check
Change the problem to a fictional web collection. Its planner requests centralized protection for common web-request exploit patterns at a supported front end, while a separate team handles network-volume DDoS concerns. Should the planner answer NSG simply because web traffic uses ports? Check basis: no. The requested inspection/protection purpose points to WAF. Packet criteria remain useful at their layer, but they do not express the named web-request purpose. This exercise contains no exploit payloads, scans or attack instructions.
Verify purpose before product
Write a short result of the form “this capability addresses this object and decision.” Avoid “secures everything.” A full design may need multiple layers, configuration and qualified review. This unit intentionally omits SKUs, prices, quotas, deployment steps and detailed firewall-rule syntax; it does not treat the existence of a network lesson as complete coverage of every infrastructure leaf.
Segmentation and enforcement are separate evidence
Virtual-network segmentation defines boundaries such as subnets. Network controls enforce which traffic may cross relevant boundaries. A fictional diagram with separate web and database subnets is a useful design artifact, but it does not prove the effective rules block an unwanted path. Check the actual traffic condition, the applicable filtering control and the resulting connectivity. A managed stateful firewall can be part of that design without granting application users their data roles. As a transfer check, imagine an authenticated user whose connection reaches the application but whose role lacks the requested permission. Changing a subnet label does not correct that authorization decision. Network evidence and identity evidence should be evaluated at their own scopes.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
What is Azure Bastion? | Microsoft LearnDescribe defense in depth - Training | Microsoft LearnAzure Key Vault Overview - Azure Key Vault | Microsoft LearnAzure network security overview | Microsoft LearnIntroduction to Azure Web Application Firewall | Microsoft LearnMicrosoft Learn: rd-sc-network