Network Security
Azure Firewall · DDoS · Bastion · Private Endpoint · NSG/ASG
Practice questions for this topic →
Decision table
| Need | Choose |
|---|---|
| Decrypt and inspect outbound HTTPS, IDPS, filter by full URL path | Azure Firewall Premium |
| Small business, under 250 Mbps, lowest-cost managed firewall | Azure Firewall Basic |
| Deny known-malicious IPs, DNS proxy, web categories | Azure Firewall Standard |
| Central policy across many firewalls and hubs | Azure Firewall Manager + firewall policy |
| Cost protection and DDoS Rapid Response support | DDoS Network Protection |
| DDoS protection for just a few public IPs at the lowest cost | DDoS IP Protection |
| RDP or SSH to VMs with no public IPs, sessions recorded | Azure Bastion Premium |
| Native RDP or SSH client through Bastion | Bastion Standard or Premium |
| On-prem clients reach a storage account privately | Private Endpoint + Azure DNS Private Resolver inbound endpoint |
| NSG rules written by application role, not IP address | Application Security Groups (ASGs) |
| Web application firewall | WAF on Front Door (global) or Application Gateway (regional) |
| Management ports open only on request, for a limited time | Just-in-time VM access (Defender for Servers) |
The firewall SKU, Bastion SKU and DDoS plan each have a different feature line. Read the feature in the question first, then take the lowest SKU that includes it.
Azure Firewall SKUs
- Basic: aimed at small and medium businesses, up to 250 Mbps. Basic threat intelligence only alerts.
- Standard: network-level FQDN filtering, web categories, DNS proxy, and threat intelligence in alert-and-deny mode. Up to 30 Gbps.
- Premium: TLS inspection of outbound traffic, IDPS and full-URL filtering. Up to 100 Gbps. For a single TCP flow, fat flow support is 1 Gbps on Standard and 10 Gbps on Premium, so a 5 Gbps single flow needs Premium.
- In every SKU: built-in high availability, zones and Firewall Manager.
- Forced tunneling without a public IP on the firewall: needs Standard or Premium. Every SKU supports forced tunneling.
- Rule processing order: DNAT rules, then network rules, then application rules, regardless of rule collection group or rule collection priority.
- Inbound TLS termination for a public web app: the Azure Firewall SKU comparison points to Application Gateway, not Firewall Premium.
DDoS Protection
- DDoS Network Protection: the only tier with DDoS Rapid Response support, cost protection for scale-out resources during an attack, and a WAF discount.
- DDoS IP Protection: protects a few public IPs at the lowest cost.
- Not supported: protecting a public IP attached to a NAT gateway with either DDoS Network or IP Protection.
Bastion SKUs
- Developer: free and shared, one VM connection at a time. Needs no AzureBastionSubnet and no public IP, and doesn't support peering or concurrent connections.
- Basic: connects to VMs in the same VNet and peered VNets (the lowest SKU for peered-VNet access). Dedicated deployments need an AzureBastionSubnet of /26 or larger.
- Standard: native RDP and SSH clients (through the Azure CLI), and disabling copy and paste in browser sessions.
- Premium: session recording and a private-only deployment with no public IP on the Bastion host.
Private endpoints and private DNS
- Private Endpoint gives a PaaS resource a private IP in your VNet. On-premises clients use ExpressRoute private peering plus a DNS forwarder.
- On-prem DNS: forward the privatelink name to an Azure DNS Private Resolver inbound endpoint.
- One private DNS zone per service type (for example privatelink.blob.core.windows.net for Blob and privatelink.file.core.windows.net for Files). Don't share one zone across two services' private endpoints: it can delete the initial A record and break resolution.
- Without a custom DNS server, VMs query the Azure-provided DNS service at 168.63.129.16.
Exam Tips
Tick each tip once you can answer it without looking.
“Decrypt and inspect outbound HTTPS, IDPS” → Azure Firewall Premium. Trap: Basic and Standard have no TLS inspection.
“Small business, under 250 Mbps, cheapest managed firewall” → Azure Firewall Basic.
“DNS proxy and deny known-malicious IPs” → Azure Firewall Standard. Trap: Basic threat intelligence only alerts.
“Single TCP flow at 5 Gbps through the firewall” → Premium (fat flow up to 10 Gbps).
“Cost protection and Rapid Response during a DDoS attack” → DDoS Network Protection.
“DDoS protection for a few public IPs at lowest cost” → DDoS IP Protection.
“RDP or SSH to VMs with no public IPs, sessions recorded” → Azure Bastion Premium.
“Native RDP client through Bastion, VMs in peered spokes” → Bastion Standard (native client). Trap: Basic is the lowest SKU for peered VNets, but not for the native client.
“Bastion Developer” → Free, shared, one VM connection at a time, no subnet or public IP.
“Block copy and paste in browser sessions” → Bastion Standard or Premium.
“On-prem clients reach a storage account privately” → Private Endpoint + DNS Private Resolver inbound endpoint.
“Private endpoints for Blob and Files” → A zone per service type. Trap: One shared zone can break name resolution.
“NSG rules by application role, not IP address” → Application Security Groups.
“Open management ports only on request, for a limited time” → Just-in-time VM access (Defender for Servers).
“Firewall rule types: which is processed first” → DNAT, then network, then application, regardless of priority.