AZ-900 Describe Azure architecture and services Practice Question
Which Azure network security service filters network traffic to and from Azure resources using rules based on source, destination, port, and protocol?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Firewall with NSGs because both perform filtering, but Azure Firewall is a centralized, managed service for advanced scenarios (e.g., inspecting outbound traffic to the internet), while NSGs are the correct answer for basic, rule-based filtering at the resource or subnet level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Security Groups (NSGs)
Network Security Groups (NSGs) are the correct answer because they filter network traffic to and from Azure resources at the subnet or network interface level using rules that specify source, destination, port, and protocol. NSGs operate as a distributed, stateful firewall that evaluates each packet against a set of allow or deny rules, making them the primary tool for granular network traffic control within a virtual network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a fully managed, stateful firewall-as-a-service that provides centralized protection across virtual networks, including FQDN filtering, threat intelligence, and NAT capabilities. It operates at both network and application layers (L3-L7) and is typically deployed as a central security boundary for enterprise architectures. However, for basic, per-subnet or per-NIC traffic filtering based on source/destination IP, port, and protocol, NSGs are the native, lightweight, and cost-effective solution. Azure Firewall is an advanced option that goes well beyond the simple filtering needed here.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is a defensive service that continuously monitors Azure resources and mitigates volumetric, protocol, and application-layer distributed denial-of-service attacks. It automatically activates only during an attack, and it does not allow users to define custom allow/deny rules for everyday traffic management. Its purpose is to ensure availability under attack, not to filter specific traffic flows based on source, destination, port, or protocol. Thus, for routine traffic filtering, NSGs are the correct service, not DDoS Protection.
- ✓
Network Security Groups (NSGs)
Why this is correct
Network Security Groups (NSGs) contain security rules that allow or deny inbound and outbound traffic to Azure resources. Each rule specifies source and destination IP ranges, port ranges, and protocol (TCP, UDP, or any), with a priority that determines evaluation order. NSGs are stateful, meaning return traffic is automatically allowed, and they can be associated with subnets or virtual machine network interfaces. This makes them the ideal, low-cost, and granular tool for basic network traffic filtering in Azure.
- ✗
Azure WAF
Why it's wrong here
Azure Web Application Firewall (WAF) is specifically designed to protect web applications from layer 7 attacks such as SQL injection, cross-site scripting, and other OWASP Top 10 threats. It is integrated with Application Gateway or Front Door and inspects HTTP/HTTPS traffic, not raw network packets. NSGs filter traffic at the network layer (L3/L4) using IP addresses, ports, and protocols, without any application-layer awareness. Since the requirement is basic traffic filtering rather than web attack protection, WAF is not the correct choice.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.