AZ-900 Describe Azure architecture and services Practice Question
Which Azure security service provides a cloud-native firewall with built-in high availability and unrestricted cloud scalability?
⚠ Common exam trap
Watch out — candidates often confuse Azure Firewall with Network Security Groups (NSGs) because both filter traffic, but NSGs lack the centralized management, built-in high availability, and automatic scaling that define Azure Firewall as a cloud-native firewall service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Firewall
Azure Firewall is a cloud-native, stateful firewall as a service that provides built-in high availability and scales automatically to accommodate changing network traffic patterns. Unlike other options, it is designed specifically as a managed firewall service with unrestricted cloud scalability, supporting both inbound and outbound traffic filtering at the network and application layers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network Security Groups
Why it's wrong here
Network Security Groups (NSGs) are distributed, stateful packet filters that operate at the subnet or network interface level. They offer basic allow/deny rules based on source/destination IP, port, and protocol, but lack centralized administration, FQDN filtering, threat intelligence, and advanced logging. NSGs are best suited for micro-segmentation within a VNet, not as a full network firewall solution. Because they are not a managed centralized service, they cannot replace Azure Firewall for comprehensive, policy-driven network security.
- ✗
Azure WAF
Why it's wrong here
Azure WAF (Web Application Firewall) protects web applications at the application layer (L7) from attacks like SQL injection and cross-site scripting, using the OWASP Core Rule Set. It is tightly integrated with Application Gateway and Front Door, and only inspects HTTP/S traffic destined for specific web apps. It does not filter non-web traffic, IP/port/FQDN rules, or inter-VNet traffic, so it cannot serve as a general network firewall. Azure WAF addresses web-specific threats, whereas Azure Firewall provides broad network-layer security across all assets.
- ✓
Azure Firewall
Why this is correct
Azure Firewall is a managed, stateful, cloud-native firewall service. It provides centralized traffic filtering across all VNets and subscriptions, with built-in FQDN filtering, threat intelligence integration, and automatic scaling. Unlike NSGs or WAFs, it handles both internal and external network traffic at L3-L4 (plus selective L7) and offers enterprise-grade logging and policy management. For the AZ-900 scope, Azure Firewall is the definitive modern firewall service for securing cloud workloads.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is specifically designed to mitigate volumetric attacks (L3/L4) such as SYN floods or UDP amplification by absorbing traffic at Azure's edge. It does not enforce granular allow/deny policies based on IP, FQDN, or port—it only monitors and scrubs attack traffic during a DDoS event. This makes it a protective layer that complements, but never replaces, a stateful firewall. Unlike Azure Firewall, it offers no continuous, policy-based traffic inspection for everyday workloads.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Scalability
Scalability is the ability of a system, network, or process to handle a growing amount of work by adding resources, either by making the existing resources more powerful (vertical scaling) or by adding more resources (horizontal scaling).
Key term
Azure Firewall
Azure Firewall is a cloud-based network security service that protects your virtual networks in Microsoft Azure by filtering traffic based on rules you define.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.