AZ-700 · Domain 5 of 5

AZ-700 Domain 5: Design and implement Azure network security services

Filtering and inspecting Azure network traffic: network and application security groups, VNet flow logs and IP flow verify, Bastion access rules, Azure Firewall SKUs, rules and Firewall Manager policies, secured virtual hubs, and Web Application Firewall policies.

Exam weight
15–20%
Official functional groups
3
Estimated questions estimate
~9
Suggested study time estimate
9–12 hrs

About 12 min read Reviewed October 2026

Overview

Domain 5 covers the controls that decide which traffic is allowed and how it is inspected. Microsoft lists three functional groups. Network security groups cover creating NSGs and associating them with subnets or NICs, application security groups, inbound and outbound rules, virtual network flow logs and how to interpret them, IP flow verify, NSG rules for remote administration including Azure Bastion, and security admin rules in Azure Virtual Network Manager.

The Azure Firewall group covers features, SKU choice, deployment design, rules, Firewall Manager policies and secured virtual hubs inside Virtual WAN. The WAF group covers features, deployment design, detection versus prevention mode, rule sets on Front Door and on Application Gateway, and creating and associating WAF policies. Together they form layered defense: NSGs filter at layers 3 and 4, Azure Firewall inspects centrally, and WAF protects web apps at layer 7.

How it's tested

Network security questions describe traffic that must be allowed, blocked, logged or inspected, then ask which control and which rule type to configure. Others give an NSG rule table and ask whether a flow succeeds. Read priorities, service tags and association points carefully, because one number often decides the answer.

  • Evaluate the rule table

    An NSG or firewall rule list is shown, and you decide whether a specific flow is allowed or denied.

  • Pick the control layer

    A threat or requirement is described, and you choose NSG, Azure Firewall, WAF or a Virtual Network Manager security admin rule.

  • Select the SKU or mode

    Features like TLS inspection, IDPS or blocking mode are required, and you pick the Firewall SKU or WAF mode.

Reasoning it through

Outbound traffic from app servers must be limited to *.contoso.com over HTTPS, with all other internet traffic blocked and logged centrally. NSGs filter by IP and service tag, not FQDN, so they cannot express this rule alone. Azure Firewall application rules match FQDNs over HTTP and HTTPS. A UDR sending 0.0.0.0/0 to the firewall forces traffic through it, so Azure Firewall with an application rule is the fit.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

5.1 Implement and manage network security groupsNSGs, ASGs, rules, flow logs, IP flow verify, Bastion access and Virtual Network Manager rules.
What it means
This group covers creating NSGs and associating them with subnets or network interfaces, creating ASGs and associating them with NICs, writing inbound and outbound rules, implementing and interpreting virtual network flow logs, verifying IP flow, configuring NSGs for remote administration including Azure Bastion, and managing VNet security with Azure Virtual Network Manager.
What to understand
Rules run in priority order from 100 to 4096, and the first match wins, with default rules at 65000 and above allowing VNet and load balancer traffic and denying the rest. Inbound traffic is checked by the subnet NSG then the NIC NSG, and outbound in reverse. ASGs group NICs by role so rules read like web-to-database. Bastion lets admins reach VMs without public IPs, so VM NSGs only need SSH or RDP from the Bastion subnet. Virtual Network Manager security admin rules are evaluated before NSGs and can enforce always-allow or deny across many VNets.
How it shows up
Expect a rule table to evaluate, or a requirement to apply one rule set across many subscriptions without editing each NSG.
Common confusion
Assuming a NIC-level allow overrides a subnet-level deny; inbound traffic must pass both NSGs.
5.2 Design and implement Azure Firewall and Azure Firewall ManagerFirewall features, SKUs, deployment, rules, Firewall Manager policies and secure hubs.
What it means
This group covers mapping requirements to Azure Firewall features, choosing the Basic, Standard or Premium SKU, designing and creating a deployment, configuring DNAT, network and application rules, creating Firewall Manager policies and deploying a secured virtual hub by placing Azure Firewall inside a Virtual WAN hub.
What to understand
Azure Firewall is a stateful managed firewall that sits in AzureFirewallSubnet and needs UDRs to steer spoke traffic to it. Rule collections are processed DNAT first, then network, then application, grouped in rule collection groups by priority. Premium adds TLS inspection, signature-based IDPS, URL filtering and web categories. Firewall policies managed by Firewall Manager support parent and child inheritance across regions. A secured virtual hub uses routing intent to send private or internet traffic through the hub firewall.
How it shows up
Expect a feature requirement that decides the SKU, or a rule-order question about why a DNAT or application rule is not matching.
Common confusion
Expecting Standard SKU to decrypt HTTPS for inspection; TLS inspection requires Premium.
5.3 Design and implement a Web Application Firewall (WAF) deploymentWAF features, deployment design, modes, rule sets and policies on Front Door and Application Gateway.
What it means
This group covers mapping requirements to WAF capabilities, designing a WAF deployment, choosing detection or prevention mode, configuring managed rule sets for WAF on Azure Front Door and on Application Gateway, implementing a WAF policy and associating it at the right scope.
What to understand
WAF protects HTTP applications against common exploits such as SQL injection and cross-site scripting using Microsoft-managed rule sets, plus custom rules for rate limits, geo filtering or IP lists. Detection mode logs matches without blocking, which suits tuning, while prevention mode blocks requests. On Application Gateway a policy can apply globally, to a listener or to a URL path. On Front Door a policy is linked to domains through a security policy, and managed rules need the Premium tier. Exclusions reduce false positives.
How it shows up
Expect a request to protect a web app from injection attacks without blocking legitimate users during rollout, or to apply different policies per site.
Common confusion
Starting in prevention mode before tuning; detection mode is the safer first step when false positives are a concern.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • NSG rule priority

    Lower numbers are processed first, from 100 to 4096; the first match stops evaluation.

    Remember
    Default rules sit at 65000 and above.
    Tested as
    Rule table questions.
    Trap
    Thinking higher numbers win.

  • Subnet and NIC NSGs

    Both are evaluated, subnet first for inbound and NIC first for outbound.

    Remember
    Traffic must be allowed by each NSG applied.
    Tested as
    Troubleshooting questions.
    Trap
    Expecting one allow to override the other's deny.

  • Service tags

    Microsoft-maintained groups of IP prefixes such as Internet, VirtualNetwork and Storage.

    Remember
    They remove manual IP list upkeep.
    Tested as
    Rule design questions.
    Trap
    Hardcoding Azure service IP ranges.

  • Application security groups

    Logical groups of NICs used as rule sources and destinations.

    Remember
    All NICs in an ASG must be in the same VNet.
    Tested as
    Tiered app questions.
    Trap
    Spanning ASGs across VNets.

  • Virtual network flow logs

    Records of allowed and denied flows at VNet scope.

    Remember
    Pair with traffic analytics for analysis.
    Tested as
    Logging questions.
    Trap
    Planning new NSG flow logs.

  • Azure Bastion access

    Browser or native-client RDP and SSH over TLS without public IPs on VMs.

    Remember
    Needs AzureBastionSubnet and specific NSG rules if an NSG is applied.
    Tested as
    Remote admin questions.
    Trap
    Opening RDP to the internet instead.

  • Security admin rules

    Virtual Network Manager rules evaluated before NSGs.

    Remember
    Always allow and deny cannot be overridden by NSGs.
    Tested as
    Governance questions.
    Trap
    Assuming NSGs are always final.

  • Azure Firewall SKUs

    Basic for small businesses, Standard for threat intelligence and FQDN filtering, Premium for TLS inspection and IDPS.

    Remember
    Premium is required for decryption.
    Tested as
    SKU questions.
    Trap
    Choosing Standard for IDPS.

  • Rule processing order

    DNAT, then network, then application rules.

    Remember
    A network rule match stops application rule evaluation.
    Tested as
    Firewall troubleshooting questions.
    Trap
    Expecting application rules to run first.

  • Firewall Manager policy hierarchy

    Parent policies hold base rules inherited by child policies.

    Remember
    Use parents for organization-wide rules.
    Tested as
    Multi-region questions.
    Trap
    Duplicating rules in each firewall.

  • Secured virtual hub

    A Virtual WAN hub with Azure Firewall and routing intent.

    Remember
    Managed through Firewall Manager.
    Tested as
    Virtual WAN security questions.
    Trap
    Treating it as a separate hub VNet.

  • WAF modes

    Detection logs matches; prevention blocks them.

    Remember
    Tune in detection before switching.
    Tested as
    Rollout questions.
    Trap
    Expecting detection mode to block.

  • WAF policy scope

    Global, per-site or per-URI on Application Gateway; per-domain via security policy on Front Door.

    Remember
    More specific policies override broader ones.
    Tested as
    Multi-site questions.
    Trap
    Creating separate gateways per site.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Network security layers

ConceptMeaningKey differenceCommon trap
NSG Stateful layer 3 and 4 filtering on subnets or NICs Distributed, IP and port based Expecting FQDN filtering
Azure Firewall Central stateful firewall with FQDN and threat intelligence Inspects and logs centrally Forgetting UDRs to send traffic to it
WAF Layer 7 protection for HTTP apps Blocks web exploits Using it for non-HTTP traffic
Security admin rules Virtual Network Manager rules applied at scale Evaluated before NSGs Assuming NSGs can override them

Azure Firewall SKUs

ConceptMeaningKey differenceCommon trap
Basic Essential protection for small deployments Limited throughput and features Expecting IDPS
Standard FQDN filtering, threat intelligence, DNS proxy Common enterprise default Expecting TLS inspection
Premium Adds TLS inspection, IDPS, URL filtering, web categories Advanced threat protection Choosing it without a need

Firewall rule types

ConceptMeaningKey differenceCommon trap
DNAT rule Translates inbound public traffic to a private target Processed first Forgetting a matching network rule is implied
Network rule Filters by IP, port, protocol and service tag Layer 3 and 4 Using it for URL paths
Application rule Filters outbound HTTP, HTTPS and SQL by FQDN Layer 7 names Expecting it to catch traffic a network rule already matched

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. NIC allow beats subnet deny

    What candidates pick
    Add an allow rule on the NIC NSG to fix traffic blocked at the subnet.
    Why it looks right
    The NIC is closer to the VM.
    Why it's wrong
    Inbound traffic must be allowed by both the subnet NSG and the NIC NSG, so a subnet deny still blocks it.

    Clue to watch for Two NSGs are associated on the path.

  2. NSG filters FQDNs

    What candidates pick
    Write an NSG rule for *.contoso.com.
    Why it looks right
    NSGs are the default filter.
    Why it's wrong
    NSG rules match IP prefixes, ports and service tags, not domain names; FQDN filtering needs Azure Firewall.

    Clue to watch for The requirement lists domain names.

  3. Standard decrypts TLS

    What candidates pick
    Pick Azure Firewall Standard for HTTPS payload inspection.
    Why it looks right
    Standard is cheaper and has threat intelligence.
    Why it's wrong
    Only Premium performs TLS inspection and signature-based IDPS.

    Clue to watch for The scenario says inspect encrypted traffic.

  4. WAF stops port scans

    What candidates pick
    Deploy WAF to block non-HTTP attacks on a VM.
    Why it looks right
    WAF sounds like a general firewall.
    Why it's wrong
    WAF inspects HTTP requests only; layer 3 and 4 threats need NSGs, Azure Firewall or DDoS Protection.

    Clue to watch for The traffic is not web traffic.

  5. NSG overrides admin rule

    What candidates pick
    Edit a local NSG to allow traffic denied by a security admin rule.
    Why it looks right
    NSGs are normally authoritative.
    Why it's wrong
    Security admin rules with deny or always allow are evaluated first and cannot be overridden by NSGs.

    Clue to watch for Virtual Network Manager is deployed across subscriptions.

  6. Detection mode blocks

    What candidates pick
    Enable detection mode to stop attacks immediately.
    Why it looks right
    Detection sounds active.
    Why it's wrong
    Detection mode only logs matches; prevention mode is needed to block requests.

    Clue to watch for The requirement is to block, not observe.

Answer framework

Follow these steps to choose and configure AZ-700 network security controls.

  1. Classify the traffic by direction, protocol and whether it is HTTP, because web threats call for WAF while other traffic uses NSGs or Azure Firewall.
  2. Decide whether control is distributed or central: NSGs and ASGs on subnets and NICs, or Azure Firewall with UDRs and Firewall Manager policies.
  3. Check feature needs such as FQDN filtering, TLS inspection, IDPS or threat intelligence to choose the Firewall SKU, and managed rules to choose the Front Door tier.
  4. Evaluate precedence: security admin rules, then subnet and NIC NSGs, then firewall DNAT, network and application rules, then WAF policy scope.
  5. Plan visibility with virtual network flow logs, IP flow verify and firewall or WAF logs before switching WAF to prevention.

Practice question

A subnet NSG has an inbound rule at priority 200 allowing TCP 443 from Internet and a rule at priority 150 denying all traffic from Internet. The NIC NSG allows TCP 443 from Internet at priority 100. Is inbound HTTPS from the internet allowed to the VM?

Want more like this? The AZ-700 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with NSGs, because their rule logic underpins the rest of the domain. In a lab, attach NSGs to a subnet and a NIC, write conflicting rules, and use IP flow verify to confirm each prediction. Add ASGs for a web and database tier, deploy Azure Bastion, and enable virtual network flow logs with traffic analytics.

Next, deploy Azure Firewall Standard in a hub with a route table on a spoke. Create DNAT, network and application rules and confirm the processing order by watching which rule logs each flow. Then read the Premium feature list and the Firewall Manager parent and child policy model. Review how a secured virtual hub uses routing intent, linking back to Virtual WAN in Domain 2.

Finish with WAF on Application Gateway: start in detection mode, review logs, add an exclusion, then switch to prevention. Compare the Front Door WAF options by tier. Use practice questions with NSG rule tables to build speed.

FAQ

How much of AZ-700 is Domain 5, Design and implement Azure network security services?

Microsoft weights it at 15–20% of the exam, across three functional groups: network security groups, Azure Firewall with Firewall Manager, and Web Application Firewall.

Which NSG rule wins when several match?

The rule with the lowest priority number that matches the flow. Evaluation stops at that first match.

When do I need Azure Firewall Premium?

When you need TLS inspection, signature-based IDPS, URL filtering or web categories, which Standard does not provide.

What is a secured virtual hub?

A Virtual WAN hub with Azure Firewall deployed in it and managed through Firewall Manager, usually with routing intent.

Should WAF start in detection or prevention mode?

Detection mode is the usual starting point, so you can review matches and add exclusions before switching to prevention to block attacks.

Can an NSG override a Virtual Network Manager security admin rule?

No. Security admin rules are evaluated before NSGs, and deny or always-allow actions take effect regardless of NSG rules.

Are NSG flow logs still used?

Microsoft is retiring NSG flow logs in favor of virtual network flow logs, which the current study guide names.

Other Networking certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered NSGs, Azure Firewall, Firewall Manager and WAF. Test whether you can evaluate rule tables and choose the right security layer quickly.

Take the AZ-700 practice test Check your AZ-700 readiness

Keep going