3.3.1. Network Security Groups and Application Security Groups

💡 First Principle: An NSG is a stateful packet filter — it evaluates source, destination, port, and protocol against a prioritized rule list, and because it's stateful, a rule allowing inbound traffic automatically allows the matching return traffic without a separate outbound rule.

NSGs can be applied to a subnet, a network interface, or both (evaluated together when both apply). Rules are evaluated in priority order (lower number = higher priority), and the first matching rule wins — later rules are never evaluated once a match is found. Application Security Groups (ASGs) let you group VMs by application role (e.g., "WebTier," "DatabaseTier") and reference that group in NSG rules instead of hardcoding IP addresses, so rules stay accurate as VMs are added or removed from a tier.

⚠️ Exam Trap: NSG statefulness is a frequent trap — a scenario showing only an inbound allow rule and asking "will the response traffic be blocked without an explicit outbound rule" is testing whether you know NSGs are stateful (the answer is no, it won't be blocked; the response is automatically permitted).

Reflection Question: Why would using Application Security Groups instead of hardcoded IP addresses in NSG rules reduce the operational risk of a rule silently becoming outdated?