3.3. Implement Security for Azure Network Services
💡 First Principle: Network controls decide whether a request can even attempt to reach a resource — they're evaluated before identity, before application logic, before anything else — which is exactly why a network misconfiguration can undermine every other control covered so far, and why network security still matters even in a Zero Trust model that doesn't trust the network by default.
This is the largest subsection in Phase 3 because Azure offers layered network controls at multiple scopes — per-resource (NSGs), centrally-managed across many VNets (Virtual Network Manager, Virtual WAN), hybrid connectivity (VPN, Private Access), and traffic inspection (Azure Firewall) — and the exam expects you to know which layer a given requirement belongs to.
Mental model: picture concentric rings — NSGs/ASGs filter at the individual resource boundary, Virtual Network Manager and Virtual WAN apply policy centrally across many VNets at once, VPN and Private Access handle the boundary between on-premises/remote users and Azure, and Private Endpoints/Private Link remove PaaS resources from the public internet entirely.
⚠️ Common Misconception: NSGs and Azure Firewall are not interchangeable. NSGs are stateful Layer 3-4 packet filters scoped per NIC or subnet; Azure Firewall is a centralized, managed Layer 3-7 service with FQDN filtering and threat intelligence. They operate at different layers and different scopes — a well-architected network uses both together.
