4.1.2. Azure Firewall
💡 First Principle: Azure Firewall is a fully managed, cloud-native network firewall that centralizes traffic filtering across an entire virtual network (or multiple VNets via a hub-and-spoke design), using rules based on IP, port, application FQDN, and threat intelligence — offering broader, centrally-managed protection than a per-subnet NSG.
Because it's centrally managed, a single Azure Firewall policy can govern traffic for many VNets in a hub-and-spoke architecture, rather than needing separate NSG rules configured VNet by VNet. Its FQDN filtering (allowing traffic to *.microsoft.com but nothing else, for example) and built-in threat intelligence feed are capabilities NSGs simply don't have.
⚠️ Exam Trap: Don't reach for Azure Firewall when the question is really testing NSGs (or vice versa) — Azure Firewall is the centralized, feature-rich option; NSGs (4.1.5) are the lightweight, per-subnet/NIC option. Both filter traffic, but at very different scope and depth.
Reflection Question: Why would a company managing dozens of virtual networks prefer a centralized Azure Firewall policy over configuring individual NSGs in every single VNet?
