4.1.5. Network Security Groups (NSGs)
💡 First Principle: An NSG is a lightweight, stateful Layer 3/4 packet filter attached to a subnet or a network interface, evaluating each packet's source, destination, port, and protocol against allow/deny rules — it's the basic building block of Azure network access control, not a full-featured firewall.
Because NSGs are stateful, allowing inbound traffic on a port automatically allows the corresponding outbound response traffic — you don't need a matching outbound rule just to let replies back out. This is a small detail with outsized exam relevance.
⚠️ Exam Trap: NSGs are stateful — if you allow inbound traffic on port 443, the response traffic is automatically permitted. Adding a redundant outbound rule "just to be safe" reflects a misunderstanding of how NSGs actually evaluate state.
Reflection Question: If an NSG rule allows inbound traffic on port 443, does a separate outbound rule need to be created to allow the response traffic back to the requester? Why or why not?
