4.1. Core Infrastructure Security Services in Azure

💡 First Principle: Core infrastructure security services exist because network-layer protection is still one layer of defense-in-depth (Phase 2.1.2) even in an identity-first world — each service in this section protects a different point in the traffic path, from the internet edge down to individual resource secrets, and picking the wrong one for a scenario means either overpaying for unnecessary protection or leaving a real gap open.

Why care: a company that only deploys NSGs but skips a Web Application Firewall is still exposed to application-layer attacks like SQL injection, because NSGs simply don't inspect that layer. Knowing which service protects which layer is exactly what this exam tests — not configuration steps, but "which service is designed to stop this."

⚠️ Common Misconception: Believing any one of these seven services alone constitutes "network security." In practice, real deployments layer several of them together — this is defense-in-depth (Phase 2.1.2) applied specifically to network infrastructure.