Protecting Networks, Applications, and Secrets in Azure

radio_button_uncheckedshort_text 1. Introduction: from the physical perimeter to software-defined infrastructure

Network security was born in environments where servers, users, and equipment were concentrated inside buildings and data centers. Routers, access control lists, and firewalls formed a relatively stable perimeter between the internal network and the internet. With virtualization, web applications, mobile devices, and cloud computing, this perimeter has become distributed. Networks, traffic rules, load balancers, and secret vaults started to be configured by software and consumed as services.

This transformation contributes directly to organizations and to society because essential services - banks, hospitals, schools, governments, and communication platforms - depend on availability, confidentiality, and integrity. A well-protected architecture reduces interruptions, leaks, and fraud, while also enabling innovation with controlled risks. The challenge is understanding that 'being in the cloud' does not automatically make a system secure: Microsoft protects the platform, while the client must properly configure networks, identities, applications, and data.

Throughout this chapter, think of a three-tier application: a publicly exposed web interface, an internal API, and a database. Each service studied answers a different question. A volumetric attack requires DDoS mitigation; an HTTP exploitation requires WAF ; traffic between subnets requires NSGs and, in centralized scenarios, Azure Firewall; VM administration requires Bastion; passwords, keys, and certificates require Key Vault. Understanding these boundaries is more important than memorizing names.

Guiding question

If an application uses WAF , does it still need NSG , Azure Firewall, DDoS Protection, and Key Vault? Yes. Each control acts on a distinct surface, layer, or purpose.

1.1 Security as an architecture, not as an isolated product

Defense in depth means combining preventive, detective, and responsive controls. A control can fail, be bypassed, or not detect a certain type of traffic. Segmentation limits lateral movement; a central firewall controls routes and destinations; the WAF understands web protocols; the Key Vault reduces credential exposure. The result is a sequence of complementary barriers, not a promise of invulnerability.

radio_button_uncheckedshort_text 2. Technical foundations: layers, flows, and state

2.1 Network and application layers

For the SC-900, it is not necessary to memorize the entire OSI model, but it is essential to differentiate network and application controls. Layers 3 and 4 mainly deal with IP addresses, transport protocols, and ports, such as TCP 443 or UDP 53. Layer 7 interprets the application protocol, for example methods, headers, paths, and HTTP content. DDoS Protection primarily acts against L3/L4 network attacks; NSGs filter flows by IP, port, and protocol; the WAF inspects HTTP/HTTPS at L7. Azure Firewall combines stateful inspection, network rules, and rules oriented to applications and destinations.

2.2 North-south and east-west traffic

North-south traffic enters or leaves the environment, such as users accessing a website or servers querying the internet. East-west traffic circulates between internal components, such as an API accessing a database or two virtual networks exchanging information. A secure architecture controls both: the edge should not be the only barrier, as an attacker who compromises a component may try to move internally.

2.3 Stateful and stateless filtering

A stateful control tracks the state of a connection. When a permitted outbound flow initiates a session, the corresponding response traffic can be recognized without a manual mirrored rule. NSGs and Azure Firewall are stateful . This does not mean that "all return traffic is allowed"; it means that the service associates the packets with the authorized connection. Stateless controls evaluate packets independently and usually require explicit rules for each direction.

2.4 Five elements of a flow

Key concept for exam

Port 443 does not automatically mean 'secure traffic.' TLS protects the communication, but an HTTPS request can still carry an SQL injection attempt. That is why the WAF remains relevant.

radio_button_uncheckedshort_text 3. Azure Virtual Network, subnets and segmentation

Azure Virtual Network, or VNet, is the foundation of the private network in Azure. It provides a logical and isolated space in which resources can communicate using private IP addresses. A VNet exists in a region, can span availability zones within that region, and can connect to other networks via peering, VPN, or ExpressRoute. Isolation between VNets is an important property: different networks do not communicate automatically, unless a connection is created.

3.1 Address space and CIDR

When creating a VNet, one or more address blocks are defined, usually private according to RFC 1918, such as 10.20.0.0/16. The CIDR notation indicates how many bits identify the network. A /16 block contains more addresses than a /24. Planning avoids overlap with local networks and other VNets, as overlapping ranges make peering, VPN, and routing difficult.

3.2 Subnets as functional and security boundaries

A subnet divides the VNet space. Instead of placing all resources in the same segment, the organization separates components by function, sensitivity, or communication need. a web layer can accept traffic from the load balancer; the application layer only accepts web calls; the data layer only accepts the database port from the application. This organization reduces the attack surface and facilitates the application of NSGs and routes.

3.3 Connectivity does not equal authorization

VNet and peering create network paths; they do not replace authentication, authorization, or application controls. Similarly, blocking a port does not replace the principle of least privilege in identities. Network security limits "who can reach the service"; identity and authorization define "who can use the service and what they can do".

radio_button_uncheckedshort_text 4. Network Security Groups (NSGs)

A Network Security Group filters incoming and outgoing traffic associated with subnets or network interfaces. It contains rules that allow or deny flows based on priority, direction, protocol, source, destination, and ports. NSGs are distributed and stateful controls: they are close to the resources and are suitable for restricting communication between layers.

4.1 Components of a rule

4.2 Default rules

Azure creates default rules with lower priority. They allow traffic within the VNet, allow responses associated with certain platform services, and deny incoming traffic from the internet, while outgoing traffic to the internet is allowed by default in many scenarios. Higher-priority custom rules can change the outcome. For the exam, the main point is that rules are processed by priority until a match is found.

4.3 Service tags and application security groups

Service tags represent sets of IP prefixes maintained by Azure, such as Internet, VirtualNetwork, or specific services. application security groups allow grouping virtual machine interfaces by logical function, such as WebServers or DatabaseServers, reducing dependence on individual addresses. These resources make rules more readable and adaptable.

Example

The application subnet can accept TCP 443 only from the WebServers group and deny other sources. The database subnet can accept TCP 1433 only from the AppServers group. Thus, even if a web host is compromised, the path to other resources remains limited.

4.4 What an NSG does not do

• Does not analyze SQL injection, XSS, or HTTP semantics.
• It is not an application proxy nor a web publishing service.
• It does not replace a central firewall solution when egress control, NAT, advanced inspection, or policies between many networks are required.
• Does not store secrets and does not authenticate end users.

radio_button_uncheckedshort_text 5. Azure Firewall

Azure Firewall is a firewall as a service, cloud-native, fully stateful , and with built-in high availability. It can inspect north-south and east-west traffic, functioning as a central control point in hub-and-spoke architectures. Instead of managing virtual appliances individually, the organization uses a managed service that scales with the platform.

5.1 Types of rules

5.2 Azure Firewall versus NSG

NSG is a distributed filter applied to subnets and interfaces. Azure Firewall is a centralized service through which traffic can be routed. In small environments, NSGs can meet several basic requirements. In corporate architectures, the firewall centralizes egress, inspection, NAT, logs, and policies across multiple networks. Both are often used: the firewall controls central paths and NSGs enforce local micro-segmentation.

5.3 SKUs and depth

The current documentation presents Basic, Standard, and Premium SKUs. The choice depends on scale and features, such as advanced filtering, TLS inspection, and intrusion prevention systems available in higher tiers. For the SC-900, it is more important to recognize Azure Firewall as a managed and stateful network firewall than to memorize all the commercial limits of each SKU.

Exam trap

Azure Firewall and WAF are not synonyms. The Firewall protects network flows and destinations broadly; the WAF is specialized in attacks against web applications and interprets HTTP/HTTPS.

5.4 User-defined routes

To ensure that traffic passes through the Azure Firewall, subnets can use route tables and user-defined routes, known as UDRs. This pattern is called forced tunneling when the organization forces certain traffic through an inspection point. Without route planning, creating a firewall does not guarantee that all flows will go through it.

radio_button_uncheckedshort_text 6. Azure Web Application Firewall ( WAF )

The Azure Web Application Firewall provides centralized protection for web applications against common exploits and vulnerabilities. It operates at the application layer, understanding HTTP and HTTPS requests. It can be integrated with Azure Application Gateway for regional ingress, and with Azure Front Door for global edge ingress. The WAF reduces the need to implement the same protection separately in each application, although it does not eliminate the need for code fixes.

6.1 Attacks and anomalies observed

• SQL injection: attempt to manipulate database queries through malicious inputs.
• Cross-site scripting (XSS): insertion of scripts into pages consumed by other users.
• File inclusion, command injection, and HTTP protocol violations.
• Bots, scanners, IP reputation patterns, and excessive volume, according to available resources and rules.
• Headers, paths, methods, and parameters incompatible with defined policies.

6.2 Managed rules and custom rules

Managed rule sets are maintained to detect known classes of attacks, often aligned with OWASP categories. Custom rules allow blocking or allowing based on address, country/region, header, path, size, rate, and other conditions. In detection mode, the WAF logs matches; in prevention mode, it can block requests. Deployment should start with observation and tuning to reduce false positives.

6.3 WAF does not replace secure development

A WAF is a compensatory layer. It can block a known payload, but it does not fix authorization flaws, business logic issues, undue exposure of APIs, or secrets in the code. Applications still need input validation, authentication, authorization, dependency fixes, and security testing.

radio_button_uncheckedshort_text 7. Azure DDoS Protection

A distributed denial-of-service attack, or DDoS, tries to exhaust bandwidth, connections, CPU, memory, or other resources to make a service unavailable. It is distributed because it uses many sources, often compromised devices. Any publicly accessible endpoint can be a target.

7.1 Infrastructure protection and enhanced protection

The Azure platform has infrastructure protection against common attacks. Azure DDoS Protection adds enhanced features tailored to protected resources. Current documentation differentiates DDoS Network Protection, associated with virtual networks through a plan, and DDoS IP Protection, enabled per public IP. Both share core engineering features but differ in business model and additional services.

7.2 How the service works

• Continuous monitoring of traffic patterns.
• Adaptive limit adjustment based on the resource profile.
• Automatic mitigation when traffic exceeds attack parameters.
• Metrics, alerts, logs, and reports for investigation.
• Layer 3 and 4 vector protection, such as TCP, SYN, and UDP floods.

7.3 DDoS Protection and WAF are complementary

DDoS Protection specializes in availability and volumetric network attacks. The WAF protects HTTP/S logic and can apply rate limiting or rules against bots and exploits. A critical web application often uses both: DDoS for L3/L4 and WAF for L7. Azure Front Door also offers edge protection and integration with WAF , but the examinable concept remains the use of complementary layers.

Do not confuse

DDoS does not mean a successful intrusion or data theft. The main objective is unavailability. However, attacks can be combined with other techniques or used as a distraction, so monitoring and response are still necessary.

7.4 Resilience is part of the defense

Mitigation does not replace resilient architecture. Regional distribution, availability zones, load balancing, autoscale, caching, and response plans reduce impact. Availability security depends on a protection service and on a design capable of continuing to operate during failures or spikes.

radio_button_uncheckedshort_text 8. Comparing DDoS Protection, NSG , Azure Firewall, and WAF

8.1 How to solve questions by elimination

1. Identify the asset: public IP, subnet, network flow, HTTP application, or virtual machine. 2. Identify the threat: flooding, improper port, unauthorized destination, web exploitation, or administrative exposure. 3. Observe the layer: L3/L4 favors DDoS, NSG or Firewall; L7 favors WAF . 4. Look for keywords: “no public IP for RDP / SSH ” points to Bastion; “secrets, keys, and certificates” points to Key Vault.

Mental rule

Volumetric availability = DDoS. Distributed filtering = NSG . Central network control = Azure Firewall. HTTP attack = WAF . Private administration = Bastion. Secret material = Key Vault.

radio_button_uncheckedshort_text 9. Azure Bastion

Azure Bastion is a managed PaaS service for RDP and SSH connection to virtual machines via TLS. It is deployed in the virtual network and allows reaching VMs using private IP addresses. The central benefit is to avoid a public IP directly on the VM and reduce the exposure of administrative ports 3389 and 22 to the internet.

9.1 Why opening RDP / SSH to the internet is risky

Exposed administrative services receive scans, password attempts, vulnerability exploitation, and automated attacks. Even with NSG restricted to certain addresses, changes in origin and rule errors can increase exposure. Bastion creates a managed entry point, while the VMs remain private.

9.2 What Bastion offers

• RDP or SSH sessions protected by TLS.
• Connection through the portal and, depending on the SKU, by native clients and additional resources.
• Absence of a special agent within the VM for the main scenario.
• Reduction of public IPs and exposed administrative ports.
• Possibility of auditing resources and session recording in specific offerings.

9.3 What Bastion can't solve on its own

Bastion does not replace strong authentication, RBAC, operating system updates, endpoint protection, logs, and the principle of least privilege. An excessively privileged administrator continues to be a risk. The service protects the network path; the identity and the operating system still need their own controls.

Architectural detail

Dedicated deployments use a reserved subnet called AzureBastionSubnet. This subnet must be planned according to the current service requirements and should not host common workloads.

radio_button_uncheckedshort_text 10. Azure Key Vault: secrets, keys, and certificates

Azure Key Vault is a cloud service for storing and accessing sensitive material with strict control. It reduces the insecure practice of embedding passwords, tokens, or keys in source code, shared variables, configuration files, pipelines, or container images. The service separates the application from the lifecycle of credentials and provides authorization, auditing, and integration with Microsoft Entra identities.

10.1 Three main types of objects

10.2 Vault and Managed HSM

Key Vault vaults store secrets, keys, and certificates; keys can be protected by software or HSM depending on the tier. Managed HSM is a dedicated service for keys protected by hardware security modules and meets scenarios requiring stricter cryptographic control. For the SC-900, the main point is that Key Vault manages secrets, keys, and certificates; Managed HSM enhances key protection and control.

10.3 Control plane and data plane

The control plane manages the Azure resource: create the vault, configure the network, diagnostics, and policies. The data plane accesses the objects: read a secret, sign with a key, or obtain a certificate. An identity can have permission to manage the resource without having permission to read the secrets, and vice versa. This separation applies least privilege.

Secret versus key

A password needs to be revealed to the application for use and is usually stored as a secret. A cryptographic key can remain inside the service: the application requests a signing or decryption operation without receiving the private material.

radio_button_uncheckedshort_text 11. Secure access and lifecycle in Key Vault

11.1 Authentication and authorization

Microsoft Entra authenticates users, applications, and managed identities. Then, Key Vault authorizes the operation through Azure RBAC or, in legacy environments, access policies. RBAC allows assigning roles at scopes such as subscription, resource group, or vault. The modern recommendation is to apply minimal roles and separate infrastructure administrators from secret consumers.

11.2 Managed identities

A managed identity eliminates the need for a fixed credential for the application to authenticate to Entra. The Azure feature receives an identity and automatically obtains tokens. The application uses the token to request only the authorized object or operation. Thus, it is not necessary to store a 'Key Vault password' in the code itself.

11.3 Network protection

In addition to authorization, the vault can restrict network paths. Key Vault firewall, selected networks, and Private Endpoint allow private access from a VNet. This combination reduces public exposure but does not replace RBAC: being on the correct network does not grant the right to read a secret.

11.4 Versioning, rotation, and recovery

• Objects have versions, allowing updates without reusing the same value indefinitely.
• Rotation reduces the period during which a compromised credential remains valid.
• Expiration and alerts help avoid expired certificates and forgotten secrets.
• Soft delete keeps deleted objects for a retention period.
• Purge protection prevents permanent deletion during the configured period, protecting against malicious or accidental destruction.
• Logs and diagnostics record requests for auditing and investigation.

Good practice

Use separate safes by application, environment, and region when this reduces impact and simplifies

radio_button_uncheckedshort_text 12. Integrated architecture: how services work together

Consider an e-commerce application. Users arrive via the internet. The edge layer absorbs and distributes traffic; DDoS Protection helps against volumetric network attacks; the WAF blocks malicious HTTP requests. The front-end is in its own subnet, the API in another, and the database in a third. NSGs allow only the necessary flows between these layers.

The Azure Firewall in the hub controls outbound traffic to the internet, access to approved destinations, and communication between networks. Administrators reach virtual machines through Bastion, without a public IP on the VMs. The application uses a managed identity to retrieve the connection string from the Key Vault or to perform an operation with a key. WAF , NSG , Firewall, Bastion, and Key Vault logs are forwarded for monitoring and investigation.

12.1 Normal flow of a request

5. The user sends HTTPS to the public entry point. 6. DDoS protection monitors the volume and mitigates L3/L4 attack patterns. 7. The WAF inspects the HTTP/S request and applies managed and custom rules. 8. The front-end calls the API only through the authorized port in the NSG . 9. The API authenticates with managed identity and retrieves the necessary secret from the Key Vault. 10. The API accesses the database only through the allowed flow between subnets.

12.2 Flow during an incident

If a source tries to exploit SQL injection, the WAF can detect and block it. If the volume grows abnormally, DDoS Protection acts on availability. If a compromised server tries to access a malicious destination, Azure Firewall can alert or deny with threat intelligence. If someone tries to read a secret without the appropriate role, the Key Vault denies and logs the request. The architecture turns a broad incident into observable events and containment boundaries.

radio_button_uncheckedshort_text 13. Project decisions, monitoring, and common mistakes

13.1 Start with requirements, not with products

The selection of controls should start from assets, threats, data paths, and regulatory requirements. An internal application without a public IP may not need the same edge design as a global portal. An environment with few networks can start with NSGs; an organization with dozens of subscriptions may need hub-and-spoke, Azure Firewall, and centralized policies. Key Vault is useful whenever there are secrets, but the way to isolate and use HSM depends on the risk.

13.2 Observability

Controls without logs limit detection and investigation. Diagnostics can be sent to Log Analytics, Storage, Event Hubs, and solutions like Microsoft Sentinel, depending on the service. DDoS metrics show mitigation; WAF logs record triggered rules; NSG flow logs or equivalent resources help understand flows; Firewall records decisions; Key Vault records operations; Bastion can provide session auditing in compatible offerings.

13.3 Principle of least privilege in all layers

Least privilege is not limited to identity functions. In a network, it means allowing only the necessary sources, destinations, ports, and protocols. In WAF , it means publishing only expected paths and methods. In administration, it means reducing the people and machines that can start sessions. In Key Vault, it means granting only specific actions on the necessary objects.

Deployment strategy

Plan, implement in observation mode when applicable, validate logs, adjust false positives, automate through infrastructure as code, and periodically review rules and permissions.

radio_button_uncheckedshort_text 14. Integrated practical scenario

A company migrates its service portal to Azure. The portal is public, has internal APIs, a database, and two support virtual machines. The organization wants to reduce downtime, prevent administrative exposure, limit communication between layers, and remove passwords from the code.

14.1 Proposed solution

14.2 Deployment sequence

11. Plan CIDR blocks without overlap and create subnets by function. 12. Apply NSGs with explicit rules for web, application, data, and administration. 13. Create the entry point with WAF and validate rules in detection mode before blocking. 14. Enable DDoS protection appropriate for critical public IPs. 15. Deploy Azure Firewall and routes when there is a requirement for central inspection and controlled egress. 16. Deploy Bastion and remove unnecessary public IPs from VMs. 17. Create Key Vault, enable recovery, configure networking, assign minimal RBAC, and use managed identity. 18. Send logs to a monitoring platform and test failure and response scenarios.

14.3 Result

The environment does not become invulnerable, but gains clear boundaries. Volumetric attacks find mitigation; web attacks find inspection; internal compromises find segmentation; administration does not depend on public ports; credentials stop circulating in code. Each event generates evidence for operation and audit. This is the essence of defense in depth applied to Azure infrastructure.

Test point

The best answer is usually the service that is most specific to the presented requirement, not the 'most advanced' product. Read the verb: mitigate DDoS, filter traffic, inspect HTTP, manage VM, or store secret.

radio_button_uncheckedshort_text 15. Quick review for the SC-900 exam

• VNet is the logical private network in Azure; subnets divide its address space and organize workloads.
• NSG is stateful and filters inbound/outbound traffic by priority, direction, protocol, source, destination, and port.
• Azure Firewall is a central firewall as a service, stateful , with network, application, NAT rules, and threat features.
• WAF protects web applications against HTTP/HTTPS attacks and anomalies at layer 7.
• Azure DDoS Protection mitigates distributed denial-of-service attacks, mainly at layers 3 and 4.
• Bastion allows RDP / SSH to VMs via private IP without direct exposure of a public IP on the machine.
• Key Vault stores secrets, keys, and certificates and integrates with Entra, RBAC, and managed identities.
• Private Endpoint restricts the network path, but does not replace authorization.
• The services are complementary and implement defense in depth.

radio_button_uncheckedshort_text 16. Conclusion

Protecting cloud infrastructure requires understanding flows, layers, and responsibilities. Virtual networks and subnets create isolation; NSGs restrict local communication; Azure Firewall centralizes network policies; WAF interprets web traffic; DDoS Protection preserves availability; Bastion reduces administrative exposure; Key Vault protects secrets and cryptographic material. Security emerges from the coherent combination of these services with identities, monitoring, and human processes.

In my assessment, the most valuable concept of this chapter is the specialization of controls. Unsafe projects often try to make a product solve all risks. Mature projects ask which asset is exposed, which layer is being attacked, which flow needs to exist, and what evidence will be generated. This way of thinking prepares the student not only for the SC-900, but also for real architectural decisions.

radio_button_uncheckedshort_text 17. Review questions

1. A company needs to block SQL injection attempts on an HTTPS portal. Which service is the most directly indicated?

A) NSG B) Azure Web Application Firewall C) Azure Bastion D) Azure Key Vault

Answer with explanation

Correct answer: B. The WAF interprets HTTP/HTTPS at layer 7 and has rules for web attacks, including SQL injection.

2. Which service allows connecting via RDP or SSH to a VM using a private IP, without directly exposing a public IP on the VM?

A) Azure Bastion B) Azure DDoS Protection C) WAF D) Network Security Group

Answer with explanation

Correct answer: A. Azure Bastion provides a managed pathway for RDP / SSH over TLS to private VMs.

3. Which statement best describes the difference between NSG and Azure Firewall?

A) NSG protects only HTTP and Firewall only databases. B) NSG stores secrets and Firewall issues certificates. C) NSG is a distributed filter in subnets/interfaces; Azure Firewall is a central stateful control for traffic between networks and the internet. D) There is no functional difference.

Answer with explanation

Correct answer: C. They can be used together: NSG for local segmentation and Azure Firewall for centralized policies and inspection.

4. An application needs to access a database password without maintaining fixed credentials in the code. Which combination is most suitable?

A) WAF and DDoS Protection B) Azure Key Vault and managed identity C) Bastion and NSG D) Azure Firewall and public IP

Answer with explanation

Correct answer: B. The managed identity authenticates the application, and the Key Vault delivers only the authorized secret.

radio_button_uncheckedshort_text 18. Essential Glossary

radio_button_uncheckedshort_text 19. Official references for further study

• Microsoft Learn - Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals. Updated on June 26, 2026.
• Microsoft Learn - Azure DDoS Protection overview.
• Microsoft Learn - What is Azure Firewall?
• Microsoft Learn - Introduction to Azure Web Application Firewall.
• Microsoft Learn - Azure network security groups overview.
• Microsoft Learn - Azure virtual networks and subnets.
• Microsoft Learn - What is Azure Bastion?
• Microsoft Learn - Azure Key Vault basic concepts.
• Microsoft Learn - Overview of Azure Key Vault keys, secrets, and certificates.
• Microsoft Learn - Secure your Azure Key Vault.

Note about update

Cloud services evolve continuously. For pricing, SKUs, regions, limits, and available features, always refer to the latest official documentation. The focus of this chapter is the purpose and conceptual differentiation required in the SC-900.