NSG vs Azure Firewall: which one filters your traffic?

One is a free set of rules on a subnet, the other a paid managed firewall for the whole network. Six questions on the difference the exam tests, AZ-900, 2026 edition.

Try 6 free NSG-versus-Azure-Firewall questions in the exam's own style — every answer explained, no sign-up — and clear up the mix-up for good.

Straight to the 6 free questions ↓

The one-line verdict: a Network Security Group (NSG) is a free, basic filter you attach to a subnet or NIC; Azure Firewall is a paid, managed firewall for a whole virtual network. The exam plays on the mix-up between them, so fix the difference once and the questions answer themselves.

The core difference

Both control network traffic in Microsoft Azure, but they sit at different scales. An NSG is a set of allow/deny rules working on layer 3/4 — source and destination IP, port and protocol. You bind it to a subnet or a NIC, and it filters traffic to and from that resource. It is a free feature, which makes it the default tool for basic segmentation.

Azure Firewall is a managed, stateful, centralized firewall service — a paid Azure resource you deploy once to protect an entire virtual network. On top of IP/port rules it adds application and FQDN rules (allow traffic to *.windows.net but nothing else), threat intelligence-based filtering against known-bad addresses, and central logging. The diagram above lines the two up column by column: the free per-resource filter on the left, the managed network-wide appliance on the right.

Where the exam probes

The AZ-900 questions almost always hinge on one of four tells. Read the scenario for these signals:

“Free” or “no extra cost” → NSG. The firewall is always a billed resource.
“A single VM” / “a subnet” → NSG. Its scope is a NIC or a subnet.
“Central” / “the whole VNet” / “managed” → Azure Firewall.
“FQDN rules”, “application rules”, “threat intelligence” → Azure Firewall. An NSG has none of these.

They are not rivals

The trap answer is “use only one.” In practice the two are used together: NSGs do cheap micro-segmentation between tiers inside the network, while Azure Firewall is the single central egress point for outbound internet traffic, where the logging and threat feed matter most. A question that describes both needs — per-tier rules and one controlled exit — wants both services, not a choice between them.

Don’t confuse them with these

Two more distractors show up next to this pair. Microsoft Defender for Cloud assesses your security posture and makes recommendations — it does not filter packets. Azure Policy governs which resources may exist and how they are configured, not the traffic between them. Keep the lane clear: NSG and Azure Firewall move packets; Defender scores you; Policy governs resources.

How to use the questions below

Answer each one before you open the explanation, and when you miss, read past the correct option to why the others are wrong — the distractors here are the right-sounding neighbour offered for the wrong reason. Getting the tell right (“free” versus “central and managed”) is what carries into the exam. For the wider services picture, see the Azure architecture and services domain; for the governance pair people mix up next, the Azure Policy vs RBAC page.

A Network Security Group and Azure Firewall side by side. The Network Security Group is a free, basic feature that attaches to a subnet or NIC and filters on layer 3/4 — IP, port and protocol — using simple allow and deny rules. Azure Firewall is a managed, stateful, paid resource that protects a whole virtual network, adds FQDN and application rules plus threat intelligence and central logging, and the two are often used together.

6 free AZ-900 practice questions

Answers and explanations — no email wall

AZ-900 Question 1 of 6

You want to allow or block traffic to a single virtual machine by IP address and port, at no extra cost. Which Azure feature fits?

Answer: A — A Network Security Group (NSG)

A Network Security Group is a free set of allow/deny rules on IP, port and protocol that you attach to the VM's NIC or its subnet — exactly this job. Why not the others: Azure Firewall is a paid managed service sized for a whole network, not a single VM. Microsoft Defender for Cloud assesses security posture; it does not filter packets. Azure Policy governs which resources may be created, not network traffic. Pro tip: NSG = free filter on a NIC or subnet.

AZ-900 Question 2 of 6

A company needs one central, managed firewall for an entire virtual network, with application and FQDN rules. Which service should they use?

Answer: A — Azure Firewall

Azure Firewall is a managed, stateful firewall service that protects a whole virtual network and supports application/FQDN rules — the central-control answer. Why not the others: stacking NSGs gives basic IP/port rules per resource, not central FQDN filtering. Azure Advisor gives recommendations; Azure Monitor collects metrics and logs. Neither is a firewall. Pro tip: 'central', 'managed', 'FQDN rules' all point to Azure Firewall.

AZ-900 Question 3 of 6

Which of these is a free feature in Azure?

Answer: A — A Network Security Group (NSG)

An NSG is a free feature — you pay nothing to attach allow/deny rules to a subnet or NIC. Why not the others: Azure Firewall is a billed managed resource, the DDoS Network Protection tier is a paid add-on, and a VPN Gateway is charged per hour. Pro tip: if the question says 'at no extra cost' in a networking scenario, the answer is usually the NSG.

AZ-900 Question 4 of 6

Which service offers threat intelligence-based filtering to alert on or deny traffic from known malicious IPs and domains?

Answer: A — Azure Firewall

Threat intelligence-based filtering is an Azure Firewall capability — it can alert on or deny traffic to and from known-bad IPs and domains. Why not the others: an NSG only matches your own IP/port/protocol rules and has no threat feed. Azure Cost Management tracks spend, and Microsoft Entra ID handles identity, not network threats. Pro tip: 'threat intelligence' is a giveaway word for Azure Firewall.

AZ-900 Question 5 of 6

Which resource do you attach directly to a subnet or a network interface (NIC)?

Answer: A — A Network Security Group (NSG)

An NSG attaches to a subnet or to a NIC, and its rules apply to traffic in and out of that scope. Why not the others: Azure Firewall is deployed centrally into its own subnet for the network, not bound to each NIC. A Management Group organises subscriptions, and a Subscription is a billing and access boundary — neither is a network filter. Pro tip: NSG scope = subnet or NIC.

AZ-900 Question 6 of 6

An architect wants micro-segmentation between tiers inside a VNet and one central point to control outbound internet access. What is the best approach?

Answer: A — Use NSGs for the per-tier rules and Azure Firewall for central egress control

The two are complementary: NSGs give lightweight allow/deny rules between subnets and tiers, while Azure Firewall provides one managed, logged choke point for outbound traffic. Why not the others: NSGs alone lack central FQDN egress control; Azure Firewall alone is a heavier tool for fine per-tier rules; and Azure Policy governs resource configuration, not packets. Pro tip: NSG inside, Firewall at the edge — they work together.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 6 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

300 questions in 6 full tests, AZ-900 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

Is a Network Security Group a firewall?

Not a full one. An NSG is a basic layer 3/4 filter — allow and deny rules on IP, port and protocol attached to a subnet or NIC. It has no application/FQDN rules, threat intelligence or central logging. Azure Firewall is the managed, stateful firewall service; the NSG is the lightweight filter.

Do you need both an NSG and Azure Firewall?

Often, yes. They are complementary: NSGs handle cheap per-resource micro-segmentation inside the virtual network, while Azure Firewall gives one central, managed, logged point for controlling outbound traffic. For AZ-900 you only need to know that they coexist and what each is for.

Are these real exam questions?

No. They are our own questions, written in the style and difficulty of the exam. Reproducing real exam items breaks the Microsoft certification agreement and can cost you your certification, and a memorised item teaches you nothing about the one you have not seen.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.