Why This Cheat Sheet Matters for AZ-500
This cheat sheet covers the most important Azure Firewall & NSG concepts tested on the AZ-500 (Azure Security Engineer Associate) certification exam. It contains 2 sections with 8 key points that you should memorize before exam day. Implement network security with NSGs, Azure Firewall, WAF, Private Link, and network segmentation. Use this as a quick-reference guide during your final review sessions.
Network Controls
- NSG: stateful L3/L4 filtering at subnet or NIC level; priority-ordered rules.
- ASG: group VMs logically for NSG rules without managing IP addresses.
- Azure Firewall: centralized, stateful with DNAT, network, and application rules.
- WAF: OWASP rule sets protecting web applications at Layer 7.
Private Connectivity
- Private Endpoint: private IP in your VNet for PaaS service access.
- Service Endpoint: routes traffic through Azure backbone but keeps public IP.
- Azure Bastion: secure RDP/SSH without public IP exposure.
- JIT VM Access: opens management ports temporarily with Defender for Cloud.
Practice Network Security Questions
Put your knowledge to the test with practice questions.
Azure Quick Reference Tips
Azure services follow consistent naming patterns that help with exam recall. Resource Manager (ARM) templates use JSON, while Bicep provides a cleaner DSL for infrastructure as code. Remember that Azure resources are organised in a hierarchy: Management Groups → Subscriptions → Resource Groups → Resources.