thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Foundational

Network Security Group (NSG)

Azure set of stateful allow/deny rules filtering traffic to and from resources by source, destination, port and protocol.

Definition

NSG rules are processed by priority (100 to 4096, lower first) and can be associated with subnets and network interfaces. Default rules allow VNet and load balancer traffic and deny other inbound traffic. Rules can use service tags and application security groups instead of IP addresses.

Example

A rule with priority 100 allows TCP 443 from the Internet service tag to the web subnet.

Exam tip

When NSGs exist on both subnet and NIC, inbound traffic must be allowed by both; the first matching rule by priority wins.

Related terms