Azure Infrastructure Security: VNets, NSGs, Bastion & Key Vault

Why infrastructure security matters

Azure Virtual Networks (VNets)

An Azure Virtual Network (VNet) is a logically isolated network in Azure. Resources inside a VNet can communicate with each other, but resources in different VNets cannot — unless you explicitly connect them.

Key VNet concepts

Concept	What it means
Address space	The range of private IP addresses available in the VNet (for example, 10.0.0.0/16)
Subnets	Divisions within a VNet that group related resources (for example, a “web” subnet and a “database” subnet)
Network segmentation	Separating workloads into different subnets or VNets so a compromise in one area does not spread to others
VNet peering	Connecting two VNets so resources can communicate across them (traffic stays on Microsoft’s backbone network)

Why segmentation matters

Without segmentation, all resources in a flat network can communicate with everything else. If an attacker compromises one server, they can move laterally to every other server.

With segmentation: Alex places SecureBank’s web servers in one subnet, application servers in a second, and databases in a third. NSG rules ensure the web servers can only talk to the application tier, and only the application tier can reach the databases. If the web server is compromised, the attacker cannot jump directly to the database.

Network Security Groups (NSGs)

An NSG contains a list of security rules that allow or deny network traffic to resources connected to Azure VNets. You can attach an NSG to a subnet or to an individual network interface (NIC).

How NSG rules work

Each rule has these properties:

Property	Description
Priority	A number from 100 to 4096. Lower numbers are processed first.
Source/Destination	IP address, range, service tag, or application security group
Port	Specific port or range (for example, 443 for HTTPS)
Protocol	TCP, UDP, ICMP, or Any
Action	Allow or Deny
Direction	Inbound or Outbound

Default NSG rules

Every NSG includes three default inbound and three default outbound rules that you cannot delete:

Default inbound rules:

• Allow traffic from within the same VNet (VNet-to-VNet)
• Allow traffic from Azure Load Balancer
• Deny all other inbound traffic (catch-all deny)

Default outbound rules:

• Allow traffic to the same VNet
• Allow outbound internet traffic
• Deny all other outbound traffic

💡 Exam tip: NSG rule processing

Rules are evaluated in priority order (lowest number first). Once a matching rule is found, processing stops.

This means a “Deny” rule at priority 100 will override an “Allow” rule at priority 200 for the same traffic. The exam often tests this concept with a scenario where someone creates an Allow rule but traffic is still blocked by a higher-priority Deny rule.

Comparing network security layers

Each layer adds different protection — they are complementary, not competing

Feature	NSGs	Azure Firewall	WAF
Operates at	Subnet or NIC level	Virtual network level (centralised hub)	Application level (HTTP/HTTPS)
Filtering basis	IP, port, protocol	IP, port, protocol, FQDN, threat intelligence	HTTP request patterns (OWASP rules)
Cost	Free	Paid	Paid (via Application Gateway or Front Door)
Best for	Basic per-resource traffic control	Centralised enterprise network policy	Protecting web applications from exploits
Analogy	Room door locks	Building security desk	Bulletproof teller window

Azure Bastion

Azure Bastion provides secure, browser-based RDP and SSH connectivity to your virtual machines — directly from the Azure portal, over TLS, without exposing any public IP addresses.

Why Bastion exists

Traditional remote access to VMs requires a public IP address on the VM. That public IP becomes an attack surface — scanners constantly probe public RDP (port 3389) and SSH (port 22) endpoints.

Azure Bastion eliminates this risk entirely:

Without Bastion	With Bastion
VM needs a public IP address	No public IP needed on the VM
RDP/SSH ports exposed to the internet	Ports are only open to the Bastion service
Need VPN or jump box for secure access	Browser-based access from Azure portal over TLS
Vulnerable to port-scanning attacks	Attack surface removed completely

How Bastion works

1. Alex opens the Azure portal and selects a VM
2. Clicks “Connect via Bastion”
3. The Azure portal opens a browser-based RDP/SSH session
4. Traffic flows: Alex’s browser —TLS—> Azure Bastion —private network—> the VM
5. The VM never has a public IP. The connection is fully managed by Azure.

💡 Exam tip: Bastion keywords

When the exam describes a scenario with “secure remote access without public IPs” or “browser-based RDP/SSH from the Azure portal” — the answer is Azure Bastion.

Remember: Bastion is a fully managed PaaS — Alex does not need to patch, update, or manage it. Azure handles the infrastructure. Bastion is available in four SKUs: Developer (free, for testing), Basic, Standard, and Premium — each adding features like scaling, native client support, and session recording.

Azure Key Vault

Azure Key Vault is a cloud service for securely storing and managing three types of sensitive objects:

Object type	What it stores	Example
Secrets	Passwords, connection strings, API keys	Database password, third-party API token
Keys	Encryption keys (for encrypting/decrypting data)	Keys used by Azure Storage or Azure SQL encryption
Certificates	TLS/SSL certificates	HTTPS certificate for SecureBank’s web application

Why not just store secrets in code or config files?

• Hardcoded secrets get committed to source control — anyone with repository access can see them
• Secrets in config files can be leaked through error messages, logs, or backups
• Rotation becomes a nightmare — you must find and update every copy manually

Key Vault solves all of this: secrets are stored centrally, accessed via API, protected by access policies, and every access is logged in an audit trail.

For higher security requirements, Azure Key Vault also supports Managed HSM — hardware security modules that meet FIPS 140-2 Level 3 validation for organisations with strict regulatory requirements.

Key Vault and managed identities

Managed identities let Azure resources (like a web app or VM) authenticate to Key Vault without storing any credentials in code. Azure manages the identity automatically.

Flow: Web app needs a database password —> Web app uses its managed identity to request the secret from Key Vault —> Key Vault verifies the identity and returns the secret —> No password is ever stored in code.

💡 Scenario: Alex secures SecureBank's application secrets

SecureBank’s development team has been storing database connection strings in application config files. After a security review, Alex moves all secrets to Azure Key Vault.

1. All connection strings, API keys, and certificates are moved to Key Vault
2. Each application gets a managed identity
3. Key Vault access policies grant each app access only to the secrets it needs (least privilege)
4. The old config files are cleaned of all secrets
5. Key Vault audit logs show exactly which app accessed which secret, and when

Director Reyes reviews the audit log: “I can see that only the banking app accessed the database credentials, and it happened at expected times. This is exactly the visibility we needed.”

🎬 Video walkthrough

🎬 Video coming soon

Azure Infrastructure Security — VNets, NSGs, Bastion & Key Vault (SC-900)

Azure Infrastructure Security — VNets, NSGs, Bastion & Key Vault (SC-900)

~10 min

Flashcards

Question

What is network segmentation and why does it matter?

Click or press Enter to reveal answer

Answer

Network segmentation divides a network into isolated segments (subnets or VNets) so resources in one segment cannot freely communicate with another. It limits lateral movement — if an attacker compromises one subnet, they cannot automatically reach resources in other subnets.

Click to flip back

Question

How are NSG rules processed?

Click or press Enter to reveal answer

Answer

NSG rules are evaluated in priority order — lowest number first (100 before 200). Once a matching rule is found, processing stops. Default rules (which cannot be deleted) deny all inbound traffic and allow all outbound VNet and internet traffic.

Click to flip back

Question

What does Azure Bastion do?

Click or press Enter to reveal answer

Answer

Azure Bastion provides secure, browser-based RDP/SSH access to VMs from the Azure portal over TLS — without needing a public IP on the VM. It eliminates the attack surface of exposed RDP/SSH ports. It is a fully managed PaaS service.

Click to flip back

Question

What three types of objects does Azure Key Vault store?

Click or press Enter to reveal answer

Answer

1) Secrets — passwords, connection strings, API keys. 2) Keys — encryption keys for data protection. 3) Certificates — TLS/SSL certificates. All access is controlled by policies and logged for auditing.

Click to flip back

Question

How do managed identities work with Key Vault?

Click or press Enter to reveal answer

Answer

A managed identity is an Azure-managed credential assigned to a resource (like a web app). The app uses this identity to authenticate to Key Vault and retrieve secrets — no passwords or keys are stored in code. Azure handles the identity lifecycle automatically.

Click to flip back

Knowledge check

Knowledge Check

SecureBank's web application currently stores its database password in a configuration file. Alex wants to move to a more secure approach where the password is stored centrally, access is audited, and the application does not hold any credentials in its code. What combination should Alex implement?

AStore the password in an environment variable on the VM and restrict access to the VMBStore the password in Azure Key Vault and have the app authenticate using a managed identityCEncrypt the configuration file using BitLocker and restrict access to the fileDStore the password in Azure Blob Storage with a Shared Access Signature for the app

Check Answer

Knowledge Check

Alex needs to allow SecureBank's IT team to manage virtual machines remotely. The VMs are in a private subnet with no public IP addresses. The solution must not require a VPN or expose any ports to the internet. What should Alex use?

AAssign temporary public IP addresses to the VMs during maintenance windowsBCreate NSG rules that allow RDP traffic from the IT team's office IPCDeploy Azure Bastion to provide browser-based RDP/SSH access through the Azure portalDSet up Azure Firewall DNAT rules to translate inbound RDP traffic to the private VMs

Check Answer

Knowledge Check

SecureBank has a VNet with three subnets: Web, Application, and Database. Alex wants to ensure that only the Application subnet can communicate with the Database subnet. Web servers should reach the Application subnet but never the Database directly. What should Alex configure?

AAzure Firewall rules that block traffic between the Web and Database subnetsBNSG rules on the Database subnet allowing traffic only from the Application subnetCVNet peering between the Application and Database subnets onlyDAzure DDoS Protection on the Database subnet to block unwanted traffic

Check Answer