Topic 1 · Question 253

Both NSG and Firewall can perform this function. I believe the key is in the number of virtual networks involved. You will use an NSG for a single VN and a Firewall for multiple.

An NSG is a firewall, albeit a very basic one. It’s a software defined solution that filters traffic at the Network layer. However, Azure Firewall is more robust. It’s a managed firewall service that can filter and analyze L3-L4 traffic, as well as L7 application traffic. Azure Firewall provides the same capabilities as an NSG, plus more.

D is correct Ans

Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall-as-a-service with built-in high availability and unrestricted cloud scalability. You can centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks.
Capabilities supported in Azure Firewall:
Stateful firewall as a service
Built-in high availability with unrestricted cloud scalability
FQDN filtering
FQDN tags
Network traffic filtering rules
Outbound SNAT support
Inbound DNAT support
Centrally create, enforce, and log application and network connectivity policies across Azure subscriptions and VNETs
Fully integrated with Azure Monitor for logging and analytics

NSG is used to limit access within a vNET.
Azure firewall is used to limit access to a vNET from outside.
Therefore the answer is correct.