Skills Pragati
YouTube

SC-500 Step by step · Part 5

Lock Down an Azure Network: NSG, Private Endpoint, Firewall

Segment tiers with NSGs and application security groups, reach Key Vault over a private endpoint, and route traffic through Azure Firewall.

· 7 min read

Create a private endpoint for kv-sc500-pragati, review and create
Watch the lesson: Part 5: Network security, NSGs, private endpoints, Azure Firewall, VPN and Private Access | SC-500

A flat network is an attacker’s favourite: one compromised web server, and everything else is one hop away. Part 5 of the SC-500 course segments Pragati Logistics’ dispatch network so each tier talks only to the tier it needs, and platform services stop answering on the internet.

Step 1: Segment by role with NSGs and ASGs

Create vnet-sc500-dispatch (free) and two application security groups: asg-sc500-web and asg-sc500-app. An ASG is just a label for a role, so rules name roles, not IP addresses.

Create nsg-sc500-app and add one inbound rule: source asg-sc500-web, destination asg-sc500-app, TCP 8080, allow, priority 100. Associate the NSG with the subnet.

Add inbound security rule on nsg-sc500-app: TCP 8080, allow, priority 100
Web reaches app on 8080; everything else falls to the default deny.

Step 2: A private endpoint for Key Vault

The vault firewall already denies public traffic. Now give it a private address: Networking, Private endpoint connections, Create, name pe-kv-sc500, resource type Microsoft.KeyVault/vaults, sub-resource vault, subnet in vnet-sc500-dispatch.

Integrate with a private DNS zone: yes (privatelink.vaultcore.azure.net). That zone is what makes the vault’s normal name resolve to the private address inside the network.

Create a private endpoint: review with the key vault as target resource
The vault gets a private IP in the dispatch network.

Step 3: Azure Firewall with a policy

Create fw-sc500-hub (Basic SKU) with a new firewall policy, fwpol-sc500, in a hub network. The rules live in the policy, not on the firewall, so one policy can serve many firewalls.

Add an application rule collection that allows only the outbound sites the app needs, by FQDN.

Firewall policy: add an application rule collection
Outbound by name: only the destinations the app needs.

Part 5 also covers a point-to-site VPN with Entra ID sign-in, Entra Private Access, Virtual Network Manager security admin rules and Network Watcher.

How you know it worked

  • Effective security rules on the VM’s network card show the merged NSG rules in evaluation order.
  • IP flow verify from an outside address to port 22 returns access denied, with the rule that denied it.
  • The vault name resolves to a private IP from inside the network.

What a tech lead should take away

  • NSG filters by IP and port on every subnet; Azure Firewall centralises outbound rules by name; WAF protects web apps; private endpoints take PaaS off the internet.
  • Name roles, not IPs, with application security groups.
  • Private endpoints need private DNS, or apps silently keep using the public address.

Do it yourself

Lab guides, practice and full mock exams come with a subscription. See the plans

More on SC-500