Create and Configure a Network Security Group in Azure

Lab Overview

In this lab, you will learn how to create and configure a Network Security Group (NSG) within the Azure portal. Network Security Groups are critical components in Azure that help you control inbound and outbound network traffic to your resources.

By setting up rules in an NSG, you can define which traffic is allowed or denied based on factors such as the source, destination, and protocol.

This hands-on lab will guide you step-by-step through the process of creating a new NSG, defining security rules, and associating the NSG with a subnet in a virtual network.

By the end of this lab, you will have a fully functional NSG that controls traffic for a specified subnet in your virtual network.

Learning Objectives

Navigate the Azure portal to access the Network Security Group (NSG) service.
Create a new Network Security Group.
Define inbound security rules to control traffic to your resources.
Apply specific security rules for HTTP traffic using an NSG.
Associate the NSG with a subnet in a virtual network.
Verify the successful application of the NSG to a virtual network and its subnets.
Understand how to configure and apply network security at the subnet level in Azure.

Exam Relevance

The skills you learn in this lab are necessary to pass the following Azure certification exams:

AZ-104
AZ-305
AZ-700

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

Create and Configure an NSG in Azure

Lab Overview

Learning Objectives

Exam Relevance