Network security & firewalls
Security groups vs Network security groups and application security groups
Security groups map to Azure network security groups (NSGs), with application security groups (ASGs) standing in for rules that reference other security groups.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | Security groups | Network security groups and application security groups |
| Lifecycle | Generally available | Generally available |
| What it is | Stateful, allow-only virtual firewalls attached to network interfaces. Rules can reference other security groups instead of IP ranges. | Stateful, prioritized allow and deny rules applied to subnets or network interfaces. Application security groups let rules target groups of VMs instead of IP ranges. |
| Pricing model | Free. | Free. |
| Docs | Security groups docs | Network security groups and application security groups docs |
| Pricing page | Security groups pricing | Network security groups and application security groups pricing |
| Exams | SAA-C03 SCS-C03 ANS-C01 Retiring | AZ-104 AZ-700 SC-500 |
Key differences
- Rule types. Security groups have allow rules only (everything else is denied). NSGs have prioritized allow and deny rules, plus default rules that allow traffic within the virtual network and from the load balancer.
- Attachment. Security groups attach to network interfaces. NSGs attach to subnets, NICs, or both, and both levels are evaluated.
- References. Security group rules can reference other security groups. NSG rules reference ASGs or service tags (such as Storage or AzureLoadBalancer).
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Free. Security groups pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| AWS Certified Advanced Networking – Specialty ANS-C01 | AWS | Specialty | retiring The exam is being retired. The last day to take it is Dec 31, 2026. Existing certifications stay active for their three-year period. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of Security groups?
Security groups map to Azure network security groups (NSGs), with application security groups (ASGs) standing in for rules that reference other security groups.
How does pricing compare between Security groups and Network security groups and application security groups?
AWS: Free. Azure: Free. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Security – Specialty (SCS-C03); AWS Certified Advanced Networking – Specialty (ANS-C01) [retiring]; Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Network Engineer Associate (AZ-700); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).