Network security groups and application security groups: rule priority, default rules, subnet vs NIC association, effective security rules

A network security group (NSG) filters traffic to and from Azure resources in a virtual network with a list of allow and deny rules. Each rule matches on source, source port, destination, destination port and protocol (TCP, UDP, ICMP or any) and has a direction (inbound or outbound), an action and a priority. NSGs are stateful: if an inbound connection is allowed, the return traffic is allowed automatically without an outbound rule. NSGs are the basic layer 3 and layer 4 firewall of every Azure network and appear in almost every networking question.