Explain Azure networking basics: VNets, subnets, NSGs, peering, and private endpoints.
What they are really testing: Whether you can build an isolated network and, importantly, keep PaaS traffic off the public internet with private endpoints. A core Azure design competency.
A real interview question
Explain Azure networking basics: VNets, subnets, NSGs, peering, and private endpoints.
What most people say
drag me
“You create a VNet with subnets and use NSGs as firewalls to control traffic.”
It covers the basics but misses peering (and its non-transitivity) and private endpoints, which are how you connect VNets and keep PaaS services like Storage and SQL off the public internet, a key Azure security pattern.
The follow-ups they ask next
Why does peering being non-transitive matter?
Spokes peered to a hub cannot reach each other through the hub by default. You either mesh-peer them or route through a network virtual appliance/Azure Firewall in the hub, which is why hub-and-spoke needs deliberate routing.
What problem do private endpoints solve?
They give a PaaS service a private IP in your VNet so traffic never goes over the public internet, letting you disable the public endpoint. Essential for keeping Storage/SQL access private.
What the interviewer is listening for
- VNet/subnets + NSG (stateful) + ASG
- Knows peering is non-transitive (hub-and-spoke)
- Knows private endpoints keep PaaS off the public internet
What sinks the answer
- Only VNet + NSG
- Unaware peering is non-transitive
- No notion of private endpoints
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“[A VNet is your isolated network, split into subnets for tiers]. [NSGs are stateful firewall rules on subnets/NICs; ASGs group NICs by role]. [VNet peering connects VNets privately over the backbone, but it is non-transitive, so hub-and-spoke at scale]. [Private endpoints give a PaaS service (Storage/SQL) a private IP in your VNet so traffic stays private and the public endpoint can be disabled].”
Keep going with azure
Foundation
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
Foundation
In Azure, what handles authentication versus authorization?
Foundation
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
Junior
How does Azure RBAC work? Explain roles, scopes, and assignments.
Junior
What happens when a user signs in to an Azure/Entra-protected application?
Junior
What is the difference between a service principal and a managed identity, and why prefer managed identities?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free