What is an Azure Virtual Network and how do network security groups work?
Interviewer Expectations for this Question
01
Core Competency
Assesses fundamental understanding of Microsoft Azure conventions, runtime behavior, and memory/performance considerations.
02
Evaluation Criteria
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
Comprehensive Model Answer
Verified Solution
A Virtual Network, or VNet, is an isolated private network in a region with its own address space. You divide it into subnets and control traffic with network security groups (NSGs).
- NSGs contain inbound and outbound rules with priority, source and destination, port, and protocol. Lower numbers win, and the first match applies.
- Rules can allow or deny. Default rules allow VNet-to-VNet and Azure Load Balancer traffic and deny the rest.
- NSGs can attach to subnets, network interfaces, or both, and both are evaluated.
- Traffic between subnets can be forced through an appliance using user-defined routes.
az network nsg rule create -g rg-app --nsg-name nsg-web \
--name allow-https --priority 100 --access Allow \
--protocol Tcp --destination-port-ranges 443
Use service tags and application security groups to keep rules readable, and Azure Firewall for centralised egress control.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.