Azure Networking – Interview Q&A

Part 1 – IP Addressing Fundamentals

1. What is an IP address?

Priority: High

An IP (Internet Protocol) address is a unique logical address assigned to a network interface for communication. It identifies the source or destination of network traffic.

Key Points: IPv4, IPv6, network communication.

2. What is the difference between IPv4 and IPv6?

Priority: High

3. What is the difference between Public IP and Private IP?

Priority: High

• Public IP: Globally routable address used for internet communication.

• Private IP: Used within private networks and not directly routable over the public internet.

Key Point: Azure VMs can communicate privately without individual public IP addresses.

4. What are the private IPv4 address ranges?

Priority: High

Key Point: These are RFC 1918 private address ranges.

5. What is NAT?

Priority: High

NAT (Network Address Translation) translates IP addresses between networks. Source NAT allows multiple private devices to access the internet through public IP addresses.

Key Point: Azure NAT Gateway provides outbound source NAT.

6. What are IP address classes?

Priority: Medium

Key Point: Modern Azure networking uses CIDR instead of classful addressing.

7. What is the loopback IP address?

Priority: Medium

127.0.0.1 is the IPv4 loopback address, commonly called localhost. It allows a computer to communicate with itself.

Example: http://localhost:5000

Part 2 – CIDR and Subnetting

8. What is CIDR?

Priority: High

CIDR stands for Classless Inter-Domain Routing. It represents IP networks using a prefix length, such as 10.0.1.0/24.

Key Point: /24 means 24 network bits and 8 host bits.

9. What is a subnet mask?

Priority: High

A subnet mask separates the network portion from the host portion of an IPv4 address.

Example: 255.255.255.0 is equivalent to /24.

10. How do you calculate the total number of IP addresses?

Priority: High

Formula:

Example: /24 = 2⁸ = 256 total IP addresses.

11. What is subnetting?

Priority: High

Subnetting divides a larger IP network into smaller networks for better organization, address allocation, and security segmentation.

Example: Divide 10.0.0.0/16 into multiple /24 subnets.

12. What is the difference between /16, /24, and /28?

Priority: High

Key Point: Azure reserves five IPv4 addresses in every subnet.

13. Why does Azure reserve five IP addresses?

Priority: High

Azure reserves the first four and last IP addresses in each IPv4 subnet for network identification and platform functionality.

Example: 10.0.1.0/24 has 251 assignable addresses.

14. What is the difference between Network Address and Broadcast Address?

Priority: Medium

• Network address: Identifies the subnet, such as 192.168.1.0.

• Broadcast address: Last address of a traditional IPv4 subnet, such as 192.168.1.255.

Key Point: Azure VNets do not support traditional IP broadcast traffic.

15. Can two Azure subnets have overlapping IP ranges?

Priority: High

No. Subnets within the same VNet must have non-overlapping address ranges.

Example: 10.0.1.0/24 and 10.0.2.0/24 are valid separate subnets.

Part 3 – Azure Virtual Network (VNet)

16. What is an Azure Virtual Network?

Priority: High

An Azure VNet is a logically isolated private network that allows Azure resources to communicate securely using private IP addresses.

Key Points: Isolation, private communication, subnets, security.

17. What is the difference between VNet and Subnet?

Priority: High

• VNet: Defines the overall private network and its IP address space.

• Subnet: Divides the VNet into smaller networks for organizing workloads and applying security policies.

Example: VNet 10.0.0.0/16, Subnet 10.0.1.0/24.

18. What is the difference between Public and Private Subnets in Azure?

Priority: High

A public subnet typically contains internet-facing workloads, while a private subnet contains internal workloads without direct public exposure.

Key Point: Azure does not automatically classify a subnet as public or private. Connectivity depends on IP assignments, routes, and security rules.

19. Can VMs in different subnets communicate?

Priority: High

Yes. Azure provides routing between subnets in the same VNet by default.

Key Point: NSGs, user-defined routes, and other security controls can restrict communication.

20. Can two different VNets communicate?

Priority: High

Yes. Azure VNet Peering allows private communication between VNets using Microsoft's backbone network.

Key Point: VNet address spaces generally must not overlap for peering.

21. Can a VNet span multiple Azure regions?

Priority: Medium

No. A VNet belongs to a single Azure region, but it can contain resources across availability zones within that region.

Key Point: Use Global VNet Peering to connect VNets across regions.

Part 4 – Network Security Groups (NSG)

22. What is an NSG?

Priority: High

An Azure Network Security Group filters inbound and outbound network traffic using Allow and Deny rules.

Key Points: Source, destination, protocol, port, priority.

23. How does NSG rule priority work?

Priority: High

NSG rules are evaluated from the lowest priority number to the highest. The first matching rule determines the action.

Example: Priority 100 is evaluated before priority 200.

24. Where can you associate an NSG?

Priority: High

An NSG can be associated with a subnet or a VM's network interface (NIC).

Key Point: Subnet NSGs apply broadly, while NIC NSGs provide interface-specific filtering.

25. What happens if both Subnet NSG and NIC NSG are configured?

Priority: High

Traffic must be permitted by both NSGs. For inbound traffic, the subnet NSG is evaluated before the NIC NSG; for outbound traffic, the order is reversed.

Key Point: A Deny rule in either NSG can block traffic.

26. What are the default NSG rules?

Priority: High

Azure NSGs include default rules that allow VNet traffic, allow outbound internet traffic, and deny other inbound traffic.

Key Point: Custom rules with higher precedence can override default behavior.

27. Are NSGs stateful or stateless?

Priority: High

NSGs are stateful. Once a connection is allowed, its response traffic is automatically permitted.

Key Point: You do not need a separate reverse-direction rule for response packets.

28. What is the difference between Inbound and Outbound NSG rules?

Priority: High

• Inbound: Controls traffic entering a subnet or NIC.

• Outbound: Controls traffic leaving a subnet or NIC.

Example: Allow inbound HTTPS on port 443 and restrict outbound database connections.

29. What is the difference between NSG and Azure Firewall?

Priority: Medium

Part 5 – Public VM, Private VM and Jump Box

30. What is the difference between Public VM and Private VM?

Priority: High

• Public VM: Has a public IP or is exposed through a public-facing service.

• Private VM: Uses private IP connectivity without direct public internet exposure.

Key Point: Private VMs are preferred for internal application and database workloads.

31. How do you connect to a private VM without a public IP?

Priority: High

Use Azure Bastion, a Jump Box, VPN, or ExpressRoute with an appropriate private network path.

Example: Connect to a Jump Box first, then access the private VM using its private IP.

32. What is a Jump Box?

Priority: High

A Jump Box is an intermediate server used to access private VMs securely without assigning public IP addresses to every server.

Key Point: It provides a controlled administrative access path.

33. What is Azure Bastion?

Priority: High

Azure Bastion is a fully managed service that provides secure RDP and SSH access to Azure VMs using private IP addresses.

Key Point: Target VMs do not require public IP addresses.

34. What is the difference between Jump Box and Azure Bastion?

Priority: Medium

35. Which ports are used for SSH, RDP, HTTP and HTTPS?

Priority: High

Part 6 – Azure NAT Gateway

36. What is Azure NAT Gateway?

Priority: High

Azure NAT Gateway is a managed networking service that provides outbound internet connectivity to resources in associated subnets.

Key Points: Outbound access, static public IP, SNAT.

37. Can NAT Gateway allow inbound internet connections?

Priority: High

No. NAT Gateway supports outbound connections and their return traffic, but does not allow unsolicited inbound internet connections.

Key Point: It does not expose private VMs to direct inbound access.

38. What is SNAT?

Priority: High

SNAT (Source Network Address Translation) translates a private source IP address into a public source IP address for outbound communication.

Example: Private VM 10.0.2.4 → NAT Gateway → Public Internet.

39. What is the difference between NAT Gateway and VM Public IP?

Priority: High

40. Why use NAT Gateway instead of default outbound access?

Priority: High

NAT Gateway provides predictable public IP addresses and scalable outbound connectivity.

Key Point: Explicit outbound connectivity is recommended instead of relying on Azure's legacy default outbound access.

41. How do you verify NAT Gateway connectivity?

Priority: Medium

Connect to the private Linux VM and execute:

curl ifconfig.me

The returned public IP should match one of the public IP addresses assigned to the NAT Gateway.

Part 7 – Real-Time Scenario-Based Questions

42. A private VM cannot access the internet. How do you troubleshoot?

Priority: High

Check the NAT Gateway or other outbound connectivity configuration, NSG outbound rules, route tables, and DNS resolution.

Key Point: A private IP alone does not guarantee internet access.

43. Two VMs in the same VNet cannot communicate. What could be the reason?

Priority: High

Check NSG rules, VM operating-system firewalls, effective routes, and whether the destination service is listening on the required port.

Key Point: Same-VNet communication is normally available unless restricted.

44. How do you allow only one IP address to access a VM using SSH?

Priority: High

Create an inbound NSG rule allowing TCP port 22 from the administrator's specific public IP /32, and ensure broader SSH access is denied.

Key Point: Follow least-privilege access.

45. How do you securely host an ASP.NET Core application and SQL Server in Azure VMs?

Priority: High

Host the web application behind a controlled HTTPS entry point and keep SQL Server on a private VM.

Allow SQL port 1433 only from the application subnet or designated application servers.

46. A private VM must access an external API that requires a fixed public IP. What is your solution?

Priority: High

Configure Azure NAT Gateway with a static public IP and associate it with the VM's subnet.

Key Point: The external API sees the NAT Gateway's public IP.

47. A VM has a public IP, but SSH or RDP is not working. What should you check?

Priority: High

Check NSG inbound rules, the operating-system firewall, public IP association, routing, and whether SSH/RDP services are running.

Key Point: A public IP does not automatically permit remote access.

48. How can you prevent direct internet access to a database VM?

Priority: High

Avoid assigning a public IP, restrict inbound traffic through NSG rules, and allow database connections only from trusted application resources.

Key Point: Use private network connectivity for database access.