The ticket
You have 12 minutes. The interviewer draws tenant techclick-lab.in, hub 10.40.0.0/16, spoke 10.41.0.0/16, Firewall 10.40.0.4, FortiGate 203.0.113.10. Talk like you closed that ticket.
Name the control → name the object (MG, CA policy, PE NIC, GatewaySubnet) → name the proof (az account show, effective NSG, sign-in What If, FQDN → 10.41.x.x, effective routes) → name the trap. Weak: “check the logs.” Strong: “Sign-in logs for bg-emergency, plus role assignment list on sub-spoke-app.”
Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10. Not a live tenant.
Twenty questions (say these out loud)
- Who still owns identity and data on every Azure SKU?
- Entra tenant vs subscription — which object is
techclick-lab.in? - Why a landing zone before the first pay-api VM?
- Why is Owner = Hotmail on a random sub a failing design?
- NSG vs Azure Firewall vs WAF — one sentence each.
- How do you force spoke egress to 10.40.0.4?
- Why a public IP on pay-api bypasses the Firewall inbound?
- Why report-only before CA On?
- What must be true of
bg-emergency? - How do you avoid locking the tenant?
- Why is a secret in appsettings still a finding if kv-tc-lab exists?
- RBAC vs access policies on Key Vault?
- Why soft-delete and purge protection?
- Why is Allow Azure services not Private Link?
- What does a Private Endpoint look like on the wire?
- Defender recommendation vs Sentinel incident?
- Why do both need Log Analytics?
- Why must the subnet be named GatewaySubnet?
- Why don’t spokes see each other through the hub by default?
- Stolen refresh token / standing Owner / app secret — which sensor sees it?
| Q band | Lesson | Proof you must name |
|---|---|---|
| 1–2 | Shared + Entra | az account show |
| 3–4 | Landing zone | MG parent + Policy list |
| 5–7 | NSG / Firewall / WAF | Effective NSG + UDR |
| 8–10 | CA + break-glass | What If + sign-in filter |
| 11–13 | Key Vault + MI | RBAC on kv-tc-lab |
| 14–15 | Private Link | nslookup → 10.41.x.x |
| 16–17 | Defender + Sentinel | Two different blades |
| 18–19 | Hub-spoke | Peering + GatewaySubnet |
| 20 | Identity path | Role assignment + SigninLogs |
If the answer has no dummy name from this lab, it is still a brochure.
Weak vs strong
| Weak | Strong |
|---|---|
| Azure is down / reboot the VM | Which plane: Entra, RBAC, or fabric? |
| Open NSG any-any | Effective rules + UDR to 10.40.0.4 |
| We have Defender | Recommendation vs incident + workspace |
| VPN is up | IKE vs route vs peering vs selectors |
Role assignments
How to rehearse
Side A — draw
Tenant, three MGs, two subs, 10.40 / 10.41, 10.40.0.4, 203.0.113.50, FortiGate 203.0.113.10, kv-tc-lab, bg-emergency. From memory.
Side B — five proofs
Say five az/portal proofs without notes:
az account show, effective NSG, CA What If, nslookup to 10.41, effective routes.Side C — quiz
Misses send you back to that lesson. Do not invent SKU limits you did not read.
az account show --query "[name, tenantId]" -o tsv # sub-spoke-app # 22222222-2222-2222-2222-222222222222 az network nic list-effective-nsg -g rg-spoke -n nic-pay-api -o table az network nic show-effective-route-table -g rg-spoke -n nic-pay-api -o table az role assignment list --subscription sub-spoke-app -o table
Four interview fails
1 · Feature dump
They asked for a path through this lab.
2 · No proof command
Theory only. Name az or the blade.
3 · Mixing WAF, Firewall, NSG
Three layers. Say which one answers the question.
4 · Invented limits
If you do not remember a SKU cap, say so. Dummy IPs are enough.
How to prove it
You can walk questions 1–20 without notes, and you name a proof for each. You never say “reboot Azure.”
Traps
| Trap | Correction |
|---|---|
| Memorising portal menu names | Still fail if you cannot draw first-match of controls |
| Faking ExpressRoute SKUs | Say private circuit vs IPsec and stop |
| Closing with secure score | That is not an incident close |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview
Sources
- This series lessons 1–9 — Microsoft Learn pages cited there.
- Microsoft Learn — Shared responsibility in the cloud.
- Microsoft Learn — Azure landing zones.
- Microsoft Learn — Hub-spoke network topology.
Related: Azure session factory · Migration series.