# Interview: name the control, the object, and the proof Source: https://ai.techclick.in/blog_azure_security_interview_20 Markdown: https://ai.techclick.in/blog_azure_security_interview_20.md Publisher: Techclick Infosec Pvt Ltd Twenty Azure security interview scenarios from this lab: Entra, landing zone, NSG/Firewall/WAF, CA, KV, PE, Sentinel, hub-spoke. ## The ticket You have 12 minutes. The interviewer draws tenant techclick-lab.in , hub 10.40.0.0/16, spoke 10.41.0.0/16, Firewall 10.40.0.4, FortiGate 203.0.113.10. Talk like you closed that ticket. Strong answer pattern Name the control → name the object (MG, CA policy, PE NIC, GatewaySubnet) → name the proof ( az account show , effective NSG, sign-in What If, FQDN → 10.41.x.x, effective routes) → name the trap. Weak: “check the logs.” Strong: “Sign-in logs for bg-emergency, plus role assignment list on sub-spoke-app.” Hero · whiteboard If you cannot draw tenant vs sub vs VNet, you are not ready. Lab data · dummy only Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10 . Not a live tenant. ## Twenty questions (say these out loud) - Who still owns identity and data on every Azure SKU? - Entra tenant vs subscription — which object is techclick-lab.in ? - Why a landing zone before the first pay-api VM? - Why is Owner = Hotmail on a random sub a failing design? - NSG vs Azure Firewall vs WAF — one sentence each. - How do you force spoke egress to 10.40.0.4? - Why a public IP on pay-api bypasses the Firewall inbound? - Why report-only before CA On? - What must be true of bg-emergency ? - How do you avoid locking the tenant? - Why is a secret in appsettings still a finding if kv-tc-lab exists? - RBAC vs access policies on Key Vault? - Why soft-delete and purge protection? - Why is Allow Azure services not Private Link? - What does a Private Endpoint look like on the wire? - Defender recommendation vs Sentinel incident? - Why do both need Log Analytics? - Why must the subnet be named GatewaySubnet? - Why don’t spokes see each other through the hub by default? - Stolen refresh token / standing Owner / app secret — which sensor sees it? Q band Lesson Proof you must name 1–2 Shared + Entra az account show 3–4 Landing zone MG parent + Policy list 5–7 NSG / Firewall / WAF Effective NSG + UDR 8–10 CA + break-glass What If + sign-in filter 11–13 Key Vault + MI RBAC on kv-tc-lab 14–15 Private Link nslookup → 10.41.x.x 16–17 Defender + Sentinel Two different blades 18–19 Hub-spoke Peering + GatewaySubnet 20 Identity path Role assignment + SigninLogs Weak vs strong - Weak: reboot Azure no object, no proof Strong: object + az + the trap you did not step in If the answer has no dummy name from this lab, it is still a brochure. ## Weak vs strong Weak Strong Azure is down / reboot the VM Which plane: Entra, RBAC, or fabric? Open NSG any-any Effective rules + UDR to 10.40.0.4 We have Defender Recommendation vs incident + workspace VPN is up IKE vs route vs peering vs selectors https://portal.azure.com Training mock · not live Azure portal Home Microsoft Entra ID Virtual networks Azure Firewall Subscriptions → sub-spoke-app → IAM ### Role assignments Owner wl-owners · PIM eligible Not present hotmail personal standing Owner Reader priya@techclick-lab.in Break-glass bg-emergency excluded from CA, alerted Proof az role assignment list + Sign-in logs Cancel Save Interviewers want this blade in your mouth. Training mock. ## How to rehearse #### Side A — draw Tenant, three MGs, two subs, 10.40 / 10.41, 10.40.0.4, 203.0.113.50, FortiGate 203.0.113.10, kv-tc-lab, bg-emergency. From memory. - #### Side B — five proofs Say five az/portal proofs without notes: az account show , effective NSG, CA What If, nslookup to 10.41, effective routes. - #### Side C — quiz Misses send you back to that lesson. Do not invent SKU limits you did not read. az · dummy rehearsal az account show --query "[name, tenantId]" -o tsv # sub-spoke-app # 22222222-2222-2222-2222-222222222222 az network nic list-effective-nsg -g rg-spoke -n nic-pay-api -o table az network nic show-effective-route-table -g rg-spoke -n nic-pay-api -o table az role assignment list --subscription sub-spoke-app -o table ## Four interview fails ### 1 · Feature dump They asked for a path through this lab. ### 2 · No proof command Theory only. Name az or the blade. ### 3 · Mixing WAF, Firewall, NSG Three layers. Say which one answers the question. ### 4 · Invented limits If you do not remember a SKU cap, say so. Dummy IPs are enough. ## How to prove it You are ready when You can walk questions 1–20 without notes, and you name a proof for each. You never say “reboot Azure.” ## Traps Trap Correction Memorising portal menu names Still fail if you cannot draw first-match of controls Faking ExpressRoute SKUs Say private circuit vs IPsec and stop Closing with secure score That is not an incident close ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Best proof of tenant vs subscription? Reboot pay-api az account show — name is the sub, tenant domain is techclick-lab.in NSG hit count WAF CRS version Correct: b . Lesson 1. Q2 Force spoke Internet via the hub with… UDR 0.0.0.0/0 to 10.40.0.4 and no VM public IP Allow Azure services A CA policy Renaming the tenant Correct: a . Lesson 3. Q3 bg-emergency must be… Included in MFA-for-all Excluded from CA and alerted on every sign-in The daily Owner A FortiGate local user Correct: b . Lesson 4. Q4 Allow Azure services is… Private Link Not private — Azure-sourced IPs An NSG PIM Correct: b . Lesson 6. Q5 Gateway subnet name? Gateway GatewaySubnet hub-vpn AzureFirewallSubnet Correct: b . Lesson 8. Q6 Strong interview pattern? Control + object + proof + trap Reboot first List every Azure logo Say Microsoft owns identity Correct: a . This lesson. Check answers Reset Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview ## Sources - This series lessons 1–9 — Microsoft Learn pages cited there. - Microsoft Learn — Shared responsibility in the cloud . - Microsoft Learn — Azure landing zones . - Microsoft Learn — Hub-spoke network topology . Related: Azure session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt