Why network isolation matters in Azure - See It in Action

Why network isolation matters

📖 Scenario: You are setting up a simple cloud environment in Azure for a small company. The company wants to keep their sensitive data safe and separate from the public internet and other parts of their network.Think of it like having a private room in a house where only certain people can enter, keeping important things safe from strangers.

🎯 Goal: Build a basic Azure virtual network with network isolation by creating a virtual network and a subnet with network security group rules that block all inbound traffic except from a trusted IP address.

📋 What You'll Learn

Create an Azure virtual network named MyVNet with address space 10.0.0.0/16

Create a subnet named SecureSubnet within MyVNet with address prefix 10.0.1.0/24

Create a network security group named NSG-SecureSubnet with a rule to allow inbound traffic only from IP 203.0.113.5

Associate the network security group NSG-SecureSubnet with the subnet SecureSubnet

💡 Why This Matters

🌍 Real World

Network isolation is like having private rooms in a building where only authorized people can enter. It protects sensitive data and systems from unwanted access.

💼 Career

Understanding network isolation is essential for cloud engineers and security professionals to design secure cloud environments that protect company resources.

1

Create the Azure virtual network

Create an Azure virtual network named MyVNet with the address space 10.0.0.0/16 using the az network vnet create command.

Azure

# Use az network vnet create to make MyVNet with 10.0.0.0/16
# Your code here

Hint

Use the Azure CLI command az network vnet create with the --name and --address-prefixes options.

2

Create the subnet inside the virtual network

Create a subnet named SecureSubnet inside the virtual network MyVNet with the address prefix 10.0.1.0/24 using the az network vnet subnet create command.

Azure

az network vnet create --name MyVNet --resource-group MyResourceGroup --address-prefixes 10.0.0.0/16
# Create SecureSubnet with 10.0.1.0/24 inside MyVNet
# Your code here

Hint

Use az network vnet subnet create with --name SecureSubnet and specify the virtual network name with --vnet-name MyVNet.

3

Create a network security group with a rule to allow trusted IP

Create a network security group named NSG-SecureSubnet using az network nsg create. Then add a security rule named AllowTrustedIP that allows inbound traffic from IP 203.0.113.5 on all ports using az network nsg rule create.

Azure

az network vnet create --name MyVNet --resource-group MyResourceGroup --address-prefixes 10.0.0.0/16
az network vnet subnet create --name SecureSubnet --resource-group MyResourceGroup --vnet-name MyVNet --address-prefixes 10.0.1.0/24
# Create NSG-SecureSubnet and add AllowTrustedIP rule for 203.0.113.5
# Your code here

Hint

Create the NSG first, then add a rule with az network nsg rule create specifying the source IP and allowing inbound traffic.

4

Associate the network security group with the subnet

Associate the network security group NSG-SecureSubnet with the subnet SecureSubnet in the virtual network MyVNet using az network vnet subnet update.

Azure

az network vnet create --name MyVNet --resource-group MyResourceGroup --address-prefixes 10.0.0.0/16
az network vnet subnet create --name SecureSubnet --resource-group MyResourceGroup --vnet-name MyVNet --address-prefixes 10.0.1.0/24
az network nsg create --resource-group MyResourceGroup --name NSG-SecureSubnet
az network nsg rule create --resource-group MyResourceGroup --nsg-name NSG-SecureSubnet --name AllowTrustedIP --priority 100 --direction Inbound --access Allow --protocol '*' --source-address-prefixes 203.0.113.5 --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges '*'
# Associate NSG-SecureSubnet with SecureSubnet
# Your code here

Hint

Use az network vnet subnet update with --network-security-group NSG-SecureSubnet to link the NSG to the subnet.

Practice

1. Why is network isolation important in Azure cloud environments?

easy

A. It increases the speed of internet browsing.

B. It protects resources by controlling access and traffic flow.

C. It reduces the cost of cloud storage.

D. It automatically backs up data daily.

Solution

1. Step 1: Understand network isolation purpose

   Network isolation separates resources to prevent unauthorized access and control traffic.

2. Step 2: Identify the main benefit

   Protecting resources by controlling who can connect and what traffic is allowed is the key benefit.

3. Final Answer:

   It protects resources by controlling access and traffic flow. -> Option B

4. Quick Check:

   Network isolation = Protect resources [OK]

Hint: Network isolation means controlling access and traffic [OK]

Common Mistakes:

• Confusing isolation with cost reduction
• Thinking it speeds up internet browsing
• Assuming it handles backups automatically

2. Which Azure component is used to create network isolation by segmenting resources?

easy

A. Azure Functions

B. Azure Blob Storage

C. Azure Virtual Network (VNet)

D. Azure DevOps

Solution

1. Step 1: Identify Azure components for network isolation

   Azure Virtual Network (VNet) segments resources into isolated networks.

2. Step 2: Exclude unrelated services

   Blob Storage, Functions, and DevOps do not provide network segmentation.

3. Final Answer:

   Azure Virtual Network (VNet) -> Option C

4. Quick Check:

   VNet = Network isolation tool [OK]

Hint: VNet segments resources for isolation [OK]

Common Mistakes:

• Choosing storage or compute services instead of network
• Confusing DevOps with networking
• Ignoring the role of VNet in isolation

3. Given this Azure network setup code snippet, what is the effect of applying the Network Security Group (NSG) rule?

securityRule = {
  name: 'deny-inbound',
  priority: 100,
  direction: 'Inbound',
  access: 'Deny',
  protocol: '*',
  sourceAddressPrefix: '*',
  destinationPortRange: '22'
}

medium

A. Denies all inbound traffic on port 22

B. Denies outbound traffic on all ports

C. Allows outbound traffic on port 22

D. Allows all inbound traffic on port 22

Solution

1. Step 1: Analyze NSG rule properties

   The rule denies inbound traffic on port 22 from any source.

2. Step 2: Understand direction and access

   Direction is inbound and access is deny, so inbound SSH (port 22) is blocked.

3. Final Answer:

   Denies all inbound traffic on port 22 -> Option A

4. Quick Check:

   Inbound deny on port 22 = Block SSH [OK]

Hint: Deny inbound on port 22 blocks SSH access [OK]

Common Mistakes:

• Confusing inbound with outbound direction
• Assuming allow instead of deny
• Ignoring port number in rule

4. You configured a subnet with a Network Security Group (NSG) to allow only HTTP (port 80) traffic inbound, but users report they cannot access the web app. What is the likely issue?

medium

A. The NSG rule is missing an outbound allow for port 80.

B. The web app is not deployed in the subnet.

C. The subnet is not attached to a Virtual Network.

D. The NSG rule denies inbound traffic on port 80.

Solution

1. Step 1: Check NSG inbound rules

   If users cannot access HTTP, likely inbound port 80 is blocked or denied.

2. Step 2: Confirm rule effect

   Allow only HTTP means deny rules may override or misconfigured deny blocks port 80 inbound.

3. Final Answer:

   The NSG rule denies inbound traffic on port 80. -> Option D

4. Quick Check:

   Inbound deny on port 80 blocks web access [OK]

Hint: Check if inbound port 80 is denied in NSG [OK]

Common Mistakes:

• Assuming outbound rules block inbound traffic
• Ignoring subnet attachment to VNet
• Thinking deployment location causes access issue

5. You want to isolate a sensitive Azure database so only a specific app server can connect. Which combination ensures proper network isolation?

hard

A. Use separate VNets with peering and NSG allowing only app server IP on database port.

B. Deploy database publicly with firewall allowing all IPs.

C. Place both in the same Virtual Network and subnet without NSG rules.

D. Use Azure Blob Storage instead of database for isolation.

Solution

1. Step 1: Understand isolation needs

   Separate VNets with peering isolate networks but allow controlled communication.

2. Step 2: Apply NSG rules for access control

   NSG allowing only app server IP on database port restricts access tightly.

3. Step 3: Exclude insecure options

   Same subnet without NSG lacks isolation; public database with open firewall is insecure; Blob Storage is unrelated.

4. Final Answer:

   Use separate VNets with peering and NSG allowing only app server IP on database port. -> Option A

5. Quick Check:

   Separate VNets + NSG = Strong isolation [OK]

Hint: Use peered VNets plus NSG to restrict access [OK]

Common Mistakes:

• Skipping NSG rules for access control
• Using public access for sensitive data
• Confusing storage service with database isolation