Why network isolation matters in Azure - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a virtual network in Azure.

Azure

az network vnet create --name [1] --resource-group MyResourceGroup --location eastus --address-prefix 10.0.0.0/16

Drag options to blanks, or click blank then click option'

AMyStorage

BMyVNet

CMyVM

DMySubnet

Attempts:

3 left

💡 Hint

Common Mistakes

Using a subnet or VM name instead of the virtual network name.

Confusing resource group name with virtual network name.

The --name parameter specifies the name of the virtual network. Here, MyVNet is the correct name for the virtual network.

2fill in blank

medium

Complete the code to create a subnet within the virtual network.

Azure

az network vnet subnet create --address-prefix 10.0.1.0/24 --name [1] --vnet-name MyVNet --resource-group MyResourceGroup

Drag options to blanks, or click blank then click option'

AMySubnet

BMyVNet

CMyResourceGroup

DMyNSG

Attempts:

3 left

💡 Hint

Common Mistakes

Using the virtual network name instead of subnet name.

Using resource group or network security group names.

The --name parameter here specifies the subnet name. MySubnet is the correct choice for a subnet.

3fill in blank

hard

Fix the error in the command to associate a network security group with a subnet.

Azure

az network vnet subnet update --name MySubnet --resource-group MyResourceGroup --vnet-name MyVNet --network-security-group [1]

Drag options to blanks, or click blank then click option'

AMyVNet

BMySubnet

CMyNSG

DMyResourceGroup

Attempts:

3 left

💡 Hint

Common Mistakes

Using the virtual network or subnet name instead of NSG name.

Using the resource group name.

The --network-security-group parameter requires the name of the network security group (NSG). MyNSG is the correct NSG name.

4fill in blank

hard

Fill both blanks to create a network security group and then create a rule to allow HTTP traffic.

Azure

az network nsg create --resource-group MyResourceGroup --name [1]
az network nsg rule create --resource-group MyResourceGroup --nsg-name [2] --name AllowHTTP --protocol tcp --priority 1000 --destination-port-range 80 --access allow --direction inbound

Drag options to blanks, or click blank then click option'

AMyNSG

BMyVNet

CMySubnet

DMyResourceGroup

Attempts:

3 left

💡 Hint

Common Mistakes

Using virtual network or subnet names instead of NSG name.

Using resource group name as NSG name.

Both commands use the network security group name. MyNSG is the correct name for the NSG in both places.

5fill in blank

hard

Fill all three blanks to create a virtual machine in a subnet with network isolation.

Azure

az vm create --resource-group [1] --name [2] --image UbuntuLTS --vnet-name MyVNet --subnet [3] --admin-username azureuser --generate-ssh-keys

Drag options to blanks, or click blank then click option'

AMyResourceGroup

BMyVM

CMySubnet

DMyNSG

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing NSG name with subnet name.

Using virtual network name instead of subnet name.

The VM creation command requires the resource group name, VM name, and subnet name. Here, MyResourceGroup, MyVM, and MySubnet are correct.

Practice

1. Why is network isolation important in Azure cloud environments?

easy

A. It increases the speed of internet browsing.

B. It protects resources by controlling access and traffic flow.

C. It reduces the cost of cloud storage.

D. It automatically backs up data daily.

Solution

1. Step 1: Understand network isolation purpose

   Network isolation separates resources to prevent unauthorized access and control traffic.

2. Step 2: Identify the main benefit

   Protecting resources by controlling who can connect and what traffic is allowed is the key benefit.

3. Final Answer:

   It protects resources by controlling access and traffic flow. -> Option B

4. Quick Check:

   Network isolation = Protect resources [OK]

Hint: Network isolation means controlling access and traffic [OK]

Common Mistakes:

• Confusing isolation with cost reduction
• Thinking it speeds up internet browsing
• Assuming it handles backups automatically

2. Which Azure component is used to create network isolation by segmenting resources?

easy

A. Azure Functions

B. Azure Blob Storage

C. Azure Virtual Network (VNet)

D. Azure DevOps

Solution

1. Step 1: Identify Azure components for network isolation

   Azure Virtual Network (VNet) segments resources into isolated networks.

2. Step 2: Exclude unrelated services

   Blob Storage, Functions, and DevOps do not provide network segmentation.

3. Final Answer:

   Azure Virtual Network (VNet) -> Option C

4. Quick Check:

   VNet = Network isolation tool [OK]

Hint: VNet segments resources for isolation [OK]

Common Mistakes:

• Choosing storage or compute services instead of network
• Confusing DevOps with networking
• Ignoring the role of VNet in isolation

3. Given this Azure network setup code snippet, what is the effect of applying the Network Security Group (NSG) rule?

securityRule = {
  name: 'deny-inbound',
  priority: 100,
  direction: 'Inbound',
  access: 'Deny',
  protocol: '*',
  sourceAddressPrefix: '*',
  destinationPortRange: '22'
}

medium

A. Denies all inbound traffic on port 22

B. Denies outbound traffic on all ports

C. Allows outbound traffic on port 22

D. Allows all inbound traffic on port 22

Solution

1. Step 1: Analyze NSG rule properties

   The rule denies inbound traffic on port 22 from any source.

2. Step 2: Understand direction and access

   Direction is inbound and access is deny, so inbound SSH (port 22) is blocked.

3. Final Answer:

   Denies all inbound traffic on port 22 -> Option A

4. Quick Check:

   Inbound deny on port 22 = Block SSH [OK]

Hint: Deny inbound on port 22 blocks SSH access [OK]

Common Mistakes:

• Confusing inbound with outbound direction
• Assuming allow instead of deny
• Ignoring port number in rule

4. You configured a subnet with a Network Security Group (NSG) to allow only HTTP (port 80) traffic inbound, but users report they cannot access the web app. What is the likely issue?

medium

A. The NSG rule is missing an outbound allow for port 80.

B. The web app is not deployed in the subnet.

C. The subnet is not attached to a Virtual Network.

D. The NSG rule denies inbound traffic on port 80.

Solution

1. Step 1: Check NSG inbound rules

   If users cannot access HTTP, likely inbound port 80 is blocked or denied.

2. Step 2: Confirm rule effect

   Allow only HTTP means deny rules may override or misconfigured deny blocks port 80 inbound.

3. Final Answer:

   The NSG rule denies inbound traffic on port 80. -> Option D

4. Quick Check:

   Inbound deny on port 80 blocks web access [OK]

Hint: Check if inbound port 80 is denied in NSG [OK]

Common Mistakes:

• Assuming outbound rules block inbound traffic
• Ignoring subnet attachment to VNet
• Thinking deployment location causes access issue

5. You want to isolate a sensitive Azure database so only a specific app server can connect. Which combination ensures proper network isolation?

hard

A. Use separate VNets with peering and NSG allowing only app server IP on database port.

B. Deploy database publicly with firewall allowing all IPs.

C. Place both in the same Virtual Network and subnet without NSG rules.

D. Use Azure Blob Storage instead of database for isolation.

Solution

1. Step 1: Understand isolation needs

   Separate VNets with peering isolate networks but allow controlled communication.

2. Step 2: Apply NSG rules for access control

   NSG allowing only app server IP on database port restricts access tightly.

3. Step 3: Exclude insecure options

   Same subnet without NSG lacks isolation; public database with open firewall is insecure; Blob Storage is unrelated.

4. Final Answer:

   Use separate VNets with peering and NSG allowing only app server IP on database port. -> Option A

5. Quick Check:

   Separate VNets + NSG = Strong isolation [OK]

Hint: Use peered VNets plus NSG to restrict access [OK]

Common Mistakes:

• Skipping NSG rules for access control
• Using public access for sensitive data
• Confusing storage service with database isolation