In Azure, how would you control which traffic can reach a VM, and how do network security groups work?
What they are really testing: Whether you know the Azure primitive for network filtering (NSGs), how rule priority and direction work, and that an NSG can attach at the subnet or the NIC. They want the priority-ordering detail, since that is where Azure rules behave differently from a simple allow list.
A real interview question
In Azure, how would you control which traffic can reach a VM, and how do network security groups work?
What most people say
drag me
“You open the ports you need in the Azure firewall and that is it.”
It vaguely points at the right idea but never names NSGs, never mentions rule priority or direction, and ignores that the first matching rule wins. Without the priority model you cannot reason about why an allow rule is being overridden by a deny.
The follow-ups they ask next
You added an allow rule for port 22 but SSH is still blocked. What would you check first?
A lower-numbered (higher-priority) deny rule is matching first, since the first matching rule wins. Check rule priorities, and confirm the source and direction on your allow rule are correct.
An NSG is on both the subnet and the VM's NIC. How is traffic evaluated?
Both are evaluated. For inbound, the subnet NSG is checked then the NIC NSG, and traffic must be allowed by both to reach the VM; a deny in either one blocks it.
What the interviewer is listening for
- Names NSGs as the Azure control
- Knows rules have priority and first match wins
- Knows an NSG attaches at subnet or NIC level
What sinks the answer
- Cannot name the Azure primitive
- Unaware that rule priority decides the outcome
- Thinks adding an allow rule always grants access
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“In Azure I use [a network security group] with [inbound and outbound allow or deny rules] by source, port, and protocol. It attaches at [the subnet or the VM's NIC]. Rules are evaluated by [priority, lowest number first], and [the first matching rule wins], so a [high-priority deny] can override an allow.”
Keep going with networking
Foundation
What is a VPC, and what is a subnet within it? Why split a network into subnets at all?
Foundation
What is the difference between TCP and UDP, and when would you choose each?
Foundation
What happens, step by step, when you type a URL into a browser and press enter?
Foundation
How does DNS resolution actually work, and what is the difference between an A record and a CNAME?
Foundation
What is the difference between IPv4 and IPv6, and why does IPv6 exist?
Junior
An EC2 instance in a private subnet needs to download OS updates from the internet. Walk me through how you make that work, and why.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free