Introduction to Cloud Computing and Azure Fundamentals

Virtual Networks and Isolation

A Virtual Network (VNet) serves as the fundamental building block for your private network in the cloud. It provides a logically isolated environment where you can launch resources, define IP address ranges, and manage subnets. The core logic here is security and segmentation; by grouping related resources into subnets, you can apply distinct security policies to different tiers of your application, such as web servers versus database servers. This isolation ensures that traffic is controlled and routed predictably. By using Private Link or Service Endpoints, you extend this logic, allowing your cloud resources to communicate over a private backplane rather than the public internet, significantly reducing the attack surface. Understanding VNet topology is critical because it dictates how your services communicate with each other and the external world, ensuring that resources remain reachable while private data remains shielded from public exposure.

# Define a VNet address space in JSON for provisioning
{
  "name": "ProductionVNet",
  "addressSpace": {
    "addressPrefixes": ["10.0.0.0/16"] // Defines the total private IP range
  },
  "subnets": [
    {
      "name": "WebTier",
      "properties": {"addressPrefix": "10.0.1.0/24"} // Isolated segment for web traffic
    }
  ]
}

Network Security Groups (NSG)

Network Security Groups (NSGs) function as a distributed firewall for your cloud environment, operating at the resource level to control ingress and egress traffic. They filter traffic based on a set of rules defined by source, destination, port, and protocol. The power of NSGs lies in their ability to be applied to either a subnet or an individual network interface, providing granular control over traffic flow. By implementing a 'deny-all-by-default' strategy, you ensure that only explicitly authorized traffic can reach your critical application endpoints. When designing network security, you must reason about the flow of data: think of an NSG as a gatekeeper that validates the legitimacy of every packet. Proper rule ordering is essential here because processing stops at the first matching rule, allowing you to prioritize specific exceptions to your general security policies while maintaining a robust perimeter.

# Example of an NSG rule allowing HTTPS traffic
{
  "name": "AllowHttpsInbound",
  "properties": {
    "priority": 100, // Processed first
    "direction": "Inbound",
    "access": "Allow",
    "protocol": "Tcp",
    "sourcePortRange": "*",
    "destinationPortRange": "443", // Standard secure web port
    "sourceAddressPrefix": "*",
    "destinationAddressPrefix": "*"
  }
}

Load Balancing Strategies

Load balancers are essential for achieving high availability and scalability in your cloud architecture. By distributing incoming network traffic across multiple healthy virtual machine instances, they prevent any single component from becoming a bottleneck and ensure service continuity even if individual nodes fail. You should reason about load balancing as a traffic distribution engine that evaluates health probes to verify whether a resource is capable of processing requests. Azure Load Balancer operates at the transport layer, handling traffic based on IP addresses and ports, while Application Gateway works at the application layer, allowing for intelligent routing based on URLs or host headers. Choosing the right strategy depends on your application's architecture; for simple stateless services, a layer-4 balancer is efficient, but for complex microservices requiring path-based routing, an application-layer approach is necessary to maintain clean, scalable traffic paths.

# Configuration snippet for a basic health probe
{
  "name": "WebProbe",
  "properties": {
    "protocol": "Http",
    "port": 80,
    "requestPath": "/health", // Path to check service status
    "intervalInSeconds": 15,  // Check frequency
    "numberOfProbes": 2      // Fail count before marking offline
  }
}

Hybrid Connectivity

Hybrid connectivity bridges the gap between your on-premises infrastructure and the cloud, creating a unified network fabric. This is typically achieved through VPN Gateways, which create an encrypted tunnel over the public internet, or ExpressRoute, which provides a dedicated, private connection to your cloud data centers. The reasoning behind choosing between these options centers on reliability, latency, and bandwidth requirements. VPNs are often used for quick setup and low-to-medium throughput scenarios, while ExpressRoute is chosen for mission-critical applications that demand consistent performance and enhanced security. By extending your corporate network into the cloud, you can seamlessly migrate applications or maintain a hybrid state where data remains on-premises while compute lives in the cloud. This architecture allows you to leverage the scale of the cloud without abandoning your existing hardware investments, creating a cohesive and manageable ecosystem.

# Defining a Site-to-Site VPN gateway configuration
{
  "name": "VirtualNetworkGateway",
  "properties": {
    "gatewayType": "Vpn",
    "vpnType": "RouteBased",
    "sku": {"name": "VpnGw1"}, // Determines throughput capability
    "enableBgp": false
  }
}

Service Integration and DNS

Effective cloud integration relies on consistent service discovery and resource naming. Azure DNS provides a managed service that translates human-readable domain names into IP addresses, ensuring that your applications can find each other reliably across the network. Private DNS Zones take this a step further by allowing you to resolve hostnames within your Virtual Network without exposing those records to the public internet. Integration is fundamentally about reducing friction between components; when your resources can discover each other through consistent DNS names rather than hardcoded IP addresses, your entire architecture becomes more resilient to infrastructure changes. By layering these services with API Management or service endpoints, you ensure that inter-service communication is performant, secure, and easy to maintain. This approach creates a clean abstraction layer, allowing developers to focus on feature development while the underlying network topology manages the complexities of connection and discovery.

# Creating a private DNS A record for a database
{
  "name": "db-prod-01",
  "properties": {
    "ttl": 3600,
    "aRecords": [
      {"ipv4Address": "10.0.2.5"} // Internal IP of the database
    ]
  }
}

Interview questions

All Mcp interview questions →

Check yourself

Take the full Mcp quiz →