VNets — Portfolio Projects
Build these projects to demonstrate real skills to employers. Each project is designed to be interview-worthy — something you can walk through in detail.
Project 1: Segmented 3-Tier Network with NSGs and ASGs
Level: Beginner | Time: 2 days
Build a single VNet with web, app, and database subnets, and lock down traffic between tiers using NSGs and Application Security Groups instead of hand-maintained IP lists.
Steps
10.0.0.0/16), three subnets (web, app, db), each roughly /24
web)
web-asg, app-asg, db-asg) and add each VM's NIC to its tier's ASG
web-nsg allows 443 from Internet; app-nsg allows its app port only from web-asg; db-nsg allows its DB port only from app-asg
DenyAllInbound rule blocks everything else, then verify with az network nic show-effective-nsg on the db VM's NIC that only the app-asg rule is in effect
web VM to the db VM's port and confirm it's blocked — only app can reach db
Skills Demonstrated
GitHub Repo Name
azure-vnets-segmented-3tier
---
Project 2: Hub-Spoke Topology with Centralized Egress Firewall
Level: Intermediate | Time: 3 days
Build a hub VNet containing Azure Firewall and two spoke VNets peered to the hub, with all spoke egress traffic forced through the firewall via user-defined routes — the pattern most enterprise Azure landing zones use.
Steps
AzureFirewallSubnet (minimum /26) and deploy Azure Firewall with a Firewall Policy
spoke-a, spoke-b), each with a workload subnet, and peer both to the hub (remember: peering is not transitive, and each direction needs its own peering resource)
0.0.0.0/0 route pointing to the firewall's private IP as VirtualAppliance next hop, and associate it with the subnet
*.ubuntu.com for updates), deny everything else by default
spoke-a, confirm outbound HTTPS to an allowed FQDN works and outbound to a non-allowed destination is blocked, then check the traffic showed up in Firewall logs
spoke-a cannot reach spoke-b directly (spokes aren't peered to each other) — only through routes you explicitly add via the hub, if you choose to allow it
Skills Demonstrated
GitHub Repo Name
azure-vnets-hub-spoke-firewall
---
Project 3: Private Endpoint Architecture for PaaS Isolation
Level: Advanced | Time: 4 days
Take a Storage Account and an Azure SQL Database that are normally reachable over the public internet and put both fully behind Private Endpoints, with Private DNS Zones resolving their hostnames to VNet-private IPs — no public network access at all.
Steps
group-id blob) and one for the SQL server, both landing in that subnet
privatelink.blob.core.windows.net, privatelink.database.windows.net), link each to the VNet, and confirm the DNS records were auto-registered when the private endpoints were created
Skills Demonstrated
GitHub Repo Name
azure-vnets-private-endpoint-isolation
---
Tips for Great Projects
Make it real. Solve an actual problem, even a small one. A hub-spoke network where you actually confirmed traffic is forced through the firewall is more impressive than a tutorial clone.
Document everything. A repo with a great README beats one with better code but no explanation. Include: what it does, why you built it, how to run it, what you learned.
Show your thinking. In interviews, you'll be asked: "Why did you choose X over Y?" Have a reason. Architecture decisions matter.
Iterate publicly. Make commits regularly. Employers look at commit history. 10 commits over a week shows real work; 1 commit with everything shows you copied it.