Synthesis, Best Practices & Interview Prep

9.1 · Reference architectures end-to-end

Four blueprints an Azure Databricks SA draws from memory. Switch the diagram between them — the same three doors, hardened differently — and click any box for the "what + why." IP sizing shows the node-count math.

Walk a packet (full-DEP) — name the control, and why it breaks without it

Illustrative config — the load-bearing lines

Terraform — VNet injection + SCC, sized for peak. Full module is the optional Stage 9 hands-on artifact.

resource "azurerm_virtual_network" "ws" {
  address_space = ["10.50.0.0/16"]                    # /16: room for big subnets + PE subnets
}
resource "azurerm_subnet" "container" {               # "private" subnet — private under SCC
  address_prefixes = ["10.50.4.0/22"]                 # /22 -> ~1,019 nodes peak; immutable later
  delegation { name = "dbx"; service_delegation { name = "Microsoft.Databricks/workspaces" } }
}
resource "azurerm_databricks_workspace" "this" {
  sku                                   = "premium"   # Private Link / CMK / CSP require Premium
  public_network_access_enabled         = false       # full-private (DEP); true for hybrid Standard
  network_security_group_rules_required = "NoAzureDatabricksRules"   # required with back-end PL
  custom_parameters { no_public_ip = true }           # SCC / No Public IP
}

Portal: Create → Azure Databricks → Networking → No Public IP = Yes, Deploy in your own VNet = Yes, Public Network Access Disabled (DEP), Required NSG Rules = NoAzureDatabricksRules.

9.2 · Networking & security best-practices checklist

The pre-flight checklist laid over the three doors. For each door, ask: what's the floor, and what do I add only when a mandate pays for it? Toggle the diagram between the floor (free, always-on) and the mandated upgrades; click any box for the "what + why."

Non-negotiable vs "only when mandated"

Illustrative config — the items unique to this synthesis lesson

# Item 4.3 — IP access list (enforcement must be ON, else stored-but-not-applied)
resource "databricks_workspace_conf" "this" {
  custom_config = { "enableIpAccessLists" = "true" }   # turn the feature ON
}
resource "databricks_ip_access_list" "allow_corp" {
  list_type    = "ALLOW"                                # an ALLOW list flips to default-deny
  ip_addresses = ["203.0.113.0/24"]                     # block lists win, evaluated first
}
# Item 5.2 — cluster policy: block legacy "No Isolation Shared"
#   data_security_mode allowlist: ["USER_ISOLATION","SINGLE_USER"]  # UC-compliant modes only

-- Item 6.1 — who changed permissions / failed to log in (Public Preview table; verify)
SELECT event_time, user_identity.email, action_name, source_ip_address
FROM system.access.audit
WHERE event_date >= current_date() - INTERVAL 7 DAYS
  AND (action_name ILIKE '%Permission%' OR action_name ILIKE '%login%');

Portal: IP access lists = Account Console → Settings → Security → IP access lists; MFA is enforced in Entra ID Conditional Access (not a Databricks toggle).

9.3 · Customer-conversation & interview scenarios

The five whiteboard answers an SA gives cold. Switch the diagram between scenarios — each highlights the door(s) in play and the control that locks it. The golden rule for all five: trace the packet, name the control at each hop, state the trade-off, and know what breaks.

Service Endpoint vs Private Endpoint (Scenario 2)

Config proof — serverless private ADLS via NCC (Scenario 4)

# Databricks CLI (account admin). dfs = ADLS data; blob = model artifacts (you may need both).
databricks account network-connectivity create-network-connectivity-configuration \
  --json '{"name":"ncc-eastus","region":"eastus"}'
databricks account network-connectivity create-private-endpoint-rule <NCC_ID> \
  --json '{"resource_id":".../storageAccounts/<ADLS>","group_id":"dfs"}'
# -> APPROVE on the storage account: Portal -> Storage -> Networking -> Private endpoint connections.
#    Rule status: PENDING -> ESTABLISHED.  Quotas: 10 NCCs/region, 100 PEs/region, 50 workspaces/NCC.

Decision guide — which blueprint, which controls

Customer Q&A — what the security team actually asks

Common asks & the answer

What breaks in the field — and the FIRST check

Three questions to ask before recommending an architecture

1. Is there a regulatory mandate for no public-IP hop / no public egress, or is backbone-private enough?
2. Multi-workspace production (Standard), non-prod single-team (Simplified), or regulated PII (full DEP)?
3. Where will governed data live, are you on Premium, and have you sized subnets for peak (CIDR is immutable)?