FDE Interview Prep Capstone

11.1 · Whiteboard scenarios — trace the packet, name the control

The classic senior-interview / security-workshop exercise: design a secure deployment and walk a query from the analyst's browser to data in ADLS, naming the control at every hop. Switch the diagram between the regulated bank (classic), healthcare (serverless-first), and the cost-conscious DEP walk-throughs; click any box for the "what + why."

The controls, hop by hop (the whiteboard narration)

Illustrative config — the foundation (VNet injection + SCC + isolation)

Terraform (azurerm). Full multi-file IaC (PEs, DNS, firewall) is the Stage 3–8 hands-on artifact.

resource "azurerm_databricks_workspace" "bank" {
  sku                                   = "premium"               # PL/CMK/UC binding need Premium
  public_network_access_enabled         = false                   # "complete private isolation"
  network_security_group_rules_required = "NoAzureDatabricksRules" # back-end PL: managed public rules off
  custom_parameters {
    no_public_ip        = true                                    # SCC / NPIP
    virtual_network_id  = azurerm_virtual_network.spoke.id
    public_subnet_name  = azurerm_subnet.host.name                # "host" subnet
    private_subnet_name = azurerm_subnet.container.name           # "container" subnet
  }
}

Portal: Create → Networking → No Public IP = Yes, Deploy in your VNet = Yes, Required NSG rules = NoAzureDatabricksRules, Public network access = Disabled → add the back-end/front-end databricks_ui_api PEs + one browser_authentication PE → verify privatelink.azuredatabricks.net A-records.

11.2 · Rapid-fire Q&A — which control on which path, and what it costs

Crisp model answers that survive the follow-up probe. Switch the diagram between the three paths — the highlighted arrow is the active path; click a box for the one-line answer and the load-bearing fact (port, limit, direction).

The probes everyone asks (one-liner + the fact that's graded)

Illustrative config — an NCC private endpoint rule (serverless → ADLS)

# Account-level, regional. Storage owner APPROVES in the portal: PENDING -> ESTABLISHED.
databricks account network-connectivity create-private-endpoint-rule "$NCC_ID" --json '{
  "resource_id": "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<acct>",
  "group_id": "dfs"
}'
# Then attach the NCC to the workspace, set storage Public network access = Disabled, restart serverless.

11.3 · Defending trade-offs & cost — be a doctor, not a salesman

Every control must trace to a driver; no driver → over-build. Switch the diagram between the cheaper baseline and the hardened / mandated design — the labels carry the rough Azure cost on each control. Click any box for the driver and the price.

Anchor each control to a driver

Illustrative config — prove cost with the billing system table (SQL)

-- Show a customer their ACTUAL serverless networking spend, not a guess.
SELECT u.usage_date, u.sku_name,
       SUM(u.usage_quantity)                     AS qty,
       SUM(u.usage_quantity * p.pricing.default) AS approx_usd
FROM system.billing.usage u
JOIN system.billing.list_prices p
  ON u.sku_name = p.sku_name
 AND u.usage_end_time BETWEEN p.price_start_time AND COALESCE(p.price_end_time, current_timestamp())
WHERE u.sku_name ILIKE '%NETWORK%'                -- networking-related SKUs
  AND u.usage_date >= current_date() - INTERVAL 30 DAYS
GROUP BY u.usage_date, u.sku_name ORDER BY u.usage_date DESC;

Who pays: classic = you pay Azure directly; serverless = Databricks meters it and passes it through (billing system table). Serverless Private Connectivity /GB is waived until further notice; the /hour endpoint fee still bills.

Decision guide — what an architect recommends

Customer Q&A — what the security & FinOps teams actually ask

Common asks & the answer

What breaks in the field — and the FIRST check

Three questions to ask before recommending an architecture

1. Is there a regulatory mandate for no public-IP hop, or is backbone-private enough?
2. Full network-path control (custom firewall, UDR, DEP), or is speed/low-ops the priority?
3. Where will governed data live — and are you on Premium?