Before Lab 2.1 — Public, Internal and Private Services

In Lab 2.1, you will map the exposure of every component in the Day 2 environment.

The core concept is reachability — not every service should be reachable from the public internet.

---

Four zones of exposure

Zone	Description	Example
Public	Reachable from anywhere on the internet	Frontend, public API
Semi-public	Reachable from the internet, but restricted	API with IP allowlist or auth
Internal	Should only be reachable within the cloud environment	Internal service, microservice
Private	Not reachable from the internet at all	Database, secret store

Cloud services are public by default. Naming a service "internal" or "backend" does not make it private — only explicit configuration does.

---

The Day 2 starting architecture

The top two components are expected to be public. The bottom two are problems.

Starting Resources

Things have changed, as we now have a number of additional resources, when it's time each one will be explained.

Figuur 0: Day 2 resource group in the Azure Portal — all four components visible

---

What to look for in Lab 2.1

Lab 2.1 checklist

• I can reach the public API from my browser or curl
• I can reach the internal backend directly from outside
• I can reach the Storage Account from my browser with a SAS token
• I have classified each component: public, internal, or private
• My worksheet table is filled in with URLs, reachability results, and classifications

Lab focus

In Lab 2.1, do not fix anything yet.

Your goal is to observe, document and explain.

Lab File

Download Lab