Skip to content
Microsoft Azure
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Microsoft Azure Interview Questions & Answers

All 200 unique questions in one place — 59 easy, 95 medium, 46 hard — grouped by topic.

Practise by topic

Azure Fundamentals · 25Azure Compute · 25Azure Storage · 25Azure Networking · 25Identity and Security · 25Azure Databases · 25DevOps and Infrastructure as Code · 25Monitoring, Cost and Governance · 25

Practise the way your interview works

Company-wise Microsoft Azure questionsExperience-wise Microsoft Azure questionsRole-wise Microsoft Azure questionsCity-wise Microsoft Azure questionsMost asked Microsoft Azure questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsMicrosoft Azure mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsMicrosoft Azure topic sheets
Solved overallStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is Microsoft Azure and which service models does it offer?

Azure FundamentalsEasy
Save to ▾
Show answer
Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.
02

Explain the hierarchy of management groups, subscriptions, resource groups and resources.

Azure FundamentalsEasy
Save to ▾
Show answer
A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.
03

What is a resource group and what rules apply to it?

Azure FundamentalsEasy
Save to ▾
Show answer
A resource group is a logical container for resources that share a lifecycle, for example everything for one app environment. A resource belongs to exactly one group, groups cannot be nested, and deleting a group deletes everything inside it. The group has a location that stores metadata, but resources inside can live in other regions. Resources can be moved between groups for most resource types.
04

What is Azure Resource Manager (ARM)?

Azure FundamentalsEasy
Save to ▾
Show answer
ARM is the deployment and management layer of Azure. Every request from the portal, CLI, PowerShell, SDKs or Bicep goes through the ARM API, which authenticates the caller, checks RBAC and Policy, and forwards the call to the resource provider. Because all tools hit the same API, you get consistent results, tagging, locks and activity logs no matter how the change was made.
05

What are regions, region pairs and availability zones?

Azure FundamentalsEasy
Save to ▾
Show answer
A region is a set of datacenters in one geography, such as Central India in Pune. Availability zones are physically separate datacenter groups inside a region with independent power, cooling and network; supported regions have three. Many regions are paired with another region in the same geography for platform updates and geo-replication. Use zones for datacenter failure and a second region for regional disasters.
06

Name the Azure regions available in India.

Azure FundamentalsEasy
Save to ▾
Show answer
Microsoft runs Central India (Pune), South India (Chennai) and West India (Mumbai) as public regions, plus Jio India West and Jio India Central for specific customers. Central India supports availability zones. Indian companies pick these regions for low latency and for data residency needs such as RBI guidelines on payment data, often pairing Central India with South India for disaster recovery.
07

What is the shared responsibility model in Azure?

Azure FundamentalsEasy
Save to ▾
Show answer
Security duties are split between Microsoft and the customer. Microsoft always owns physical datacenters, hosts and the network fabric. The customer always owns data, identities, accounts and devices. The middle layers move with the service model: in IaaS you patch the OS and configure firewalls; in PaaS Microsoft patches the OS and runtime; in SaaS you mainly manage users and data.
08

What are resource locks and when would you use them?

Azure FundamentalsEasy
Save to ▾
Show answer
Locks protect resources from accidental change. CanNotDelete allows reads and updates but blocks deletion; ReadOnly allows only reads, which can break operations like listing storage keys. Locks apply to a subscription, group or resource and are inherited. Teams put CanNotDelete on production resource groups, DNS zones and ExpressRoute circuits. Only Owner or User Access Administrator roles can remove locks by default.
09

What are tags and how are they used in real projects?

Azure FundamentalsEasy
Save to ▾
Show answer
Tags are name-value pairs such as env=prod, owner=payments, costcenter=CC101 applied to resources, groups and subscriptions. They help filter cost reports, automate shutdown scripts and track ownership. Tags are not inherited by default, so teams use Azure Policy with modify or append effects to inherit tags from the resource group or require them at creation. A resource can carry up to 50 tags.
10

What is the difference between CapEx and OpEx, and how does Azure change it?

Azure FundamentalsEasy
Save to ▾
Show answer
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
11

How do you create a resource group and list resources using Azure CLI?

Azure FundamentalsEasy
Save to ▾
Show answer
Log in, select the subscription, create the group with tags, then list its resources in a table: az login az account set --subscription 'Prod-Sub' az group create --name rg-shop-prod --location centralindia --tags env=prod owner=shop az resource list --resource-group rg-shop-prod --output table The --query flag with JMESPath filters output, for example --query '[].name'.
12

Tell me about a time you learned a new Azure service quickly to deliver a task.

Azure FundamentalsEasy
Save to ▾
Show answer
Situation: our team needed event-driven processing and nobody had used Azure Functions. Task: I had one week to build a proof of concept. Action: I completed the Microsoft Learn module, built a blob-triggered function in a sandbox subscription, added Application Insights and shared a short demo and runbook. Result: the POC was approved, went live in three weeks and replaced a polling VM, cutting cost noticeably.
13

Why do you want to build a career in Microsoft Azure?

Azure FundamentalsEasy
Save to ▾
Show answer
Situation: during my internship I saw most clients running Microsoft workloads like Windows Server, SQL Server and Active Directory. Task: I wanted skills that match that demand. Action: I cleared AZ-900, then studied AZ-104 and built labs with VNets, App Service and Bicep. Result: I can now deploy and troubleshoot real environments, and I want to grow toward an Azure architect role over the next few years.
14

How do Azure SLAs work and how do you calculate a composite SLA?

Azure FundamentalsMedium
Save to ▾
Show answer
An SLA is Microsoft's uptime commitment per service, with service credits if it is missed. When services depend on each other in series, multiply their SLAs. An App Service at 99.95% calling Azure SQL at 99.99% gives about 0.9995 x 0.9999 = 99.94%. Adding redundancy, such as a second region behind Front Door, raises the combined figure because both paths must fail together.
15

Your VMs run 24x7, but their sizes and regions change every few months. Would you buy reservations or a savings plan?

Azure FundamentalsMedium
Save to ▾
Show answer
Reservations give a big discount, up to about 72% versus pay-as-you-go, when you commit to a specific VM family, region and term of one or three years. Savings plans commit to a fixed hourly spend for one or three years and apply flexibly across VM sizes, regions, App Service and Functions Premium. Use reservations for very stable workloads and savings plans when your sizes or regions change.
16

What is Azure Arc?

Azure FundamentalsMedium
Save to ▾
Show answer
Azure Arc extends the Azure control plane to servers, Kubernetes clusters and data services running on-premises or in other clouds. Once connected, those machines appear as Azure resources, so you can apply Azure Policy, RBAC, tags, Defender for Cloud, Update Manager and monitoring to them. It suits hybrid companies that keep some servers in their own datacenter but want one governance model.
17

Write an Azure PowerShell command to find all VMs without an env tag.

Azure FundamentalsMedium
Save to ▾
Show answer
Filter Get-AzVM output on the Tags hashtable and export the result for review: Connect-AzAccount Get-AzVM | Where-Object { -not $_.Tags -or -not $_.Tags.ContainsKey('env') } | Select-Object Name, ResourceGroupName, Location | Export-Csv untagged-vms.csv -NoTypeInformation For large estates, Azure Resource Graph queries are faster across many subscriptions.
18

A team accidentally deleted a production resource group. How do you prevent this in future?

Azure FundamentalsMedium
Save to ▾
Show answer
First recover what is possible: soft delete or backups for storage, Key Vault, SQL and VMs. Then add CanNotDelete locks on production groups, remove Owner and Contributor rights from individual users, and grant access through Entra groups with Privileged Identity Management for just-in-time elevation. Deploy infrastructure through pipelines only, and set activity log alerts on delete operations so the team is notified instantly.
19

Your manager asks you to estimate the monthly cost of a new Azure application. How do you do it?

Azure FundamentalsMedium
Save to ▾
Show answer
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
20

Explain the 5 Rs (or 6 Rs) of cloud migration in an Azure context.

Azure FundamentalsMedium
Save to ▾
Show answer
Rehost moves VMs as-is using Azure Migrate. Refactor makes small changes, such as moving a web app to App Service. Rearchitect changes the design, for example splitting into microservices on AKS. Rebuild rewrites as cloud-native. Replace swaps the app for SaaS. Some lists add Retire or Retain. Azure Migrate assessments help choose per workload based on dependencies, cost and readiness.
21

What is the Azure Well-Architected Framework?

Azure FundamentalsMedium
Save to ▾
Show answer
It is Microsoft's guidance for building quality workloads, organised into five pillars: reliability, security, cost optimization, operational excellence and performance efficiency. Each pillar has design principles, checklists and trade-offs. Azure Advisor and the Well-Architected Review tool score workloads against it. In design interviews, structure answers by pillar to show you considered failure, security and cost, not only features.
22

How do you handle a situation where a cloud bill suddenly doubled?

Azure FundamentalsMedium
Save to ▾
Show answer
Situation: our monthly Azure bill jumped from about 6 lakh to 12 lakh rupees. Task: find the cause within two days. Action: I used Cost Analysis grouped by resource and meter, found a Log Analytics workspace ingesting verbose debug logs and forgotten premium disks from a test. I fixed log levels, set a daily cap, deleted orphans and added budgets with alerts. Result: costs returned to normal the next month.
23

How would you set up a landing zone for a company moving to Azure?

Azure FundamentalsHard
Save to ▾
Show answer
Follow the Cloud Adoption Framework landing zone design. Create a management group hierarchy (platform, landing zones, sandbox, decommissioned), separate subscriptions for identity, management and connectivity, and a hub-spoke or Virtual WAN network. Apply Azure Policy for allowed regions, tagging and diagnostics, and assign RBAC through Entra groups. Deploy it all as code with Bicep or Terraform so new app subscriptions can be vended consistently.
24

How do you decide between IaaS and PaaS for migrating an on-premises application?

Azure FundamentalsHard
Save to ▾
Show answer
Start with constraints. If the app needs OS-level access, custom drivers or legacy software, a lift-and-shift to VMs is fastest. If it is a standard .NET, Java or Node web app with SQL Server, App Service plus Azure SQL removes patching and gives built-in scaling. Many teams lift and shift first to meet a datacenter exit date, then modernise to PaaS in a later phase.
25

How do you design an Azure subscription strategy for a large enterprise with many business units?

Azure FundamentalsHard
Save to ▾
Show answer
Use management groups that mirror governance needs rather than the org chart, for example Platform, Corp landing zones, Online landing zones and Sandbox. Give each application or business unit its own subscriptions per environment to isolate quotas, cost and blast radius. Automate subscription vending with pre-wired networking, policy and RBAC. Keep the hierarchy shallow, ideally three or four levels, to avoid policy confusion.
26

What compute options does Azure offer and when do you choose each?

Azure ComputeEasy
Save to ▾
Show answer
Virtual Machines give full OS control for legacy or custom software. Virtual Machine Scale Sets add autoscaling of identical VMs. App Service hosts web apps and APIs as PaaS. Azure Functions runs event-driven code serverlessly. AKS runs Kubernetes for container microservices, and Container Apps runs containers without managing Kubernetes. Batch handles large parallel jobs. Choose based on control needed, scaling pattern and team skills.
27

Explain Azure VM series and how you pick a size.

Azure ComputeEasy
Save to ▾
Show answer
Series are optimised for workload type: B for burstable low-cost, D for general purpose, E for memory heavy like SQL Server, F for compute intensive, L for storage throughput, N for GPU and M for very large memory such as SAP HANA. Start from CPU, memory, disk IOPS and network needs, test with real load, then right-size using Azure Advisor recommendations after a few weeks of metrics.
28

What are Spot VMs and where should you use them?

Azure ComputeEasy
Save to ▾
Show answer
Spot VMs use spare Azure capacity at discounts that can reach about 90%, but Azure can evict them with 30 seconds notice when it needs capacity or the price passes your limit. Use them for interruptible work such as batch rendering, CI build agents, test environments and big data jobs with checkpointing. Never use them for stateful production databases or anything that cannot tolerate sudden loss.
29

What is Azure App Service and what does an App Service plan define?

Azure ComputeEasy
Save to ▾
Show answer
App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.
30

What are triggers and bindings in Azure Functions?

Azure ComputeEasy
Save to ▾
Show answer
A trigger is what starts a function, and each function has exactly one: HTTP, Timer, Blob, Queue, Service Bus, Event Grid, Event Hubs or Cosmos DB change feed. Bindings declaratively connect inputs and outputs, for example reading a blob and writing to a queue without writing SDK code. They reduce boilerplate, but for complex error handling or batching you may still use the SDK directly.
31

What is Azure Bastion?

Azure ComputeEasy
Save to ▾
Show answer
Azure Bastion is a managed PaaS service that gives RDP and SSH access to VMs through the browser or native client over TLS, without giving the VMs public IPs. It is deployed into a dedicated subnet named AzureBastionSubnet in the VNet. This removes exposed ports 3389 and 22 from the internet, a common attack path. Pair it with just-in-time access from Defender for Cloud for tighter control.
32

What is the difference between an availability set and an availability zone?

Azure ComputeMedium
Save to ▾
Show answer
An availability set spreads VMs across fault domains (separate racks, power and switches) and update domains (rebooted at different times) inside one datacenter, giving a 99.95% SLA. Availability zones place VMs in physically separate datacenters within a region, giving 99.99%. Zones protect against a full datacenter outage; availability sets only protect against rack and maintenance failures. New designs prefer zones where the region supports them.
33

What are Virtual Machine Scale Sets and their orchestration modes?

Azure ComputeMedium
Save to ▾
Show answer
VMSS manages a group of load-balanced VMs that scale in or out automatically on metrics or schedules. Flexible orchestration, now the default, lets you mix VM sizes, spread across zones and fault domains, and manage instances like normal VMs. Uniform mode uses identical instances from one model and is optimised for large stateless fleets. Use VMSS for stateless web tiers, batch workers and custom container hosts.
34

What are deployment slots in App Service?

Azure ComputeMedium
Save to ▾
Show answer
Slots are live copies of an app with their own hostname, available from the Standard tier. You deploy to a staging slot, warm it up and test, then swap it with production. The swap redirects traffic with near-zero downtime and can be reversed by swapping back. Slot-specific settings, such as a staging database connection string, stay with the slot instead of moving during the swap.
35

Explain Azure Functions hosting plans.

Azure ComputeMedium
Save to ▾
Show answer
Flex Consumption is the recommended serverless plan: it scales to zero, bills per execution and memory, supports VNet integration and always-ready instances. The older Consumption plan scales to zero with a default 5-minute timeout. Premium keeps pre-warmed instances to avoid cold starts and supports long runs. Dedicated runs on an App Service plan. Container Apps hosting runs functions as containers. Choose by cold start tolerance, networking and run duration.
36

What is Azure Kubernetes Service (AKS) and what does Azure manage for you?

Azure ComputeMedium
Save to ▾
Show answer
AKS is managed Kubernetes. Azure runs the control plane, including the API server and etcd, and handles upgrades and its availability. You manage node pools, which are VM scale sets, plus workloads, networking choices and add-ons. AKS integrates with Entra ID for cluster login, Azure CNI for pod networking, ACR for images, Key Vault via CSI driver and Azure Monitor Container Insights for logs and metrics.
37

Tell me about a time you led a migration of workloads to Azure.

Azure ComputeMedium
Save to ▾
Show answer
Situation: our company had to exit a leased datacenter in nine months with 120 VMs. Task: lead the compute migration. Action: I ran Azure Migrate assessments, grouped VMs by dependency into waves, rehosted most with Azure Migrate and moved web apps to App Service, with rollback plans for each wave. Result: we finished a month early and cut monthly run cost by about 25% after right-sizing.
38

Create a Linux VM with Azure CLI using SSH keys and no public IP.

Azure ComputeMedium
Save to ▾
Show answer
Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion: az vm create \ --resource-group rg-app-dev \ --name vm-api-01 \ --image Ubuntu2204 \ --size Standard_D2s_v5 \ --vnet-name vnet-dev --subnet snet-app \ --public-ip-address '' \ --admin-username azureuser \ --generate-ssh-keys \ --zone 1
39

Write a simple HTTP-triggered Azure Function in Python (v2 programming model).

Azure ComputeMedium
Save to ▾
Show answer
The v2 model uses decorators in function_app.py, so no function.json is needed: import azure.functions as func app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION) @app.route(route='hello', methods=['GET']) def hello(req: func.HttpRequest) -> func.HttpResponse: name = req.params.get('name', 'world') return func.HttpResponse(f'Hello, {name}', status_code=200) Callers pass the function key in the code query parameter or x-functions-key header.
40

How do you configure autoscale for an App Service plan?

Azure ComputeMedium
Save to ▾
Show answer
In the plan's Scale out settings, choose rules-based autoscale or automatic scaling. A typical rule set: scale out by 1 instance when average CPU exceeds 70% for 10 minutes, scale in by 1 when below 30% for 10 minutes, minimum 2 and maximum 10 instances. Always pair scale-out with a scale-in rule and a cool-down period so the plan does not flap between sizes.
41

Users report the website on App Service is slow every morning at 9 AM. How do you investigate?

Azure ComputeMedium
Save to ▾
Show answer
Check Application Insights for response times, failed requests and dependency calls around 9 AM, and App Service plan metrics for CPU, memory and instance count. A morning spike often means traffic surge with autoscale reacting too slowly, cold start after idle, or a slow SQL query under load. Fixes include scheduled scale-out before 9 AM, Always On, a higher tier, caching with Redis or query tuning.
42

Your Azure Function has slow first responses after idle periods. What can you do?

Azure ComputeMedium
Save to ▾
Show answer
That is cold start: the plan scaled to zero and must load a new instance. Options are moving to Flex Consumption with always-ready instances or the Premium plan with pre-warmed instances, reducing package size and dependencies, and choosing a faster-starting runtime. A timer ping is a hack that is not reliable. For strict latency APIs, a dedicated plan or Container Apps with minimum replicas is better.
43

A VM is not reachable over RDP. Walk through your troubleshooting.

Azure ComputeMedium
Save to ▾
Show answer
Check the VM is running and passed boot diagnostics via the serial console or screenshot. Use Network Watcher IP flow verify and effective security rules to see if an NSG blocks port 3389. Check the route table, any firewall and whether the VM has a public IP or you should use Bastion. Inside the OS, use Run Command to check the RDP service and Windows firewall. Reset the configuration if needed.
44

Describe a production incident you handled and what you learned.

Azure ComputeMedium
Save to ▾
Show answer
Situation: an App Service API began returning 502 errors during peak hours. Task: restore service and find the root cause. Action: I scaled out to stop impact, then found in Application Insights that outbound SQL connections were exhausting SNAT ports. I added connection pooling and VNet integration with a NAT gateway. Result: errors stopped, and I wrote a postmortem and added a SNAT alert.
45

What is Durable Functions and what patterns does it support?

Azure ComputeHard
Save to ▾
Show answer
Durable Functions is an extension that lets you write stateful workflows in code. An orchestrator function calls activity functions, and the framework checkpoints state to storage so it survives restarts. Patterns include function chaining, fan-out/fan-in, async HTTP APIs with status polling, monitors and human interaction with timeouts. Orchestrator code must be deterministic, so avoid DateTime.Now or random values inside it.
46

Your team of four engineers must run 12 containerised microservices. Would you choose AKS or Azure Container Apps?

Azure ComputeHard
Save to ▾
Show answer
AKS gives full Kubernetes: custom operators, service meshes, node pool control and any Helm chart, but you own upgrades and cluster operations. Container Apps is serverless containers built on Kubernetes, KEDA and Envoy, with scale to zero, revisions, traffic splitting and Dapr, without exposing the Kubernetes API. Pick Container Apps for microservices and APIs with a small ops team, and AKS when you need deep platform control.
47

Write the commands to create an AKS cluster with a system and a user node pool.

Azure ComputeHard
Save to ▾
Show answer
Create the cluster with Azure CNI overlay and the system pool across zones, then add a user pool for apps: az aks create -g rg-aks-prod -n aks-prod \ --network-plugin azure --network-plugin-mode overlay \ --nodepool-name system --node-count 3 --zones 1 2 3 \ --enable-managed-identity --attach-acr acrshopprod \ --generate-ssh-keys az aks nodepool add -g rg-aks-prod --cluster-name aks-prod \ -n apps --mode User --node-count 3 --zones 1 2 3 \ --enable-cluster-autoscaler --min-count 3 --max-count 10
48

You need to run a nightly 3-hour data processing job cheaply. Which compute would you choose?

Azure ComputeHard
Save to ▾
Show answer
Avoid the old Consumption plan because of its execution timeout. Good options are Azure Batch or a VM Scale Set using Spot VMs with checkpointing, Container Apps jobs that run on a schedule and stop afterwards, or Durable Functions breaking work into short activities. The key is paying only while the job runs and tolerating restarts. Store input and output in Blob Storage so any worker can resume.
49

Design a highly available web tier for an e-commerce site during a festival sale.

Azure ComputeHard
Save to ▾
Show answer
Run the app on App Service Premium v3 or a VM Scale Set spread across three availability zones in Central India. Put Azure Front Door in front for global load balancing, WAF and caching of static content, with a secondary region on standby. Pre-scale before the sale using scheduled rules, add Redis for sessions and catalogue caching, and load test with Azure Load Testing beforehand.
50

How would you upgrade an AKS cluster in production with minimal downtime?

Azure ComputeHard
Save to ▾
Show answer
Check the release notes and API deprecations, then upgrade a non-prod cluster first. Set Pod Disruption Budgets and multiple replicas so draining is safe. Upgrade the control plane, then node pools one at a time using max surge so new nodes join before old ones drain. Use planned maintenance windows and auto-upgrade channels for patches. For major risk, run a blue-green cluster and switch traffic.
51

What services does an Azure Storage account provide?

Azure StorageEasy
Save to ▾
Show answer
A general-purpose v2 storage account offers Blob Storage for objects, Azure Files for SMB and NFS file shares, Queue Storage for simple messaging and Table Storage for key-value NoSQL data. Data Lake Storage Gen2 is Blob Storage with hierarchical namespace enabled for analytics. Each account has a globally unique name that forms endpoints like name.blob.core.windows.net, and settings such as redundancy and network rules apply account-wide.
52

Explain the storage redundancy options LRS, ZRS, GRS and GZRS.

Azure StorageEasy
Save to ▾
Show answer
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
53

What are the Blob Storage access tiers?

Azure StorageEasy
Save to ▾
Show answer
Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.
54

Describe a time you had to choose between speed of delivery and data safety.

Azure StorageEasy
Save to ▾
Show answer
Situation: a release deadline pushed us to skip enabling backups and soft delete on a new storage account. Task: deliver on time without risking customer files. Action: I explained to the lead that enabling soft delete, versioning and a backup policy took under an hour through our Bicep module, and added it to the same pull request. Result: we shipped on time, and a month later versioning saved a file a user overwrote.
55

What is a lifecycle management policy?

Azure StorageEasy
Save to ▾
Show answer
A lifecycle policy is a rule set on a storage account that automatically moves or deletes blobs based on age, last access or last modified time. For example, move logs to Cool after 30 days, to Archive after 90 days and delete after 365 days. It runs once a day and removes the need for custom cleanup scripts, which saves real money on large log or backup containers.
56

Upload a folder to Blob Storage with AzCopy using Entra ID login.

Azure StorageEasy
Save to ▾
Show answer
Log in with AzCopy and copy recursively; the user needs the Storage Blob Data Contributor role: azcopy login --tenant-id <tenant-guid> azcopy copy './reports' \ 'https://stshopprod.blob.core.windows.net/reports' \ --recursive --overwrite ifSourceNewer AzCopy runs transfers in parallel and can resume failed jobs with azcopy jobs resume.
57

Tell me about a time you reduced cloud storage cost.

Azure StorageEasy
Save to ▾
Show answer
Situation: our analytics team kept every raw file in the Hot tier with GRS, costing about 3 lakh rupees a month. Task: reduce cost without breaking reports. Action: I analysed access logs, moved files older than 60 days to Cool and older than a year to Archive with lifecycle rules, and switched scratch containers to LRS. Result: storage cost fell by around 45% with no complaints from users.
58

How do you explain a technical storage decision to a non-technical stakeholder?

Azure StorageEasy
Save to ▾
Show answer
Situation: finance asked why we needed GZRS instead of cheaper LRS. Task: justify the cost clearly. Action: I compared the options in business terms: LRS survives a disk failure, GZRS survives losing a whole region, and I showed the cost of downtime per hour for our app versus the extra monthly charge. Result: they approved GZRS only for critical data and LRS for the rest.
59

What is a Shared Access Signature (SAS) and what types exist?

Azure StorageMedium
Save to ▾
Show answer
A SAS is a signed URL token granting limited access to storage for a set time and permissions, such as read-only for one blob for one hour. A user delegation SAS is signed with Entra ID credentials and is the most secure. A service SAS and an account SAS are signed with the account key. Always use HTTPS, short expiry and stored access policies so tokens can be revoked.
60

How do you secure access to a storage account?

Azure StorageMedium
Save to ▾
Show answer
Disable shared key access where possible and use Entra ID with RBAC roles like Storage Blob Data Reader. Use managed identities for apps. Disable public blob access, require TLS 1.2, restrict the firewall to selected VNets, or use private endpoints and disable public network access. Enable soft delete, versioning and Defender for Storage, and keep keys, if any, in Key Vault with rotation.
61

What are Azure Managed Disks and their types?

Azure StorageMedium
Save to ▾
Show answer
Managed disks are block storage volumes for VMs that Azure manages as resources, with built-in redundancy. Types are Standard HDD for backups and dev, Standard SSD for light workloads, Premium SSD for production, Premium SSD v2 with independently tunable IOPS and throughput, and Ultra Disk for very high IOPS and low latency such as SAP HANA. Disks can be LRS or ZRS for some types.
62

What is Azure Files and when would you use Azure File Sync?

Azure StorageMedium
Save to ▾
Show answer
Azure Files provides fully managed SMB and NFS shares that VMs and on-premises machines can mount, useful for lift-and-shift of apps expecting a file server. Azure File Sync installs an agent on Windows Servers to sync shares to Azure Files and use cloud tiering, keeping hot files locally and old files in the cloud. It helps branch offices share data without large local storage.
63

What are soft delete, versioning and immutable storage for blobs?

Azure StorageMedium
Save to ▾
Show answer
Soft delete keeps deleted blobs or containers for a retention period so you can restore them. Versioning saves the previous version automatically each time a blob is overwritten. Immutable storage applies time-based retention or legal hold policies in WORM mode, so nobody, not even an admin, can delete or change data until it expires. Regulated firms use immutability for audit records and ransomware protection.
64

What is Azure Data Lake Storage Gen2?

Azure StorageMedium
Save to ▾
Show answer
ADLS Gen2 is a storage account with hierarchical namespace enabled, adding real directories, atomic renames and POSIX-style ACLs on top of Blob Storage. It is the storage layer for analytics engines such as Azure Databricks, Synapse and Microsoft Fabric. Directory operations become fast, which matters for Spark jobs. You keep Blob pricing and tiers but must plan ACLs and RBAC together.
65

An order system needs reliable, ordered messaging between services. Would you pick Queue Storage or Service Bus, and why?

Azure StorageMedium
Save to ▾
Show answer
Queue Storage is cheap and simple, holds millions of messages up to 64 KB each, and suits basic background work. Service Bus is an enterprise broker with queues and topics, FIFO through sessions, duplicate detection, dead-lettering, transactions and messages up to 100 MB on Premium. Choose Service Bus for ordered or business-critical messaging like orders and payments, and Storage queues for simple, high-volume job queues.
66

Write a lifecycle management rule to tier and delete log blobs.

Azure StorageMedium
Save to ▾
Show answer
The JSON policy moves blobs under logs/ to Cool after 30 days, Archive after 90 and deletes after 365: { "rules": [{ "name": "logs-tiering", "enabled": true, "type": "Lifecycle", "definition": { "filters": {"blobTypes": ["blockBlob"], "prefixMatch": ["logs/"]}, "actions": {"baseBlob": { "tierToCool": {"daysAfterModificationGreaterThan": 30}, "tierToArchive": {"daysAfterModificationGreaterThan": 90}, "delete": {"daysAfterModificationGreaterThan": 365}}} }}] }
67

Read a blob in Python using DefaultAzureCredential.

Azure StorageMedium
Save to ▾
Show answer
DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored: from azure.identity import DefaultAzureCredential from azure.storage.blob import BlobServiceClient url = 'https://stshopprod.blob.core.windows.net' client = BlobServiceClient(url, credential=DefaultAzureCredential()) blob = client.get_blob_client('invoices', '2026/inv-1001.pdf') data = blob.download_blob().readall() print(len(data))
68

Generate a user delegation SAS for one blob with Azure CLI.

Azure StorageMedium
Save to ▾
Show answer
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity: az storage blob generate-sas \ --account-name stshopprod --container-name invoices \ --name inv-1001.pdf --permissions r \ --expiry 2026-11-12T18:00Z --https-only \ --auth-mode login --as-user --full-uri The caller needs a role that allows generating user delegation keys.
69

A developer accidentally overwrote important files in Blob Storage. How do you recover and prevent it?

Azure StorageMedium
Save to ▾
Show answer
If versioning was on, promote the previous version; if soft delete was on, undelete within the retention period. Point-in-time restore can roll back a whole container if enabled. If none were enabled, recovery may only be from backups. Going forward, enable versioning, soft delete and Azure Backup for blobs, give developers read-only roles in production and route writes only through the application identity.
70

Your storage costs are growing fast because of old logs. What do you do?

Azure StorageMedium
Save to ▾
Show answer
Use Storage insights and Cost Analysis to find which containers and tiers drive cost. Enable last access tracking and apply lifecycle rules that move logs to Cool, then Cold or Archive, and delete after the retention period required by policy. Check for unnecessary GRS replication on non-critical data and leftover snapshots. Compress logs before upload and stop verbose logging at the source.
71

An application on a VM must access a storage account without any keys. How do you set it up?

Azure StorageMedium
Save to ▾
Show answer
Enable a system-assigned or user-assigned managed identity on the VM. Assign the identity the least role needed, such as Storage Blob Data Reader on the specific container. In code, use DefaultAzureCredential or ManagedIdentityCredential from the Azure SDK. Then disable shared key access on the account. The token is fetched from the local metadata endpoint and rotated automatically by Azure.
72

How do you create a private endpoint for a storage account?

Azure StorageHard
Save to ▾
Show answer
Create the private endpoint in the app subnet for the blob sub-resource, link the private DNS zone privatelink.blob.core.windows.net to the VNet, and disable public network access on the account: az network private-endpoint create -g rg-net -n pe-st-blob \ --vnet-name vnet-hub --subnet snet-pe \ --private-connection-resource-id <storage-id> \ --group-id blob --connection-name st-blob Then test that the name resolves to a 10.x address.
73

How would you protect storage accounts against ransomware?

Azure StorageHard
Save to ▾
Show answer
Combine prevention and recovery. Use private endpoints, disable shared keys and public access, and restrict RBAC with PIM. Enable soft delete, versioning, change feed and point-in-time restore. For critical data, use immutable storage policies or vaulted Azure Backup with immutability and multi-user authorization so attackers cannot delete backups. Turn on Defender for Storage to detect malware uploads and unusual access.
74

How do you migrate 200 TB of on-premises data to Azure when the internet link is slow?

Azure StorageHard
Save to ▾
Show answer
Calculate transfer time first: 200 TB over a 1 Gbps link at 70% efficiency takes almost a month. Use Azure Data Box devices shipped to your site, copy data locally and send them back for upload into the storage account. Then run AzCopy or Azure File Sync to sync the changes made after shipping. For ongoing large flows, consider ExpressRoute.
75

Design storage for an app storing user documents that must stay in India for 7 years.

Azure StorageHard
Save to ▾
Show answer
Use a storage account in Central India with ZRS, or GZRS paired with South India which keeps data inside India. Apply time-based immutability for seven years on the archive container and lifecycle rules to move older files to Cool and Archive tiers. Encrypt with customer-managed keys in Key Vault if compliance asks, use private endpoints, and log access to Log Analytics for audits.
76

What is an Azure Virtual Network (VNet)?

Azure NetworkingEasy
Save to ▾
Show answer
A VNet is your private, isolated network in an Azure region, defined by one or more address spaces such as 10.10.0.0/16 and divided into subnets. Resources in a VNet communicate privately and Azure provides default routing between subnets and to the internet. VNets connect to each other with peering and to on-premises with VPN Gateway or ExpressRoute. Azure reserves five IP addresses in every subnet.
77

What is a Network Security Group (NSG)?

Azure NetworkingEasy
Save to ▾
Show answer
An NSG is a stateful packet filter with allow and deny rules on source, destination, port and protocol, processed by priority from 100 to 4096, lower number first. It attaches to a subnet, a NIC or both, and both must allow the traffic. Default rules allow VNet-to-VNet and outbound internet traffic and deny other inbound traffic. Service tags and application security groups simplify rules.
78

You are setting up Azure DNS for a new domain. What are the steps?

Azure NetworkingEasy
Save to ▾
Show answer
Create a public DNS zone in Azure DNS for the domain, note the four Azure name servers it shows, and update the NS records at your domain registrar to those servers. Add records such as an A alias record pointing to the Front Door or public IP and CNAME for www. Verify with nslookup. Apply a lock on the zone so records cannot be deleted accidentally.
79

How do you work with the security team when they reject your network design?

Azure NetworkingEasy
Save to ▾
Show answer
Situation: security rejected my design because the app used public endpoints for storage and SQL. Task: meet their standards without delaying launch. Action: I met them, listed their controls, and redesigned with private endpoints, Azure Firewall egress and WAF, then shared a diagram and cost impact. Result: they approved it in one review cycle, and the design became a reusable team template.
80

How do you document and hand over a network design to the operations team?

Azure NetworkingMedium
Save to ▾
Show answer
Situation: I designed a hub-spoke network that a separate operations team would run. Task: make sure they could support it without calling me. Action: I wrote a short design note with diagrams, IP plan, routing and firewall rule ownership, kept everything in Bicep, and ran two walkthrough sessions with troubleshooting exercises using Network Watcher. Result: they handled the first three incidents independently.
81

What is VNet peering and is it transitive?

Azure NetworkingMedium
Save to ▾
Show answer
Peering connects two VNets over the Microsoft backbone with low latency, either in the same region or globally. Traffic stays private and is billed per GB. Peering is not transitive: if A peers with B and B peers with C, A cannot reach C. To route through a hub, use a network virtual appliance or Azure Firewall with user-defined routes, or use Azure Virtual WAN.
82

Compare Azure Load Balancer, Application Gateway, Front Door and Traffic Manager.

Azure NetworkingMedium
Save to ▾
Show answer
Load Balancer works at layer 4 (TCP/UDP) inside a region. Application Gateway is a regional layer 7 load balancer with path routing, TLS termination and an optional WAF. Front Door is a global layer 7 entry point with anycast, CDN caching and WAF. Traffic Manager is DNS-based global routing for any protocol. Use Front Door for global web apps and Load Balancer for non-HTTP traffic.
83

What is the difference between a VPN Gateway and ExpressRoute?

Azure NetworkingMedium
Save to ▾
Show answer
A VPN Gateway creates encrypted IPsec tunnels over the public internet, for site-to-site or point-to-site connections, and is quick and cheap to set up. ExpressRoute is a private dedicated connection through a connectivity provider with predictable latency and bandwidth up to 100 Gbps, but it does not encrypt by default. Many companies use ExpressRoute as primary and a VPN as backup.
84

What are user-defined routes (UDRs)?

Azure NetworkingMedium
Save to ▾
Show answer
UDRs are custom routes in a route table attached to a subnet, overriding Azure system routes. A common use is sending 0.0.0.0/0 from spoke subnets to Azure Firewall in the hub, with next hop type Virtual appliance, so all outbound traffic is inspected. Mistakes in UDRs are a top cause of connectivity issues, so check effective routes on the NIC when troubleshooting.
85

What is Azure Firewall and how is it different from an NSG?

Azure NetworkingMedium
Save to ▾
Show answer
Azure Firewall is a managed, stateful, centralised firewall with network and application rules, FQDN filtering, threat intelligence and, in the Premium SKU, TLS inspection and IDPS. NSGs are distributed basic filters on subnets and NICs. Typically NSGs control traffic within and between subnets, while Azure Firewall in a hub controls internet egress and cross-spoke traffic with central logging.
86

What is Azure DNS and what is a private DNS zone?

Azure NetworkingMedium
Save to ▾
Show answer
Azure DNS hosts public DNS zones on Microsoft's global name servers so you can manage records like A and CNAME with RBAC. Private DNS zones resolve names only inside linked VNets, used for internal names and private endpoints. For hybrid name resolution, Azure DNS Private Resolver lets on-premises DNS forward queries into Azure and Azure forward queries back on-premises without custom DNS VMs.
87

What is a NAT Gateway and why would you use it?

Azure NetworkingMedium
Save to ▾
Show answer
A NAT Gateway provides outbound internet connectivity for a subnet using one or more static public IPs. It gives a large pool of SNAT ports, avoiding the port exhaustion common with default outbound or Load Balancer outbound rules, and gives a fixed IP that partners can allowlist. Since default outbound access is being retired for new VNets, explicit outbound methods like NAT Gateway are recommended.
88

Create a VNet with two subnets and an NSG rule using Azure CLI.

Azure NetworkingMedium
Save to ▾
Show answer
Create the VNet, add subnets, then an NSG that allows HTTPS and attach it: az network vnet create -g rg-net -n vnet-app \ --address-prefixes 10.20.0.0/16 \ --subnet-name snet-web --subnet-prefixes 10.20.1.0/24 az network vnet subnet create -g rg-net --vnet-name vnet-app \ -n snet-db --address-prefixes 10.20.2.0/24 az network nsg create -g rg-net -n nsg-web az network nsg rule create -g rg-net --nsg-name nsg-web -n allow-https \ --priority 100 --direction Inbound --access Allow \ --protocol Tcp --destination-port-ranges 443 az network vnet subnet update -g rg-net --vnet-name vnet-app \ -n snet-web --network-security-group nsg-web
89

Peer two VNets in both directions with Azure CLI.

Azure NetworkingMedium
Save to ▾
Show answer
Peering must be created from each side. Allow forwarded traffic if a hub firewall routes it: az network vnet peering create -g rg-net -n hub-to-spoke1 \ --vnet-name vnet-hub --remote-vnet vnet-spoke1 \ --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit az network vnet peering create -g rg-net -n spoke1-to-hub \ --vnet-name vnet-spoke1 --remote-vnet vnet-hub \ --allow-vnet-access --allow-forwarded-traffic --use-remote-gateways
90

Which Network Watcher tools do you use to troubleshoot connectivity?

Azure NetworkingMedium
Save to ▾
Show answer
IP flow verify tells you if an NSG rule allows or denies a specific packet and which rule matched. Next hop shows where routing sends traffic. Connection troubleshoot tests reachability from a VM to an endpoint. Effective security rules and effective routes show the combined result on a NIC. VNet flow logs record traffic for analysis with Traffic Analytics. Packet capture records traffic on a VM.
91

A VM in a spoke cannot reach a VM in another spoke. What could be wrong?

Azure NetworkingMedium
Save to ▾
Show answer
Peering is not transitive, so spoke to spoke traffic needs a route through the hub. Check that both spokes have UDRs pointing the other spoke's range to the hub firewall, that peerings allow forwarded traffic, and that firewall network rules allow the flow. Then check NSGs on both subnets and NICs and the guest OS firewall. Use Network Watcher next hop and IP flow verify to confirm.
92

Tell me about a time you fixed a networking issue under pressure.

Azure NetworkingMedium
Save to ▾
Show answer
Situation: after a firewall change, payment APIs in our spoke could not reach a partner endpoint. Task: restore traffic quickly. Action: I used Network Watcher next hop and firewall logs in Log Analytics, found the new rule collection had higher priority and denied the partner FQDN, and added an explicit allow. Result: service recovered in 25 minutes, and we added pipeline-based firewall rule reviews.
93

What is the difference between a service endpoint and a private endpoint?

Azure NetworkingHard
Save to ▾
Show answer
A service endpoint extends the VNet identity to a PaaS service so its firewall can allow your subnet, but the service still uses its public IP. A private endpoint puts a private IP from your subnet on a specific resource instance, so traffic never needs the public endpoint and works from peered networks and on-premises. Private endpoints are preferred for strict security but need private DNS setup.
94

Explain the hub-spoke network topology.

Azure NetworkingHard
Save to ▾
Show answer
The hub VNet holds shared services: Azure Firewall, VPN or ExpressRoute gateways, Bastion and DNS resolvers. Each workload gets its own spoke VNet peered to the hub, with UDRs sending traffic through the firewall. This centralises security and connectivity while isolating workloads. For many regions and branches, Azure Virtual WAN provides a Microsoft-managed hub with automatic transit routing.
95

Create a route table that sends internet traffic to Azure Firewall.

Azure NetworkingHard
Save to ▾
Show answer
Add a default route with next hop Virtual appliance pointing to the firewall private IP, then attach it to the spoke subnet: az network route-table create -g rg-net -n rt-spoke1 az network route-table route create -g rg-net \ --route-table-name rt-spoke1 -n default-to-fw \ --address-prefix 0.0.0.0/0 \ --next-hop-type VirtualAppliance --next-hop-ip-address 10.0.1.4 az network vnet subnet update -g rg-net --vnet-name vnet-spoke1 \ -n snet-app --route-table rt-spoke1
96

How do you plan IP address space for VNets in an enterprise?

Azure NetworkingHard
Save to ▾
Show answer
Allocate from a central IP plan that does not overlap with on-premises, other clouds or future acquisitions, because overlapping ranges cannot be peered or routed. Give each region a large block, for example 10.10.0.0/14, then carve /22 or /24 spokes. Size subnets for growth and remember AKS, App Gateway and private endpoints consume many IPs. Document allocations in an IPAM tool such as Azure Virtual Network Manager IPAM.
97

An App Service cannot connect to an Azure SQL database behind a private endpoint. How do you troubleshoot?

Azure NetworkingHard
Save to ▾
Show answer
Confirm the app has regional VNet integration into a subnet that can reach the private endpoint subnet. Check DNS first: from the Kudu console, nslookup the SQL server name; it must resolve to the private IP through privatelink.database.windows.net linked to the VNet. Then check NSGs, UDRs sending traffic to a firewall that blocks port 1433, and whether SQL public access is disabled as expected.
98

Your company needs a reliable private link from its Pune datacenter to Azure. What do you propose?

Azure NetworkingHard
Save to ▾
Show answer
Propose ExpressRoute through a provider at the Pune or Mumbai peering location with private peering into a hub VNet in Central India, sized for current and forecast bandwidth. Add a site-to-site VPN as a failover path, or a second ExpressRoute circuit at another peering location for higher resilience. Use BGP for route exchange, and encrypt traffic with MACsec or IPsec if compliance requires.
99

How would you protect a public web application from attacks like SQL injection and DDoS?

Azure NetworkingHard
Save to ▾
Show answer
Put Azure Front Door Premium or Application Gateway with WAF in front of the app, using the managed Default Rule Set based on OWASP plus bot protection and rate limits. Enable Azure DDoS Network Protection on the VNet for layer 3 and 4 attacks on public IPs. Lock the app so it accepts traffic only from Front Door, using access restrictions with the service tag and the Front Door ID header.
100

Partners need to allowlist a fixed outbound IP from your AKS cluster. How do you do it?

Azure NetworkingHard
Save to ▾
Show answer
Configure the cluster's outbound type as a managed or user-assigned NAT Gateway with a static public IP, or route egress through Azure Firewall using userDefinedRouting so all traffic leaves from the firewall's public IP. Share that IP with partners. NAT Gateway is simpler and gives many SNAT ports, while Azure Firewall adds FQDN filtering and logging for compliance.
101

What is Microsoft Entra ID?

Identity and SecurityEasy
Save to ▾
Show answer
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
102

Explain the built-in roles Owner, Contributor, Reader and User Access Administrator.

Identity and SecurityEasy
Save to ▾
Show answer
Owner has full access to resources and can assign roles to others. Contributor can create and manage all resources but cannot grant access or manage role assignments. Reader can only view resources. User Access Administrator can manage role assignments but not resources. Follow least privilege: most engineers need Contributor on their own resource groups and Reader elsewhere, with Owner held by very few people.
103

What is a managed identity and what types exist?

Identity and SecurityEasy
Save to ▾
Show answer
A managed identity is an Entra ID identity that Azure creates and rotates for a resource, so code can get tokens without storing secrets. A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource you can attach to many resources and that survives their deletion. User-assigned is better when several apps share access or when you pre-create role assignments.
104

What is Azure Key Vault and what can it store?

Identity and SecurityEasy
Save to ▾
Show answer
Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.
105

What is Azure Policy and how is it different from RBAC?

Identity and SecurityEasy
Save to ▾
Show answer
RBAC controls who can do actions. Azure Policy controls what resources and settings are allowed, whoever deploys them. Policies use effects such as deny, audit, append, modify, deployIfNotExists and auditIfNotExists. For example, deny public IPs on VMs or deploy diagnostic settings automatically. Group policies into initiatives, assign them at management groups and view compliance on the dashboard.
106

Assign a role to a group at resource group scope with Azure CLI.

Identity and SecurityEasy
Save to ▾
Show answer
Look up the group object ID, then create the role assignment with the narrowest scope: GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv) az role assignment create \ --assignee-object-id $GROUP_ID \ --assignee-principal-type Group \ --role Contributor \ --scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev Assigning to groups instead of users keeps access easy to audit.
107

Store and read a secret from Key Vault using Azure CLI.

Identity and SecurityEasy
Save to ▾
Show answer
Create an RBAC-enabled vault, grant yourself Key Vault Secrets Officer, then set and read the secret: az keyvault create -g rg-sec -n kv-shop-prod \ --location centralindia --enable-rbac-authorization true az keyvault secret set --vault-name kv-shop-prod \ --name SqlPassword --value 'S3cure#Pass' az keyvault secret show --vault-name kv-shop-prod \ --name SqlPassword --query value -o tsv
108

How do you keep up with security changes in Azure?

Identity and SecurityEasy
Save to ▾
Show answer
Situation: Azure releases security changes every month, and missing one can expose our systems. Task: stay current without losing project time. Action: I follow Azure Updates and the Azure Security blog, read the monthly Defender for Cloud changes, review Service Health retirement notices and spend an hour weekly in a lab. Result: our team was ready for the mandatory MFA rollout for Azure sign-ins before it was enforced.
109

What is the difference between Entra ID roles and Azure RBAC roles?

Identity and SecurityMedium
Save to ▾
Show answer
Entra ID roles, such as Global Administrator or User Administrator, control the directory: users, groups, app registrations and tenant settings. Azure RBAC roles, such as Owner, Contributor and Reader, control Azure resources at management group, subscription, resource group or resource scope. A Global Administrator has no resource access by default, though they can elevate themselves to User Access Administrator at root scope.
110

What is the difference between an app registration and a service principal?

Identity and SecurityMedium
Save to ▾
Show answer
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
111

What is Conditional Access?

Identity and SecurityMedium
Save to ▾
Show answer
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
112

What is Privileged Identity Management (PIM)?

Identity and SecurityMedium
Save to ▾
Show answer
PIM gives just-in-time, time-bound access to privileged Entra ID roles and Azure RBAC roles. Users are eligible, not permanently assigned, and must activate the role for a few hours with justification, MFA and optionally approval. Every activation is audited and access reviews remove stale eligibility. It reduces standing admin access, which is a key control against compromised accounts. It needs Entra ID P2 or governance licensing.
113

What is Microsoft Defender for Cloud?

Identity and SecurityMedium
Save to ▾
Show answer
Defender for Cloud is a cloud security posture management and workload protection platform. The free foundational tier gives a secure score and recommendations based on the Microsoft cloud security benchmark. Paid Defender plans add threat detection for servers, storage, SQL, containers, Key Vault and App Service, vulnerability scanning and attack path analysis. It also covers AWS and GCP accounts and on-premises servers through Arc.
114

How does encryption at rest and in transit work in Azure?

Identity and SecurityMedium
Save to ▾
Show answer
All Azure Storage, managed disks and Azure SQL data is encrypted at rest with AES-256 by default using Microsoft-managed keys. You can switch to customer-managed keys in Key Vault for control over rotation and revocation, and use double encryption or confidential computing for stricter needs. In transit, services use TLS 1.2 or higher, and you should enforce HTTPS only and minimum TLS version settings.
115

What is Microsoft Sentinel?

Identity and SecurityMedium
Save to ▾
Show answer
Sentinel is Microsoft's cloud-native SIEM and SOAR built on Log Analytics. It ingests logs through connectors from Entra ID, Defender, Azure activity, firewalls and third-party sources, runs analytics rules written in KQL to raise incidents, and uses playbooks built on Logic Apps to automate responses like disabling a user. Cost depends on data ingestion, so filter noisy logs and use basic or auxiliary log tiers.
116

How do you reference Key Vault secrets in App Service app settings?

Identity and SecurityMedium
Save to ▾
Show answer
Enable a managed identity on the app, grant it Key Vault Secrets User on the vault, then set the app setting value to a Key Vault reference: @Microsoft.KeyVault(SecretUri=https://kv-shop-prod.vault.azure.net/secrets/SqlPassword/). The app reads it as a normal environment variable. Omitting the version makes App Service pick up rotated secrets automatically within about a day, or on restart.
117

How do you create a custom RBAC role?

Identity and SecurityMedium
Save to ▾
Show answer
Export a similar built-in role as JSON, keep only needed Actions and DataActions, set AssignableScopes and create it: az role definition list --name 'Virtual Machine Contributor' > vm-op.json # edit: Name 'VM Operator', Actions: # Microsoft.Compute/virtualMachines/read # Microsoft.Compute/virtualMachines/start/action # Microsoft.Compute/virtualMachines/restart/action # Microsoft.Compute/virtualMachines/deallocate/action az role definition create --role-definition vm-op.json
118

A developer's service principal secret was committed to a public GitHub repo. What do you do?

Identity and SecurityMedium
Save to ▾
Show answer
Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.
119

How do you give an external auditor read-only access to your Azure environment for two weeks?

Identity and SecurityMedium
Save to ▾
Show answer
Invite the auditor as a B2B guest user in Entra ID, add them to a group, and assign the Reader role, plus Security Reader if they review Defender findings, at the required scope through PIM with a two-week expiry. Require MFA through Conditional Access for guests. Avoid sharing accounts. After the audit, an access review or expiry removes access automatically, with all activity logged.
120

Your secure score in Defender for Cloud is low. How do you improve it?

Identity and SecurityMedium
Save to ▾
Show answer
Sort recommendations by the score increase and effort. Typical quick wins are enabling MFA for all privileged accounts, restricting management ports with just-in-time access, enabling endpoint protection and vulnerability assessment on VMs, and turning on diagnostic logs. Use Azure Policy to enforce fixes so new resources stay compliant. Assign owners and due dates through governance rules and track progress weekly.
121

Tell me about a time you pushed back on a request that broke security rules.

Identity and SecurityMedium
Save to ▾
Show answer
Situation: a project manager asked me to give a vendor Owner access to production to speed up a fix. Task: unblock the vendor without breaking policy. Action: I explained the risk, then created a time-bound PIM eligible Contributor role on just one resource group with approval, and paired with the vendor during the change. Result: the fix shipped the same day and the audit had no findings.
122

What is workload identity federation?

Identity and SecurityHard
Save to ▾
Show answer
Workload identity federation lets external workloads such as GitHub Actions, Kubernetes pods or other clouds get Entra ID tokens by exchanging their own OIDC tokens, without storing client secrets. You add a federated credential on an app registration or user-assigned managed identity that trusts a specific issuer and subject, such as a repo branch. AKS Workload ID uses this for pods to access Azure resources.
123

Write a Bicep snippet for a custom Azure Policy that denies resources outside India regions.

Identity and SecurityHard
Save to ▾
Show answer
Define the rule with an allowed list and a deny effect, then assign it at a management group: resource pol 'Microsoft.Authorization/policyDefinitions@2023-04-01' = { name: 'allowed-india-regions' properties: { policyType: 'Custom' mode: 'Indexed' policyRule: { if: { field: 'location' notIn: ['centralindia', 'southindia', 'westindia'] } then: { effect: 'deny' } } } }
124

Design identity and access for a multi-team Azure platform in a bank.

Identity and SecurityHard
Save to ▾
Show answer
Use Entra ID groups mapped to roles per team and environment, with no direct user assignments. Make production access eligible-only through PIM with approval and MFA, and require phishing-resistant MFA and compliant devices via Conditional Access. Use managed identities and workload federation for apps and pipelines. Keep break-glass accounts excluded from policies but monitored. Run quarterly access reviews and stream logs to Sentinel.
125

How would you secure an AKS cluster?

Identity and SecurityHard
Save to ▾
Show answer
Use Entra ID integration with Kubernetes RBAC and disable local accounts. Make the API server private or restrict authorized IP ranges. Run workloads with Workload ID instead of secrets, keep secrets in Key Vault through the CSI driver, and apply Azure Policy for Kubernetes to block privileged pods. Enable Defender for Containers, use network policies, scan images in ACR and route egress through Azure Firewall.
126

What database services does Azure offer?

Azure DatabasesEasy
Save to ▾
Show answer
Relational options are Azure SQL Database, Azure SQL Managed Instance, SQL Server on VMs, and Azure Database for PostgreSQL and MySQL flexible servers. Azure Cosmos DB is the globally distributed NoSQL and vector database. Azure Cache for Redis and Azure Managed Redis provide in-memory caching. For analytics there are Synapse, Fabric and Azure Data Explorer. Choose by data model, compatibility and how much operations you want to manage.
127

A client wants to move a SQL Server database that uses SQL Agent jobs and cross-database queries. Which Azure SQL option fits, and what are the alternatives?

Azure DatabasesEasy
Save to ▾
Show answer
Azure SQL Database is a fully managed single database or elastic pool, best for new cloud apps. SQL Managed Instance offers near 100% SQL Server compatibility including SQL Agent, cross-database queries and CLR, in a VNet, ideal for lift-and-shift. SQL Server on a VM gives full OS and instance control for unsupported features but you handle patching, HA and backups yourself, although the SQL IaaS extension helps.
128

What is Azure Cosmos DB and which APIs does it support?

Azure DatabasesEasy
Save to ▾
Show answer
Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.
129

Why would you use Azure Cache for Redis?

Azure DatabasesEasy
Save to ▾
Show answer
Redis is an in-memory key-value store used for caching frequent database reads, storing user sessions, rate limiting, leaderboards and pub/sub. Caching a product catalogue can cut database load and bring latency from tens of milliseconds to around one. Use the cache-aside pattern with sensible TTLs. Microsoft now steers new deployments to Azure Managed Redis, which is based on Redis Enterprise.
130

How would you reduce the cost of many idle dev and test databases?

Azure DatabasesEasy
Save to ▾
Show answer
Move them to serverless General Purpose with auto-pause, or into an elastic pool if they are always on but lightly used. Use Azure Hybrid Benefit if you own SQL licences, use the Azure Dev/Test pricing offer for non-production subscriptions, delete databases nobody has connected to in months, and use smaller backup retention and LRS backup storage for non-production.
131

How do you handle disagreement with a developer about database design?

Azure DatabasesEasy
Save to ▾
Show answer
Situation: a developer wanted to store all order data as JSON blobs in one table. Task: agree on a design that would scale. Action: I listened to his reason, faster development, then built a small benchmark showing filter and reporting queries on both designs and proposed relational tables with a JSON column for flexible attributes. Result: we adopted the hybrid, and reporting stayed fast.
132

Explain DTU and vCore purchasing models in Azure SQL Database.

Azure DatabasesMedium
Save to ▾
Show answer
DTU bundles CPU, memory and IO into fixed Basic, Standard and Premium sizes and is simple for small apps. The vCore model lets you choose compute and storage separately, with General Purpose, Business Critical and Hyperscale tiers, provisioned or serverless compute, and Azure Hybrid Benefit for existing SQL licences. vCore is recommended for most production workloads because it is transparent and easier to compare with on-premises.
133

What is serverless compute in Azure SQL Database?

Azure DatabasesMedium
Save to ▾
Show answer
Serverless is a vCore option in General Purpose and Hyperscale that autoscales between a minimum and maximum vCore range and bills per second for compute used. In General Purpose it can auto-pause after an idle period and charge only for storage, then resume on the next connection with a short delay. It suits dev databases and apps with intermittent use, not steady heavy workloads.
134

You run a SaaS app with 300 small tenant databases whose usage peaks at different times. How do you host them cost-effectively?

Azure DatabasesMedium
Save to ▾
Show answer
An elastic pool shares a set of resources, in eDTUs or vCores, among many Azure SQL databases on one logical server. It suits SaaS apps with a database per tenant, where individual usage peaks at different times. Instead of sizing each database for its peak, you size the pool for combined usage and set per-database min and max limits. Too many busy databases at once will contend for resources.
135

How do backups and point-in-time restore work in Azure SQL Database?

Azure DatabasesMedium
Save to ▾
Show answer
Azure takes full backups weekly, differential backups every 12 to 24 hours and log backups about every 10 minutes automatically. You can restore to any point within the short-term retention period of 1 to 35 days, default 7, as a new database. Long-term retention keeps weekly, monthly or yearly full backups for up to 10 years. Backup storage can be LRS, ZRS or geo-redundant.
136

What are Request Units (RUs) in Cosmos DB?

Azure DatabasesMedium
Save to ▾
Show answer
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
137

Create an Azure SQL Database with Entra-only authentication using Azure CLI.

Azure DatabasesMedium
Save to ▾
Show answer
Create the logical server with an Entra admin group and no SQL logins, then the database: az sql server create -g rg-data -n sql-shop-prod -l centralindia \ --enable-ad-only-auth \ --external-admin-principal-type Group \ --external-admin-name grp-sql-admins \ --external-admin-sid <group-object-id> az sql db create -g rg-data -s sql-shop-prod -n shopdb \ --edition GeneralPurpose --family Gen5 --capacity 2 \ --zone-redundant true --backup-storage-redundancy Zone
138

How do you let an App Service connect to Azure SQL using its managed identity?

Azure DatabasesMedium
Save to ▾
Show answer
Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles: CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [app-shop-prod]; ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod]; Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.
139

Write a Cosmos DB NoSQL query to get a customer's orders above 5000 rupees.

Azure DatabasesMedium
Save to ▾
Show answer
Filter on the partition key so the query hits one partition and stays cheap: SELECT c.id, c.orderDate, c.total FROM c WHERE c.customerId = @customerId AND c.total > 5000 ORDER BY c.orderDate DESC ORDER BY on orderDate needs a range index, which the default indexing policy includes. Check the RU charge in the response headers.
140

How do you find and fix slow queries in Azure SQL Database?

Azure DatabasesMedium
Save to ▾
Show answer
Open Query Performance Insight or Query Store to find the top queries by CPU, duration and IO. Check execution plans for scans, missing indexes and parameter sniffing. Review automatic tuning recommendations to create indexes or force the last good plan. Query DMVs like sys.dm_exec_query_stats and sys.dm_db_resource_stats. If resources are maxed after tuning, scale up or add read replicas.
141

A developer ran a DELETE without a WHERE clause on production. How do you recover?

Azure DatabasesMedium
Save to ▾
Show answer
Stop further writes if possible and note the exact time of the mistake. Use point-in-time restore to create a new copy of the database from a minute before the delete. Then copy the missing rows back into production with INSERT SELECT across databases or a data export, rather than replacing the whole database, which would lose later legitimate changes. Afterwards restrict direct write access in production.
142

Tell me about a time you improved database performance.

Azure DatabasesMedium
Save to ▾
Show answer
Situation: our reports page took 14 seconds to load on Azure SQL. Task: bring it under two seconds. Action: Query Store showed one query scanning a 40 million row table. I added a covering index, rewrote a correlated subquery as a join and cached the result in Redis for five minutes. Result: load time fell to about 800 ms and DTU usage dropped, so we avoided a tier upgrade.
143

What is the Hyperscale tier of Azure SQL Database?

Azure DatabasesHard
Save to ▾
Show answer
Hyperscale separates compute from a distributed, log-based storage layer, so databases can grow up to 128 TB with fast backups through snapshots and quick restores regardless of size. You can add up to four high-availability replicas and named replicas for read scale-out. Scaling compute takes minutes. It suits large OLTP and mixed workloads, and its pricing is now competitive with General Purpose.
144

What are active geo-replication and failover groups?

Azure DatabasesHard
Save to ▾
Show answer
Active geo-replication creates readable secondary databases in other regions, up to four, with asynchronous replication and manual failover per database. Failover groups manage a group of databases together, provide read-write and read-only listener endpoints that stay the same after failover, and support automatic failover by policy. Applications should use the failover group listener so connection strings do not change during a regional failover.
145

How do you choose a partition key in Cosmos DB?

Azure DatabasesHard
Save to ▾
Show answer
Pick a property with high cardinality that spreads requests and storage evenly and that most queries filter on, such as userId or tenantId. Each logical partition is limited to 20 GB, so avoid keys like country or status that create hot partitions. If no single property works, use a synthetic key or hierarchical partition keys. The partition key cannot be changed later without migrating data.
146

Explain the five consistency levels in Cosmos DB.

Azure DatabasesHard
Save to ▾
Show answer
Strong guarantees linearizable reads but adds latency across regions. Bounded staleness lets reads lag by a set number of versions or time. Session, the default, guarantees read-your-own-writes within a client session. Consistent prefix ensures reads never see writes out of order. Eventual is fastest and cheapest with no ordering guarantee. Most apps use Session; stronger levels cost more RUs and latency.
147

How do you migrate an on-premises SQL Server database to Azure SQL Managed Instance?

Azure DatabasesHard
Save to ▾
Show answer
Assess with Azure Migrate or the Azure SQL migration extension in Azure Data Studio to find compatibility issues and size the target. For minimal downtime, use the Managed Instance link or Log Replay Service to continuously replicate, then cut over in minutes. For smaller databases, an offline native backup to Blob Storage and RESTORE FROM URL works. Test application connectivity and performance before switching.
148

Your Cosmos DB requests are failing with 429 errors. What do you do?

Azure DatabasesHard
Save to ▾
Show answer
429 means requests exceeded provisioned RU/s. Check Insights for normalized RU consumption per partition. If one partition is hot, the partition key is the problem. If usage is even, enable autoscale or raise RU/s. Reduce RU cost by using point reads instead of queries, excluding unused paths from indexing and smaller documents. SDKs retry 429s automatically, so tune retry options too.
149

A SQL database must survive a full regional outage with under 1 minute data loss. Design it.

Azure DatabasesHard
Save to ▾
Show answer
Use Azure SQL Database Business Critical or General Purpose with zone redundancy in Central India, plus a failover group to South India. Geo-replication is asynchronous with typical lag under a few seconds, meeting the RPO. Point the app to the failover group listener, deploy the app tier in both regions behind Front Door, and test failover drills quarterly. Document RTO for the automatic policy grace period.
150

Should you use Cosmos DB or Azure SQL for a new e-commerce application?

Azure DatabasesHard
Save to ▾
Show answer
Use Azure SQL for orders, payments and inventory, which need joins, transactions and strong consistency. Use Cosmos DB for high-volume, flexible-schema data such as product catalogue, shopping carts, user activity or session data needing global low latency. Many systems combine both. If the team knows SQL well and scale is moderate, starting with Azure SQL alone is simpler and cheaper.
151

What is Infrastructure as Code and why use it on Azure?

DevOps and Infrastructure as CodeEasy
Save to ▾
Show answer
Infrastructure as Code defines resources in versioned files, such as Bicep, ARM JSON or Terraform, instead of clicking in the portal. It makes environments repeatable, reviewable through pull requests and quick to rebuild after failure. Drift between dev, test and prod drops because all are deployed from the same templates with different parameters. It also documents the setup and enables automated policy checks before deployment.
152

What is Bicep and how does it relate to ARM templates?

DevOps and Infrastructure as CodeEasy
Save to ▾
Show answer
Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.
153

What are the main services in Azure DevOps?

DevOps and Infrastructure as CodeEasy
Save to ▾
Show answer
Azure Boards tracks work items, sprints and backlogs. Azure Repos hosts Git repositories with branch policies. Azure Pipelines runs CI/CD on Microsoft-hosted or self-hosted agents. Azure Test Plans manages manual and exploratory testing. Azure Artifacts hosts NuGet, npm, Maven and Python feeds. Many Indian service companies still run client projects on Azure DevOps, while product companies often use GitHub Actions.
154

Deploy a Bicep file and preview changes with Azure CLI.

DevOps and Infrastructure as CodeEasy
Save to ▾
Show answer
Run what-if first, then deploy with a parameters file: az deployment group what-if \ --resource-group rg-shop-dev \ --template-file main.bicep \ --parameters main.dev.bicepparam az deployment group create \ --resource-group rg-shop-dev \ --template-file main.bicep \ --parameters main.dev.bicepparam Use az deployment sub create for subscription-scope templates.
155

How do you build and push a container image to ACR without Docker installed?

DevOps and Infrastructure as CodeEasy
Save to ▾
Show answer
Use ACR Tasks to build in the cloud from your source folder: az acr build --registry acrshopprod \ --image shop-api:$(git rev-parse --short HEAD) . ACR Tasks can also rebuild automatically on a Git commit or when the base image is updated, which helps patch OS vulnerabilities without manual work.
156

Tell me about a time you automated a manual process.

DevOps and Infrastructure as CodeEasy
Save to ▾
Show answer
Situation: our team created test environments by hand, taking two days each. Task: make it self-service. Action: I wrote Bicep modules for the app, database and networking and a pipeline with parameters for environment name, plus an auto-delete tag cleaned up nightly by an Automation runbook. Result: environments took 20 minutes, and idle test cost dropped by about 30%.
157

Your company is choosing between Bicep and Terraform for its Azure estate. What would you recommend?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Bicep is Azure-only, needs no state file, supports new resource features immediately and has native what-if previews. Terraform works across many clouds and SaaS providers, has a huge module ecosystem, and keeps a state file that must be stored securely, for example in a Blob Storage backend with locking. Choose Bicep for Azure-only teams and Terraform for multi-cloud or existing Terraform skills.
158

What are ARM deployment modes and scopes?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.
159

What is a service connection in Azure Pipelines?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
160

Explain stages, jobs, steps and environments in YAML pipelines.

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
A pipeline has stages, such as Build, Test and DeployProd, that run in sequence or parallel. Each stage has jobs, which run on one agent, and each job has steps, which are tasks or scripts. Deployment jobs target environments, which can have approvals, checks, business hours and deployment history. Templates let teams reuse stages and jobs across many repositories.
161

What deployment strategies can you use for Azure apps?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Rolling updates replace instances in batches, used by VMSS and Kubernetes. Blue-green runs two environments and switches traffic, as with App Service slots. Canary sends a small percentage of traffic to the new version first, using slot traffic routing, Front Door weights or Container Apps revisions. Feature flags in App Configuration let you deploy code dark and enable features gradually without redeploying.
162

What is the what-if operation in Bicep deployments?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.
163

Write a Bicep file that creates a storage account with parameters.

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Parameters keep the template reusable across environments: param location string = resourceGroup().location @minLength(3) @maxLength(24) param name string @allowed(['Standard_LRS', 'Standard_ZRS']) param sku string = 'Standard_ZRS' resource st 'Microsoft.Storage/storageAccounts@2023-05-01' = { name: name location: location sku: { name: sku } kind: 'StorageV2' properties: { minimumTlsVersion: 'TLS1_2' allowBlobPublicAccess: false supportsHttpsTrafficOnly: true } } output blobEndpoint string = st.properties.primaryEndpoints.blob
164

Write a GitHub Actions job that logs in to Azure with OIDC.

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Grant id-token write permission and use a federated credential on the app registration, so no secret is stored: permissions: id-token: write contents: read jobs: deploy: runs-on: ubuntu-latest environment: prod steps: - uses: actions/checkout@v4 - uses: azure/login@v2 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - run: az group list -o table
165

Write a basic Terraform configuration for a resource group and VNet with remote state.

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Configure the azurerm backend and provider, then resources: terraform { backend "azurerm" { resource_group_name = "rg-tfstate" storage_account_name = "sttfstateprod" container_name = "state" key = "network.tfstate" use_azuread_auth = true } } provider "azurerm" { features {} } resource "azurerm_resource_group" "net" { name = "rg-net-prod" location = "centralindia" } resource "azurerm_virtual_network" "hub" { name = "vnet-hub" location = azurerm_resource_group.net.location resource_group_name = azurerm_resource_group.net.name address_space = ["10.0.0.0/16"] }
166

Your pipeline takes 40 minutes. How do you speed it up?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Profile which stages are slow. Cache dependencies like NuGet or npm packages, run unit tests and linting in parallel jobs, and split slow integration tests to run only on main or nightly. Use self-hosted or Managed DevOps Pools agents with warm caches for big builds, build container images with layer caching, and deploy only changed services in a monorepo using path filters.
167

How do you handle a failed release that affected customers?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Situation: a release broke login for some mobile users on a Friday evening. Task: restore service fast and prevent repeats. Action: I swapped the App Service slot back to the previous version within ten minutes, informed support, then reproduced the bug in staging and found a missing config value. Result: we added config validation and smoke tests on login to the pipeline, and wrote a blameless postmortem.
168

How do you mentor juniors on DevOps practices?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Situation: three freshers joined my team without pipeline experience. Task: make them productive in a month. Action: I created a small sample repo with a Bicep template and YAML pipeline, paired with each one on their first pull request, set review checklists and let them own one non-production pipeline each. Result: within five weeks all three were shipping changes independently and one improved our caching.
169

How do you manage Terraform state securely on Azure?

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
Store state in an Azure Storage backend with a dedicated container per environment. Blob leases provide state locking so two runs cannot write at once. Use Entra ID authentication instead of access keys, enable versioning and soft delete to recover from corruption, restrict access to the pipeline identity, and use private endpoints. Never commit state files, because they can contain secrets in plain text.
170

What is GitOps and how is it used with AKS?

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
GitOps treats a Git repository as the single source of truth for cluster configuration. An agent in the cluster, such as Flux, which AKS offers as a managed extension, or Argo CD, pulls manifests from Git and reconciles the cluster to match. Changes happen only through pull requests, which gives audit history and easy rollback by reverting commits. It also removes the need to give pipelines cluster admin credentials.
171

Write an Azure Pipelines YAML that builds a .NET app and deploys it to App Service.

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
Build and publish an artifact, then deploy in a stage tied to an environment with approvals: trigger: branches: { include: [main] } pool: { vmImage: ubuntu-latest } stages: - stage: Build jobs: - job: build steps: - script: dotnet publish -c Release -o $(Build.ArtifactStagingDirectory) - publish: $(Build.ArtifactStagingDirectory) artifact: app - stage: Deploy jobs: - deployment: web environment: prod strategy: runOnce: deploy: steps: - task: AzureWebApp@1 inputs: azureSubscription: sc-shop-prod appName: app-shop-prod package: $(Pipeline.Workspace)/app
172

Someone changed production resources manually in the portal. How do you detect and handle drift?

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
Detect drift by running Bicep what-if or terraform plan on a schedule and failing the run on unexpected differences, and by alerting on activity log write events from users rather than pipeline identities. Decide whether the manual change was a valid hotfix; if so, add it to code, otherwise redeploy to restore. Then reduce write access in production to the pipeline identity plus PIM break-glass.
173

How do you manage secrets and configuration for many environments in pipelines?

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
Keep non-secret settings in parameter files or Azure App Configuration per environment. Keep secrets in Key Vault per environment and let apps read them via managed identity or Key Vault references, so pipelines rarely handle them. When pipelines need secrets, link variable groups to Key Vault and use environment approvals. Never echo secrets in logs and prefer federated identities over stored credentials.
174

A deployment to production failed halfway. How do you design pipelines to handle this?

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
Make deployments idempotent so rerunning the same template converges to the right state. Use slot swaps or blue-green so the old version keeps serving until the new one passes health checks, and roll back by swapping back. Keep database migrations backward compatible, using expand and contract, so the old code still works. Add smoke tests and automatic rollback, and alert the team with logs.
175

How would you structure IaC repositories for a platform team supporting 30 app teams?

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
Separate a platform repo for landing zone, networking and policies from shared versioned modules published to a Bicep registry in ACR or a Terraform module registry. App teams consume modules in their own repos with pinned versions. Use pull request checks: linting, what-if or plan, policy tests and security scanning with tools like Checkov or PSRule. Document module contracts and use semantic versioning for breaking changes.
176

What is Azure Monitor and what data does it collect?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
Azure Monitor is the unified monitoring platform for Azure and hybrid resources. It collects metrics, which are numeric time series stored for 93 days, and logs, which are records stored in Log Analytics workspaces and queried with KQL. Sources include platform metrics, activity logs, resource logs through diagnostic settings, VM guest data through the Azure Monitor Agent and app telemetry from Application Insights.
177

What is a Log Analytics workspace?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.
178

What is Application Insights?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
Application Insights is the APM feature of Azure Monitor. It collects requests, dependencies, exceptions, traces and custom events from apps through OpenTelemetry-based SDKs or auto-instrumentation in App Service, Functions and AKS. Features include the application map, live metrics, failure and performance analysis, availability tests and distributed tracing. Workspace-based resources store data in Log Analytics so you can join it with infrastructure logs.
179

What are Azure Advisor recommendations?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.
180

What is Azure Cost Management?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
Cost Management analyses and controls Azure spending. Cost analysis shows cost by service, resource group, tag or meter with forecasts. Budgets send alerts at thresholds such as 80% and 100% of actual or forecast spend and can trigger automation. Exports send daily cost data to Storage for reporting in Power BI. It also shows reservation utilisation and supports FinOps practices like showback and chargeback to teams.
181

What is Azure Service Health?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
Service Health shows the health of Azure services in your regions: service issues happening now, planned maintenance, health advisories and security advisories, plus retirement notices. Resource Health shows if a specific resource, such as a VM, is available and why not. Set activity log alerts on Service Health so the team gets notified for incidents affecting their subscriptions and regions, instead of finding out from users.
182

How do you create a budget with alerts for a subscription?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
In Cost Management, choose Budgets, set the scope to the subscription or a resource group, a monthly amount and alert conditions such as 50%, 80% and 100% of actual cost and 100% of forecast. Add email recipients and an action group that can notify Teams or run an automation. Budgets do not stop spending on their own, so pair them with automation or policy if needed.
183

How do you prioritise when several alerts fire at the same time?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
Situation: during a release night, CPU, disk and payment error alerts fired together. Task: decide what to handle first. Action: I ranked by customer impact, so payment failures came first, checked Service Health for a platform issue, assigned disk and CPU checks to a teammate and kept a running update in the incident channel. Result: payments recovered quickly and we tuned the noisy CPU alerts afterwards.
184

What is the difference between the activity log and resource logs?

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
The activity log records control-plane operations at subscription level, such as who created, updated or deleted a resource, and service health events. It is kept for 90 days unless exported. Resource logs record data-plane activity inside a resource, such as Key Vault secret reads or SQL audit events, and must be enabled with diagnostic settings to send them to Log Analytics, Storage or Event Hubs.
185

What types of alerts does Azure Monitor support?

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Metric alerts evaluate metrics such as CPU above 80% and can be dynamic with machine-learned thresholds. Log search alerts run KQL queries on a schedule. Activity log alerts fire on control-plane events or Service Health incidents. Smart detection in Application Insights finds anomalies. Alerts trigger action groups that send emails, SMS, Teams messages, webhooks or run Functions, Logic Apps and Automation runbooks.
186

Explain Azure Backup and Azure Site Recovery.

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Azure Backup protects data by taking scheduled backups of VMs, SQL and SAP HANA in VMs, Azure Files, blobs, disks and on-premises servers into Recovery Services or Backup vaults, with retention policies, soft delete and immutability. Azure Site Recovery replicates whole VMs continuously to another region or from on-premises to Azure for disaster recovery, with recovery plans for orchestrated failover. Backup is for restoring data; Site Recovery is for business continuity.
187

What are RPO and RTO and how do they guide Azure designs?

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
RPO, recovery point objective, is the maximum acceptable data loss measured in time. RTO, recovery time objective, is how long recovery may take. A daily backup gives an RPO of up to 24 hours. Site Recovery gives an RPO of seconds to minutes and an RTO of minutes to hours. SQL failover groups give an RPO of seconds. Lower RPO and RTO cost more, so agree targets per application.
188

What is Azure Resource Graph?

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Azure Resource Graph is a fast query service over resource metadata across all subscriptions you can access, using KQL. It is used for inventory, compliance checks and finding orphaned resources, such as unattached disks or public IPs, much faster than looping through APIs. The portal's All resources view and Azure Policy compliance use it. Results reflect configuration, not performance metrics.
189

Write a KQL query for the top 10 slowest requests in Application Insights over the last day.

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Query the requests table, summarise duration and sort: requests | where timestamp > ago(1d) | summarize count(), avgDuration = avg(duration), p95 = percentile(duration, 95) by name | top 10 by p95 desc In a workspace-based resource, the table is AppRequests with TimeGenerated and DurationMs columns instead.
190

Write a KQL query to find who deleted resources in the last 7 days.

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Use the AzureActivity table, filtering on successful delete operations: AzureActivity | where TimeGenerated > ago(7d) | where OperationNameValue endswith '/DELETE' | where ActivityStatusValue == 'Success' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, _ResourceId | order by TimeGenerated desc
191

Write a KQL query to find VMs with average CPU above 80% in the last hour.

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights: Perf | where TimeGenerated > ago(1h) | where ObjectName == 'Processor' and CounterName == '% Processor Time' | where InstanceName == '_Total' | summarize avgCpu = avg(CounterValue) by Computer | where avgCpu > 80 | order by avgCpu desc
192

Write a Resource Graph query to list unattached managed disks.

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Unattached disks keep billing, so this is a common cost check: Resources | where type =~ 'microsoft.compute/disks' | where properties.diskState =~ 'Unattached' | project name, resourceGroup, subscriptionId, sku = sku.name, sizeGb = properties.diskSizeGB Run it with az graph query -q or in the Resource Graph Explorer.
193

Finance wants each team to pay for its own Azure usage. How do you implement this?

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Make tags like costcenter and team mandatory through Azure Policy with deny for new resources and modify to inherit from resource groups. Prefer separate subscriptions per team where possible, since subscription boundaries are the cleanest cost split. Use Cost Management views and scheduled exports grouped by tag and subscription into Power BI. Share untaggable costs like shared networking with an agreed split.
194

Tell me about a time you set up monitoring that caught a problem early.

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Situation: our order service had silent failures that customers reported hours later. Task: detect them first. Action: I added Application Insights availability tests and a log alert on failed dependency calls to the payment gateway, routed to Teams and on-call. Result: two weeks later the alert caught an expired partner certificate within five minutes, and we fixed it before most users noticed.
195

How do you enable diagnostic settings at scale for all resources?

Monitoring, Cost and GovernanceHard
Save to ▾
Show answer
Use Azure Policy with deployIfNotExists definitions, such as the built-in initiatives for enabling resource logs to a Log Analytics workspace by category group. Assign them at the management group, create a remediation task for existing resources and let new resources be configured automatically. This avoids teams forgetting to enable logs, which is common when resources are created outside the pipeline.
196

How do you design monitoring for a production microservices app on AKS?

Monitoring, Cost and GovernanceHard
Save to ▾
Show answer
Enable Container Insights and Managed Prometheus with Managed Grafana for cluster and pod metrics. Instrument services with OpenTelemetry sending to Application Insights for distributed tracing. Send logs to a central Log Analytics workspace using cheaper table plans for verbose logs. Define SLOs for latency and error rate, alert on them through action groups and build dashboards and runbooks for common failures.
197

Your Log Analytics bill is very high. How do you reduce it?

Monitoring, Cost and GovernanceHard
Save to ▾
Show answer
Run the usage query on the Usage table to see which tables and resources ingest most. Remove debug or duplicate logs at the source, use data collection rules with transformations to drop columns or filter rows, and move verbose tables to Basic or Auxiliary plans. Set a daily cap for non-production workspaces, shorten interactive retention and use commitment tiers if ingestion is steady above 100 GB per day.
198

Design a disaster recovery plan for a VM-based application in Central India.

Monitoring, Cost and GovernanceHard
Save to ▾
Show answer
Agree RPO and RTO with the business. Replicate VMs to South India with Azure Site Recovery, configure recovery plans that start the database first, then app and web tiers, and pre-create the network. Use Traffic Manager or Front Door for DNS failover. Back up data separately with Azure Backup in case of corruption. Run test failovers into an isolated VNet every quarter.
199

Users say an API is failing but no alert fired. What do you change?

Monitoring, Cost and GovernanceHard
Save to ▾
Show answer
Check whether alerts measured the right signal: CPU alerts miss application errors. Add alerts on user-facing SLIs, such as failed request rate, p95 latency and availability tests from multiple locations in Application Insights. Make sure the action group has correct recipients and that alert processing rules are not suppressing it. Review the incident timeline and add the missing signals to the on-call runbook.
200

How do you enforce governance across 50 subscriptions?

Monitoring, Cost and GovernanceHard
Save to ▾
Show answer
Organise subscriptions under management groups and assign initiatives at the top: allowed regions, required tags, diagnostics, no public IPs in corp zones, Defender plans on. Use deny for critical rules and audit for the rest, with exemptions tracked. Deploy policy as code from a repo. Report compliance and secure score monthly, and use Resource Graph for inventory and cost dashboards across all subscriptions.

Frequently asked questions

What jobs can I get after learning Microsoft Azure?

Freshers usually start as cloud support associates, junior Azure administrators or cloud engineers in IT service companies and managed service providers. With one to three years of practice you can move into Azure administrator, Azure developer, DevOps engineer or cloud security engineer roles. Senior professionals become solutions architects or cloud consultants. Demand is strong because many Indian companies and global capability centres run Microsoft workloads that are moving to Azure.

Who is eligible to learn Azure?

Anyone with basic computer knowledge can start. Graduates in B.Tech, BCA, MCA, B.Sc IT and similar fields have an advantage, and working professionals from system administration, networking, testing or development switch to Azure regularly. Knowing basic networking, Linux or Windows commands and one scripting language such as Python or PowerShell helps, but these basics are covered early in the course.

How long does it take to learn Azure for a job?

With consistent practice of two to three hours a day, most learners cover the fundamentals in a month and become job-ready for entry-level roles in three to four months. Hands-on labs matter more than reading, so plan to build projects such as a hub-spoke network, an App Service with Azure SQL and a Bicep pipeline. Senior architecture skills take several years of real project experience.

Which Azure certification should I do first?

AZ-900 Azure Fundamentals is a good first step if you are new to cloud, though it is optional. For jobs, AZ-104 Azure Administrator is the most valued associate certification for infrastructure roles, while AZ-204 suits developers. Later, AZ-400 for DevOps, AZ-500 for security and AZ-305 for architects add weight. Microsoft associate and expert certifications need a free online renewal assessment every year.

Is coding required for Azure roles?

Administrator and support roles need scripting rather than programming: Azure CLI, PowerShell, Bash and Bicep or Terraform templates. Developer and DevOps roles need real coding in languages like C#, Python, Java or JavaScript plus YAML pipelines. Learning at least one scripting language well makes you faster and more valuable in every Azure role, because automation is expected in modern cloud teams.

Azure or AWS: which should I learn first?

Both are in demand in India. Azure is very strong in enterprises, banks and IT service companies that use Microsoft products, while AWS leads in startups and many product companies. Core cloud concepts like networking, identity, storage and IaC transfer well between them. Choose based on the jobs you are targeting, learn one deeply first, then pick up the second, since multi-cloud skills are increasingly valued.