Capgemini Microsoft Azure Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Capgemini hiring for Microsoft Azure roles
Capgemini is a French multinational IT services and consulting group providing technology, engineering, cloud and data services. India is its largest employee base, supporting projects in testing, application development, SAP, data engineering and analytics for global clients. It hires freshers as analysts and software engineers, and experienced professionals in QA automation, data and cloud roles.
For Microsoft Azure roles, this Capgemini practice set focuses most on Azure Fundamentals (6), Identity and Security (5), Azure Networking (5), Azure Databases (5). It has 17 easy, 12 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Paris, France
Main India offices
Mumbai, Bengaluru, Pune, Chennai, Hyderabad
Capgemini Microsoft Azure interview process
Online assessment (pseudocode + English)
Game-based aptitude test
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for CapgeminiStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the difference between the activity log and resource logs?
The activity log records control-plane operations at subscription level, such as who created, updated or deleted a resource, and service health events. It is kept for 90 days unless exported. Resource logs record data-plane activity inside a resource, such as Key Vault secret reads or SQL audit events, and must be enabled with diagnostic settings to send them to Log Analytics, Storage or Event Hubs.
02
What compute options does Azure offer and when do you choose each?
Virtual Machines give full OS control for legacy or custom software. Virtual Machine Scale Sets add autoscaling of identical VMs. App Service hosts web apps and APIs as PaaS. Azure Functions runs event-driven code serverlessly. AKS runs Kubernetes for container microservices, and Container Apps runs containers without managing Kubernetes. Batch handles large parallel jobs. Choose based on control needed, scaling pattern and team skills.
03
How does encryption at rest and in transit work in Azure?
All Azure Storage, managed disks and Azure SQL data is encrypted at rest with AES-256 by default using Microsoft-managed keys. You can switch to customer-managed keys in Key Vault for control over rotation and revocation, and use double encryption or confidential computing for stricter needs. In transit, services use TLS 1.2 or higher, and you should enforce HTTPS only and minimum TLS version settings.
04
What is the difference between CapEx and OpEx, and how does Azure change it?
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
05
Explain the 5 Rs (or 6 Rs) of cloud migration in an Azure context.
Rehost moves VMs as-is using Azure Migrate. Refactor makes small changes, such as moving a web app to App Service. Rearchitect changes the design, for example splitting into microservices on AKS. Rebuild rewrites as cloud-native. Replace swaps the app for SaaS. Some lists add Retire or Retain. Azure Migrate assessments help choose per workload based on dependencies, cost and readiness.
A VNet is your private, isolated network in an Azure region, defined by one or more address spaces such as 10.10.0.0/16 and divided into subnets. Resources in a VNet communicate privately and Azure provides default routing between subnets and to the internet. VNets connect to each other with peering and to on-premises with VPN Gateway or ExpressRoute. Azure reserves five IP addresses in every subnet.
Azure Arc extends the Azure control plane to servers, Kubernetes clusters and data services running on-premises or in other clouds. Once connected, those machines appear as Azure resources, so you can apply Azure Policy, RBAC, tags, Defender for Cloud, Update Manager and monitoring to them. It suits hybrid companies that keep some servers in their own datacenter but want one governance model.
Azure DNS hosts public DNS zones on Microsoft's global name servers so you can manage records like A and CNAME with RBAC. Private DNS zones resolve names only inside linked VNets, used for internal names and private endpoints. For hybrid name resolution, Azure DNS Private Resolver lets on-premises DNS forward queries into Azure and Azure forward queries back on-premises without custom DNS VMs.
Relational options are Azure SQL Database, Azure SQL Managed Instance, SQL Server on VMs, and Azure Database for PostgreSQL and MySQL flexible servers. Azure Cosmos DB is the globally distributed NoSQL and vector database. Azure Cache for Redis and Azure Managed Redis provide in-memory caching. For analytics there are Synapse, Fabric and Azure Data Explorer. Choose by data model, compatibility and how much operations you want to manage.
10
Create a Linux VM with Azure CLI using SSH keys and no public IP.
Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion:
az vm create \
--resource-group rg-app-dev \
--name vm-api-01 \
--image Ubuntu2204 \
--size Standard_D2s_v5 \
--vnet-name vnet-dev --subnet snet-app \
--public-ip-address '' \
--admin-username azureuser \
--generate-ssh-keys \
--zone 1
11
What are regions, region pairs and availability zones?
A region is a set of datacenters in one geography, such as Central India in Pune. Availability zones are physically separate datacenter groups inside a region with independent power, cooling and network; supported regions have three. Many regions are paired with another region in the same geography for platform updates and geo-replication. Use zones for datacenter failure and a second region for regional disasters.
A managed identity is an Entra ID identity that Azure creates and rotates for a resource, so code can get tokens without storing secrets. A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource you can attach to many resources and that survives their deletion. User-assigned is better when several apps share access or when you pre-create role assignments.
Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.
14
What is the Hyperscale tier of Azure SQL Database?
Hyperscale separates compute from a distributed, log-based storage layer, so databases can grow up to 128 TB with fast backups through snapshots and quick restores regardless of size. You can add up to four high-availability replicas and named replicas for read scale-out. Scaling compute takes minutes. It suits large OLTP and mixed workloads, and its pricing is now competitive with General Purpose.
15
Assign a role to a group at resource group scope with Azure CLI.
Look up the group object ID, then create the role assignment with the narrowest scope:
GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv)
az role assignment create \
--assignee-object-id $GROUP_ID \
--assignee-principal-type Group \
--role Contributor \
--scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev
Assigning to groups instead of users keeps access easy to audit.
16
How do you let an App Service connect to Azure SQL using its managed identity?
Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles:
CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [app-shop-prod];
ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod];
Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.
17
What is Azure Policy and how is it different from RBAC?
RBAC controls who can do actions. Azure Policy controls what resources and settings are allowed, whoever deploys them. Policies use effects such as deny, audit, append, modify, deployIfNotExists and auditIfNotExists. For example, deny public IPs on VMs or deploy diagnostic settings automatically. Group policies into initiatives, assign them at management groups and view compliance on the dashboard.
18
Why do you want to build a career in Microsoft Azure?
Situation: during my internship I saw most clients running Microsoft workloads like Windows Server, SQL Server and Active Directory. Task: I wanted skills that match that demand. Action: I cleared AZ-900, then studied AZ-104 and built labs with VNets, App Service and Bicep. Result: I can now deploy and troubleshoot real environments, and I want to grow toward an Azure architect role over the next few years.
19
How do you reference Key Vault secrets in App Service app settings?
Enable a managed identity on the app, grant it Key Vault Secrets User on the vault, then set the app setting value to a Key Vault reference: @Microsoft.KeyVault(SecretUri=https://kv-shop-prod.vault.azure.net/secrets/SqlPassword/). The app reads it as a normal environment variable. Omitting the version makes App Service pick up rotated secrets automatically within about a day, or on restart.
20
Create a VNet with two subnets and an NSG rule using Azure CLI.
Situation: a release deadline pushed us to skip enabling backups and soft delete on a new storage account. Task: deliver on time without risking customer files. Action: I explained to the lead that enabling soft delete, versioning and a backup policy took under an hour through our Bicep module, and added it to the same pull request. Result: we shipped on time, and a month later versioning saved a file a user overwrote.
Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.
23
Which Network Watcher tools do you use to troubleshoot connectivity?
IP flow verify tells you if an NSG rule allows or denies a specific packet and which rule matched. Next hop shows where routing sends traffic. Connection troubleshoot tests reachability from a VM to an endpoint. Effective security rules and effective routes show the combined result on a NIC. VNet flow logs record traffic for analysis with Traffic Analytics. Packet capture records traffic on a VM.
Redis is an in-memory key-value store used for caching frequent database reads, storing user sessions, rate limiting, leaderboards and pub/sub. Caching a product catalogue can cut database load and bring latency from tens of milliseconds to around one. Use the cache-aside pattern with sensible TTLs. Microsoft now steers new deployments to Azure Managed Redis, which is based on Redis Enterprise.
25
Explain the hierarchy of management groups, subscriptions, resource groups and resources.
A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.
26
What is Bicep and how does it relate to ARM templates?
Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.
27
What is Azure Cosmos DB and which APIs does it support?
Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.
28
What is Azure App Service and what does an App Service plan define?
App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
Peering must be created from each side. Allow forwarded traffic if a hub firewall routes it:
az network vnet peering create -g rg-net -n hub-to-spoke1 \
--vnet-name vnet-hub --remote-vnet vnet-spoke1 \
--allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit
az network vnet peering create -g rg-net -n spoke1-to-hub \
--vnet-name vnet-spoke1 --remote-vnet vnet-hub \
--allow-vnet-access --allow-forwarded-traffic --use-remote-gateways
Tips to crack the Capgemini Microsoft Azure interview
Practise game-based cognitive tests and pseudocode questions, which are commonly part of Capgemini's online assessment.
Prepare a short explanation of your projects, focusing on your role, tools used and what you would improve.
Learn about Capgemini's engineering arm and its work in sectors like automotive and financial services to show interest.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Capgemini interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Capgemini Microsoft Azure interview?
Candidates usually go through 4 stages: Online assessment (pseudocode + English); Game-based aptitude test; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Capgemini Microsoft Azure interview?
This practice set leans on Azure Fundamentals (6), Identity and Security (5), Azure Networking (5), Azure Databases (5). Revise those first, then practise explaining one or two of your own projects end to end, because most Capgemini interviewers ask you to walk through real work.
Are these the exact questions asked at Capgemini?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like Capgemini's. They are not a leaked or verified list of past questions.
Where does Capgemini hire Microsoft Azure professionals in India?
Capgemini has large teams in Mumbai, Bengaluru, Pune, Chennai, Hyderabad. Openings and locations change often, so check the Capgemini careers page and filter by city and experience.