Microsoft Azure Interview Questions for 5 Years Experience
40 questions with answers for candidates with 5 years of experience — 22 medium, 18 hard.
What interviewers expect: 5 years experience
At five years, interviews move to solution design and leadership. Expect whiteboard questions on landing zones, multi-region disaster recovery, identity strategy with PIM and Conditional Access, data platform choices and security posture. You should explain RPO and RTO trade-offs, estimate costs and describe incidents you led with clear postmortems. Expect deep follow-up questions.
This set is weighted towards Identity and Security (6), Azure Storage (6), DevOps and Infrastructure as Code (6), Azure Databases (5).
Landing zones Multi-region DR Security architecture Incident leadership
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Serverless is a vCore option in General Purpose and Hyperscale that autoscales between a minimum and maximum vCore range and bills per second for compute used. In General Purpose it can auto-pause after an idle period and charge only for storage, then resume on the next connection with a short delay. It suits dev databases and apps with intermittent use, not steady heavy workloads.
Sentinel is Microsoft's cloud-native SIEM and SOAR built on Log Analytics. It ingests logs through connectors from Entra ID, Defender, Azure activity, firewalls and third-party sources, runs analytics rules written in KQL to raise incidents, and uses playbooks built on Logic Apps to automate responses like disabling a user. Cost depends on data ingestion, so filter noisy logs and use basic or auxiliary log tiers.
03
Create an Azure SQL Database with Entra-only authentication using Azure CLI.
Create the logical server with an Entra admin group and no SQL logins, then the database:
az sql server create -g rg-data -n sql-shop-prod -l centralindia \
--enable-ad-only-auth \
--external-admin-principal-type Group \
--external-admin-name grp-sql-admins \
--external-admin-sid <group-object-id>
az sql db create -g rg-data -s sql-shop-prod -n shopdb \
--edition GeneralPurpose --family Gen5 --capacity 2 \
--zone-redundant true --backup-storage-redundancy Zone
04
What are soft delete, versioning and immutable storage for blobs?
Soft delete keeps deleted blobs or containers for a retention period so you can restore them. Versioning saves the previous version automatically each time a blob is overwritten. Immutable storage applies time-based retention or legal hold policies in WORM mode, so nobody, not even an admin, can delete or change data until it expires. Regulated firms use immutability for audit records and ransomware protection.
Use Entra ID integration with Kubernetes RBAC and disable local accounts. Make the API server private or restrict authorized IP ranges. Run workloads with Workload ID instead of secrets, keep secrets in Key Vault through the CSI driver, and apply Azure Policy for Kubernetes to block privileged pods. Enable Defender for Containers, use network policies, scan images in ACR and route egress through Azure Firewall.
06
Your company needs a reliable private link from its Pune datacenter to Azure. What do you propose?
Propose ExpressRoute through a provider at the Pune or Mumbai peering location with private peering into a hub VNet in Central India, sized for current and forecast bandwidth. Add a site-to-site VPN as a failover path, or a second ExpressRoute circuit at another peering location for higher resilience. Use BGP for route exchange, and encrypt traffic with MACsec or IPsec if compliance requires.
07
Your company is choosing between Bicep and Terraform for its Azure estate. What would you recommend?
Bicep is Azure-only, needs no state file, supports new resource features immediately and has native what-if previews. Terraform works across many clouds and SaaS providers, has a huge module ecosystem, and keeps a state file that must be stored securely, for example in a Blob Storage backend with locking. Choose Bicep for Azure-only teams and Terraform for multi-cloud or existing Terraform skills.
08
How do you decide between IaaS and PaaS for migrating an on-premises application?
Start with constraints. If the app needs OS-level access, custom drivers or legacy software, a lift-and-shift to VMs is fastest. If it is a standard .NET, Java or Node web app with SQL Server, App Service plus Azure SQL removes patching and gives built-in scaling. Many teams lift and shift first to meet a datacenter exit date, then modernise to PaaS in a later phase.
09
Design a highly available web tier for an e-commerce site during a festival sale.
Run the app on App Service Premium v3 or a VM Scale Set spread across three availability zones in Central India. Put Azure Front Door in front for global load balancing, WAF and caching of static content, with a secondary region on standby. Pre-scale before the sale using scheduled rules, add Redis for sessions and catalogue caching, and load test with Azure Load Testing beforehand.
10
Write the commands to create an AKS cluster with a system and a user node pool.
Create the cluster with Azure CNI overlay and the system pool across zones, then add a user pool for apps:
az aks create -g rg-aks-prod -n aks-prod \
--network-plugin azure --network-plugin-mode overlay \
--nodepool-name system --node-count 3 --zones 1 2 3 \
--enable-managed-identity --attach-acr acrshopprod \
--generate-ssh-keys
az aks nodepool add -g rg-aks-prod --cluster-name aks-prod \
-n apps --mode User --node-count 3 --zones 1 2 3 \
--enable-cluster-autoscaler --min-count 3 --max-count 10
11
How do you reference Key Vault secrets in App Service app settings?
Enable a managed identity on the app, grant it Key Vault Secrets User on the vault, then set the app setting value to a Key Vault reference: @Microsoft.KeyVault(SecretUri=https://kv-shop-prod.vault.azure.net/secrets/SqlPassword/). The app reads it as a normal environment variable. Omitting the version makes App Service pick up rotated secrets automatically within about a day, or on restart.
12
How do you give an external auditor read-only access to your Azure environment for two weeks?
Invite the auditor as a B2B guest user in Entra ID, add them to a group, and assign the Reader role, plus Security Reader if they review Defender findings, at the required scope through PIM with a two-week expiry. Require MFA through Conditional Access for guests. Avoid sharing accounts. After the audit, an access review or expiry removes access automatically, with all activity logged.
Strong guarantees linearizable reads but adds latency across regions. Bounded staleness lets reads lag by a set number of versions or time. Session, the default, guarantees read-your-own-writes within a client session. Consistent prefix ensures reads never see writes out of order. Eventual is fastest and cheapest with no ordering guarantee. Most apps use Session; stronger levels cost more RUs and latency.
14
Tell me about a time you set up monitoring that caught a problem early.
Situation: our order service had silent failures that customers reported hours later. Task: detect them first. Action: I added Application Insights availability tests and a log alert on failed dependency calls to the payment gateway, routed to Teams and on-call. Result: two weeks later the alert caught an expired partner certificate within five minutes, and we fixed it before most users noticed.
Peering connects two VNets over the Microsoft backbone with low latency, either in the same region or globally. Traffic stays private and is billed per GB. Peering is not transitive: if A peers with B and B peers with C, A cannot reach C. To route through a hub, use a network virtual appliance or Azure Firewall with user-defined routes, or use Azure Virtual WAN.
ADLS Gen2 is a storage account with hierarchical namespace enabled, adding real directories, atomic renames and POSIX-style ACLs on top of Blob Storage. It is the storage layer for analytics engines such as Azure Databricks, Synapse and Microsoft Fabric. Directory operations become fast, which matters for Spark jobs. You keep Blob pricing and tiers but must plan ACLs and RBAC together.
17
What is the difference between a service endpoint and a private endpoint?
A service endpoint extends the VNet identity to a PaaS service so its firewall can allow your subnet, but the service still uses its public IP. A private endpoint puts a private IP from your subnet on a specific resource instance, so traffic never needs the public endpoint and works from peered networks and on-premises. Private endpoints are preferred for strict security but need private DNS setup.
18
Write an Azure Pipelines YAML that builds a .NET app and deploys it to App Service.
A SAS is a signed URL token granting limited access to storage for a set time and permissions, such as read-only for one blob for one hour. A user delegation SAS is signed with Entra ID credentials and is the most secure. A service SAS and an account SAS are signed with the account key. Always use HTTPS, short expiry and stored access policies so tokens can be revoked.
20
What is the what-if operation in Bicep deployments?
What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.
21
Describe a production incident you handled and what you learned.
Situation: an App Service API began returning 502 errors during peak hours. Task: restore service and find the root cause. Action: I scaled out to stop impact, then found in Application Insights that outbound SQL connections were exhausting SNAT ports. I added connection pooling and VNet integration with a NAT gateway. Result: errors stopped, and I wrote a postmortem and added a SNAT alert.
22
Your pipeline takes 40 minutes. How do you speed it up?
Profile which stages are slow. Cache dependencies like NuGet or npm packages, run unit tests and linting in parallel jobs, and split slow integration tests to run only on main or nightly. Use self-hosted or Managed DevOps Pools agents with warm caches for big builds, build container images with layer caching, and deploy only changed services in a monorepo using path filters.
Workload identity federation lets external workloads such as GitHub Actions, Kubernetes pods or other clouds get Entra ID tokens by exchanging their own OIDC tokens, without storing client secrets. You add a federated credential on an app registration or user-assigned managed identity that trusts a specific issuer and subject, such as a repo branch. AKS Workload ID uses this for pods to access Azure resources.
24
What are RPO and RTO and how do they guide Azure designs?
RPO, recovery point objective, is the maximum acceptable data loss measured in time. RTO, recovery time objective, is how long recovery may take. A daily backup gives an RPO of up to 24 hours. Site Recovery gives an RPO of seconds to minutes and an RTO of minutes to hours. SQL failover groups give an RPO of seconds. Lower RPO and RTO cost more, so agree targets per application.
25
Tell me about a time you improved database performance.
Situation: our reports page took 14 seconds to load on Azure SQL. Task: bring it under two seconds. Action: Query Store showed one query scanning a 40 million row table. I added a covering index, rewrote a correlated subquery as a join and cached the result in Redis for five minutes. Result: load time fell to about 800 ms and DTU usage dropped, so we avoided a tier upgrade.
26
Should you use Cosmos DB or Azure SQL for a new e-commerce application?
Use Azure SQL for orders, payments and inventory, which need joins, transactions and strong consistency. Use Cosmos DB for high-volume, flexible-schema data such as product catalogue, shopping carts, user activity or session data needing global low latency. Many systems combine both. If the team knows SQL well and scale is moderate, starting with Azure SQL alone is simpler and cheaper.
27
How do you create a private endpoint for a storage account?
Create the private endpoint in the app subnet for the blob sub-resource, link the private DNS zone privatelink.blob.core.windows.net to the VNet, and disable public network access on the account:
az network private-endpoint create -g rg-net -n pe-st-blob \
--vnet-name vnet-hub --subnet snet-pe \
--private-connection-resource-id <storage-id> \
--group-id blob --connection-name st-blob
Then test that the name resolves to a 10.x address.
28
Design storage for an app storing user documents that must stay in India for 7 years.
Use a storage account in Central India with ZRS, or GZRS paired with South India which keeps data inside India. Apply time-based immutability for seven years on the archive container and lifecycle rules to move older files to Cool and Archive tiers. Encrypt with customer-managed keys in Key Vault if compliance asks, use private endpoints, and log access to Log Analytics for audits.
29
A deployment to production failed halfway. How do you design pipelines to handle this?
Make deployments idempotent so rerunning the same template converges to the right state. Use slot swaps or blue-green so the old version keeps serving until the new one passes health checks, and roll back by swapping back. Keep database migrations backward compatible, using expand and contract, so the old code still works. Add smoke tests and automatic rollback, and alert the team with logs.
The hub VNet holds shared services: Azure Firewall, VPN or ExpressRoute gateways, Bastion and DNS resolvers. Each workload gets its own spoke VNet peered to the hub, with UDRs sending traffic through the firewall. This centralises security and connectivity while isolating workloads. For many regions and branches, Azure Virtual WAN provides a Microsoft-managed hub with automatic transit routing.
31
How do you design an Azure subscription strategy for a large enterprise with many business units?
Use management groups that mirror governance needs rather than the org chart, for example Platform, Corp landing zones, Online landing zones and Sandbox. Give each application or business unit its own subscriptions per environment to isolate quotas, cost and blast radius. Automate subscription vending with pre-wired networking, policy and RBAC. Keep the hierarchy shallow, ideally three or four levels, to avoid policy confusion.
32
Your team of four engineers must run 12 containerised microservices. Would you choose AKS or Azure Container Apps?
AKS gives full Kubernetes: custom operators, service meshes, node pool control and any Helm chart, but you own upgrades and cluster operations. Container Apps is serverless containers built on Kubernetes, KEDA and Envoy, with scale to zero, revisions, traffic splitting and Dapr, without exposing the Kubernetes API. Pick Container Apps for microservices and APIs with a small ops team, and AKS when you need deep platform control.
Azure Backup protects data by taking scheduled backups of VMs, SQL and SAP HANA in VMs, Azure Files, blobs, disks and on-premises servers into Recovery Services or Backup vaults, with retention policies, soft delete and immutability. Azure Site Recovery replicates whole VMs continuously to another region or from on-premises to Azure for disaster recovery, with recovery plans for orchestrated failover. Backup is for restoring data; Site Recovery is for business continuity.
34
How would you upgrade an AKS cluster in production with minimal downtime?
Check the release notes and API deprecations, then upgrade a non-prod cluster first. Set Pod Disruption Budgets and multiple replicas so draining is safe. Upgrade the control plane, then node pools one at a time using max surge so new nodes join before old ones drain. Use planned maintenance windows and auto-upgrade channels for patches. For major risk, run a blue-green cluster and switch traffic.
Situation: three freshers joined my team without pipeline experience. Task: make them productive in a month. Action: I created a small sample repo with a Bicep template and YAML pipeline, paired with each one on their first pull request, set review checklists and let them own one non-production pipeline each. Result: within five weeks all three were shipping changes independently and one improved our caching.
36
Your Log Analytics bill is very high. How do you reduce it?
Run the usage query on the Usage table to see which tables and resources ingest most. Remove debug or duplicate logs at the source, use data collection rules with transformations to drop columns or filter rows, and move verbose tables to Basic or Auxiliary plans. Set a daily cap for non-production workspaces, shorten interactive retention and use commitment tiers if ingestion is steady above 100 GB per day.
37
An application on a VM must access a storage account without any keys. How do you set it up?
Enable a system-assigned or user-assigned managed identity on the VM. Assign the identity the least role needed, such as Storage Blob Data Reader on the specific container. In code, use DefaultAzureCredential or ManagedIdentityCredential from the Azure SDK. Then disable shared key access on the account. The token is fetched from the local metadata endpoint and rotated automatically by Azure.
A NAT Gateway provides outbound internet connectivity for a subnet using one or more static public IPs. It gives a large pool of SNAT ports, avoiding the port exhaustion common with default outbound or Load Balancer outbound rules, and gives a fixed IP that partners can allowlist. Since default outbound access is being retired for new VNets, explicit outbound methods like NAT Gateway are recommended.
39
How does encryption at rest and in transit work in Azure?
All Azure Storage, managed disks and Azure SQL data is encrypted at rest with AES-256 by default using Microsoft-managed keys. You can switch to customer-managed keys in Key Vault for control over rotation and revocation, and use double encryption or confidential computing for stricter needs. In transit, services use TLS 1.2 or higher, and you should enforce HTTPS only and minimum TLS version settings.
40
Write an Azure PowerShell command to find all VMs without an env tag.
Filter Get-AzVM output on the Tags hashtable and export the result for review:
Connect-AzAccount
Get-AzVM | Where-Object {
-not $_.Tags -or -not $_.Tags.ContainsKey('env')
} | Select-Object Name, ResourceGroupName, Location |
Export-Csv untagged-vms.csv -NoTypeInformation
For large estates, Azure Resource Graph queries are faster across many subscriptions.
Frequently asked questions
What is asked in Microsoft Azure interviews for 5 years of experience?
At five years, interviews move to solution design and leadership. Expect whiteboard questions on landing zones, multi-region disaster recovery, identity strategy with PIM and Conditional Access, data platform choices and security posture. You should explain RPO and RTO trade-offs, estimate costs and describe incidents you led with clear postmortems. Expect deep follow-up questions.
How many questions should I practise before a Microsoft Azure interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 5 years of experience?
Focus first on Landing zones, Multi-region DR, Security architecture, Incident leadership.