Microsoft Azure Interview Questions for 7 Years Experience
40 questions with answers for candidates with 7 years of experience — 18 medium, 22 hard.
What interviewers expect: 7 years experience
At seven years, you are evaluated as a lead or architect. Questions focus on enterprise migrations, hybrid connectivity with ExpressRoute, platform engineering for many teams, FinOps practices and compliance requirements like RBI data localisation. Interviewers want structured answers using the Well-Architected Framework and evidence of influencing stakeholders. Prepare a strong migration case study.
This set is weighted towards DevOps and Infrastructure as Code (7), Azure Databases (7), Monitoring, Cost and Governance (6), Azure Fundamentals (5).
Enterprise migration strategy Hybrid networking Platform engineering FinOps and compliance
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Finance wants each team to pay for its own Azure usage. How do you implement this?
Make tags like costcenter and team mandatory through Azure Policy with deny for new resources and modify to inherit from resource groups. Prefer separate subscriptions per team where possible, since subscription boundaries are the cleanest cost split. Use Cost Management views and scheduled exports grouped by tag and subscription into Power BI. Share untaggable costs like shared networking with an agreed split.
Sentinel is Microsoft's cloud-native SIEM and SOAR built on Log Analytics. It ingests logs through connectors from Entra ID, Defender, Azure activity, firewalls and third-party sources, runs analytics rules written in KQL to raise incidents, and uses playbooks built on Logic Apps to automate responses like disabling a user. Cost depends on data ingestion, so filter noisy logs and use basic or auxiliary log tiers.
03
Explain the 5 Rs (or 6 Rs) of cloud migration in an Azure context.
Rehost moves VMs as-is using Azure Migrate. Refactor makes small changes, such as moving a web app to App Service. Rearchitect changes the design, for example splitting into microservices on AKS. Rebuild rewrites as cloud-native. Replace swaps the app for SaaS. Some lists add Retire or Retain. Azure Migrate assessments help choose per workload based on dependencies, cost and readiness.
04
Describe a production incident you handled and what you learned.
Situation: an App Service API began returning 502 errors during peak hours. Task: restore service and find the root cause. Action: I scaled out to stop impact, then found in Application Insights that outbound SQL connections were exhausting SNAT ports. I added connection pooling and VNet integration with a NAT gateway. Result: errors stopped, and I wrote a postmortem and added a SNAT alert.
05
A deployment to production failed halfway. How do you design pipelines to handle this?
Make deployments idempotent so rerunning the same template converges to the right state. Use slot swaps or blue-green so the old version keeps serving until the new one passes health checks, and roll back by swapping back. Keep database migrations backward compatible, using expand and contract, so the old code still works. Add smoke tests and automatic rollback, and alert the team with logs.
06
Design a highly available web tier for an e-commerce site during a festival sale.
Run the app on App Service Premium v3 or a VM Scale Set spread across three availability zones in Central India. Put Azure Front Door in front for global load balancing, WAF and caching of static content, with a secondary region on standby. Pre-scale before the sale using scheduled rules, add Redis for sessions and catalogue caching, and load test with Azure Load Testing beforehand.
07
What are active geo-replication and failover groups?
Active geo-replication creates readable secondary databases in other regions, up to four, with asynchronous replication and manual failover per database. Failover groups manage a group of databases together, provide read-write and read-only listener endpoints that stay the same after failover, and support automatic failover by policy. Applications should use the failover group listener so connection strings do not change during a regional failover.
08
What is Azure Files and when would you use Azure File Sync?
Azure Files provides fully managed SMB and NFS shares that VMs and on-premises machines can mount, useful for lift-and-shift of apps expecting a file server. Azure File Sync installs an agent on Windows Servers to sync shares to Azure Files and use cloud tiering, keeping hot files locally and old files in the cloud. It helps branch offices share data without large local storage.
09
How would you protect a public web application from attacks like SQL injection and DDoS?
Put Azure Front Door Premium or Application Gateway with WAF in front of the app, using the managed Default Rule Set based on OWASP plus bot protection and rate limits. Enable Azure DDoS Network Protection on the VNet for layer 3 and 4 attacks on public IPs. Lock the app so it accepts traffic only from Front Door, using access restrictions with the service tag and the Front Door ID header.
It is Microsoft's guidance for building quality workloads, organised into five pillars: reliability, security, cost optimization, operational excellence and performance efficiency. Each pillar has design principles, checklists and trade-offs. Azure Advisor and the Well-Architected Review tool score workloads against it. In design interviews, structure answers by pillar to show you considered failure, security and cost, not only features.
11
What is Azure Firewall and how is it different from an NSG?
Azure Firewall is a managed, stateful, centralised firewall with network and application rules, FQDN filtering, threat intelligence and, in the Premium SKU, TLS inspection and IDPS. NSGs are distributed basic filters on subnets and NICs. Typically NSGs control traffic within and between subnets, while Azure Firewall in a hub controls internet egress and cross-spoke traffic with central logging.
12
Write a basic Terraform configuration for a resource group and VNet with remote state.
Configure the cluster's outbound type as a managed or user-assigned NAT Gateway with a static public IP, or route egress through Azure Firewall using userDefinedRouting so all traffic leaves from the firewall's public IP. Share that IP with partners. NAT Gateway is simpler and gives many SNAT ports, while Azure Firewall adds FQDN filtering and logging for compliance.
14
Someone changed production resources manually in the portal. How do you detect and handle drift?
Detect drift by running Bicep what-if or terraform plan on a schedule and failing the run on unexpected differences, and by alerting on activity log write events from users rather than pipeline identities. Decide whether the manual change was a valid hotfix; if so, add it to code, otherwise redeploy to restore. Then reduce write access in production to the pipeline identity plus PIM break-glass.
15
How do you manage secrets and configuration for many environments in pipelines?
Keep non-secret settings in parameter files or Azure App Configuration per environment. Keep secrets in Key Vault per environment and let apps read them via managed identity or Key Vault references, so pipelines rarely handle them. When pipelines need secrets, link variable groups to Key Vault and use environment approvals. Never echo secrets in logs and prefer federated identities over stored credentials.
16
How do you let an App Service connect to Azure SQL using its managed identity?
Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles:
CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [app-shop-prod];
ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod];
Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.
17
Tell me about a time you led a migration of workloads to Azure.
Situation: our company had to exit a leased datacenter in nine months with 120 VMs. Task: lead the compute migration. Action: I ran Azure Migrate assessments, grouped VMs by dependency into waves, rehosted most with Azure Migrate and moved web apps to App Service, with rollback plans for each wave. Result: we finished a month early and cut monthly run cost by about 25% after right-sizing.
18
A SQL database must survive a full regional outage with under 1 minute data loss. Design it.
Use Azure SQL Database Business Critical or General Purpose with zone redundancy in Central India, plus a failover group to South India. Geo-replication is asynchronous with typical lag under a few seconds, meeting the RPO. Point the app to the failover group listener, deploy the app tier in both regions behind Front Door, and test failover drills quarterly. Document RTO for the automatic policy grace period.
19
Design identity and access for a multi-team Azure platform in a bank.
Use Entra ID groups mapped to roles per team and environment, with no direct user assignments. Make production access eligible-only through PIM with approval and MFA, and require phishing-resistant MFA and compliant devices via Conditional Access. Use managed identities and workload federation for apps and pipelines. Keep break-glass accounts excluded from policies but monitored. Run quarterly access reviews and stream logs to Sentinel.
The hub VNet holds shared services: Azure Firewall, VPN or ExpressRoute gateways, Bastion and DNS resolvers. Each workload gets its own spoke VNet peered to the hub, with UDRs sending traffic through the firewall. This centralises security and connectivity while isolating workloads. For many regions and branches, Azure Virtual WAN provides a Microsoft-managed hub with automatic transit routing.
21
What deployment strategies can you use for Azure apps?
Rolling updates replace instances in batches, used by VMSS and Kubernetes. Blue-green runs two environments and switches traffic, as with App Service slots. Canary sends a small percentage of traffic to the new version first, using slot traffic routing, Front Door weights or Container Apps revisions. Feature flags in App Configuration let you deploy code dark and enable features gradually without redeploying.
22
How would you set up a landing zone for a company moving to Azure?
Follow the Cloud Adoption Framework landing zone design. Create a management group hierarchy (platform, landing zones, sandbox, decommissioned), separate subscriptions for identity, management and connectivity, and a hub-spoke or Virtual WAN network. Apply Azure Policy for allowed regions, tagging and diagnostics, and assign RBAC through Entra groups. Deploy it all as code with Bicep or Terraform so new app subscriptions can be vended consistently.
23
What is the difference between the activity log and resource logs?
The activity log records control-plane operations at subscription level, such as who created, updated or deleted a resource, and service health events. It is kept for 90 days unless exported. Resource logs record data-plane activity inside a resource, such as Key Vault secret reads or SQL audit events, and must be enabled with diagnostic settings to send them to Log Analytics, Storage or Event Hubs.
24
How do you handle a failed release that affected customers?
Situation: a release broke login for some mobile users on a Friday evening. Task: restore service fast and prevent repeats. Action: I swapped the App Service slot back to the previous version within ten minutes, informed support, then reproduced the bug in staging and found a missing config value. Result: we added config validation and smoke tests on login to the pipeline, and wrote a blameless postmortem.
25
Your Cosmos DB requests are failing with 429 errors. What do you do?
429 means requests exceeded provisioned RU/s. Check Insights for normalized RU consumption per partition. If one partition is hot, the partition key is the problem. If usage is even, enable autoscale or raise RU/s. Reduce RU cost by using point reads instead of queries, excluding unused paths from indexing and smaller documents. SDKs retry 429s automatically, so tune retry options too.
Strong guarantees linearizable reads but adds latency across regions. Bounded staleness lets reads lag by a set number of versions or time. Session, the default, guarantees read-your-own-writes within a client session. Consistent prefix ensures reads never see writes out of order. Eventual is fastest and cheapest with no ordering guarantee. Most apps use Session; stronger levels cost more RUs and latency.
Flex Consumption is the recommended serverless plan: it scales to zero, bills per execution and memory, supports VNet integration and always-ready instances. The older Consumption plan scales to zero with a default 5-minute timeout. Premium keeps pre-warmed instances to avoid cold starts and supports long runs. Dedicated runs on an App Service plan. Container Apps hosting runs functions as containers. Choose by cold start tolerance, networking and run duration.
28
Design storage for an app storing user documents that must stay in India for 7 years.
Use a storage account in Central India with ZRS, or GZRS paired with South India which keeps data inside India. Apply time-based immutability for seven years on the archive container and lifecycle rules to move older files to Cool and Archive tiers. Encrypt with customer-managed keys in Key Vault if compliance asks, use private endpoints, and log access to Log Analytics for audits.
29
Write a lifecycle management rule to tier and delete log blobs.
Use Azure SQL for orders, payments and inventory, which need joins, transactions and strong consistency. Use Cosmos DB for high-volume, flexible-schema data such as product catalogue, shopping carts, user activity or session data needing global low latency. Many systems combine both. If the team knows SQL well and scale is moderate, starting with Azure SQL alone is simpler and cheaper.
31
How do you decide between IaaS and PaaS for migrating an on-premises application?
Start with constraints. If the app needs OS-level access, custom drivers or legacy software, a lift-and-shift to VMs is fastest. If it is a standard .NET, Java or Node web app with SQL Server, App Service plus Azure SQL removes patching and gives built-in scaling. Many teams lift and shift first to meet a datacenter exit date, then modernise to PaaS in a later phase.
32
How do you enforce governance across 50 subscriptions?
Organise subscriptions under management groups and assign initiatives at the top: allowed regions, required tags, diagnostics, no public IPs in corp zones, Defender plans on. Use deny for critical rules and audit for the rest, with exemptions tracked. Deploy policy as code from a repo. Report compliance and secure score monthly, and use Resource Graph for inventory and cost dashboards across all subscriptions.
33
How do you design an Azure subscription strategy for a large enterprise with many business units?
Use management groups that mirror governance needs rather than the org chart, for example Platform, Corp landing zones, Online landing zones and Sandbox. Give each application or business unit its own subscriptions per environment to isolate quotas, cost and blast radius. Automate subscription vending with pre-wired networking, policy and RBAC. Keep the hierarchy shallow, ideally three or four levels, to avoid policy confusion.
34
How would you upgrade an AKS cluster in production with minimal downtime?
Check the release notes and API deprecations, then upgrade a non-prod cluster first. Set Pod Disruption Budgets and multiple replicas so draining is safe. Upgrade the control plane, then node pools one at a time using max surge so new nodes join before old ones drain. Use planned maintenance windows and auto-upgrade channels for patches. For major risk, run a blue-green cluster and switch traffic.
GitOps treats a Git repository as the single source of truth for cluster configuration. An agent in the cluster, such as Flux, which AKS offers as a managed extension, or Argo CD, pulls manifests from Git and reconciles the cluster to match. Changes happen only through pull requests, which gives audit history and easy rollback by reverting commits. It also removes the need to give pipelines cluster admin credentials.
36
Design a disaster recovery plan for a VM-based application in Central India.
Agree RPO and RTO with the business. Replicate VMs to South India with Azure Site Recovery, configure recovery plans that start the database first, then app and web tiers, and pre-create the network. Use Traffic Manager or Front Door for DNS failover. Back up data separately with Azure Backup in case of corruption. Run test failovers into an isolated VNet every quarter.
Azure Resource Graph is a fast query service over resource metadata across all subscriptions you can access, using KQL. It is used for inventory, compliance checks and finding orphaned resources, such as unattached disks or public IPs, much faster than looping through APIs. The portal's All resources view and Azure Policy compliance use it. Results reflect configuration, not performance metrics.
38
Explain DTU and vCore purchasing models in Azure SQL Database.
DTU bundles CPU, memory and IO into fixed Basic, Standard and Premium sizes and is simple for small apps. The vCore model lets you choose compute and storage separately, with General Purpose, Business Critical and Hyperscale tiers, provisioned or serverless compute, and Azure Hybrid Benefit for existing SQL licences. vCore is recommended for most production workloads because it is transparent and easier to compare with on-premises.
39
Tell me about a time you set up monitoring that caught a problem early.
Situation: our order service had silent failures that customers reported hours later. Task: detect them first. Action: I added Application Insights availability tests and a log alert on failed dependency calls to the payment gateway, routed to Teams and on-call. Result: two weeks later the alert caught an expired partner certificate within five minutes, and we fixed it before most users noticed.
40
How do you migrate 200 TB of on-premises data to Azure when the internet link is slow?
Calculate transfer time first: 200 TB over a 1 Gbps link at 70% efficiency takes almost a month. Use Azure Data Box devices shipped to your site, copy data locally and send them back for upload into the storage account. Then run AzCopy or Azure File Sync to sync the changes made after shipping. For ongoing large flows, consider ExpressRoute.
Frequently asked questions
What is asked in Microsoft Azure interviews for 7 years of experience?
At seven years, you are evaluated as a lead or architect. Questions focus on enterprise migrations, hybrid connectivity with ExpressRoute, platform engineering for many teams, FinOps practices and compliance requirements like RBI data localisation. Interviewers want structured answers using the Well-Architected Framework and evidence of influencing stakeholders. Prepare a strong migration case study.
How many questions should I practise before a Microsoft Azure interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 7 years of experience?
Focus first on Enterprise migration strategy, Hybrid networking, Platform engineering, FinOps and compliance.