Azure developers build cloud applications using App Service, Functions, Container Apps, Cosmos DB, Azure SQL, Service Bus and Key Vault. They use the Azure SDKs with managed identities, add Application Insights telemetry and deploy through CI/CD pipelines. The role suits .NET, Java, Python or Node developers and maps to the AZ-204 certification, with demand at product companies and digital engineering firms.
App Service and Functions Cosmos DB and Azure SQL Azure SDK Managed identities Application Insights
Solved for this roleStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Read a blob in Python using DefaultAzureCredential.
DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored:
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient
url = 'https://stshopprod.blob.core.windows.net'
client = BlobServiceClient(url, credential=DefaultAzureCredential())
blob = client.get_blob_client('invoices', '2026/inv-1001.pdf')
data = blob.download_blob().readall()
print(len(data))
02
Users report the website on App Service is slow every morning at 9 AM. How do you investigate?
Check Application Insights for response times, failed requests and dependency calls around 9 AM, and App Service plan metrics for CPU, memory and instance count. A morning spike often means traffic surge with autoscale reacting too slowly, cold start after idle, or a slow SQL query under load. Fixes include scheduled scale-out before 9 AM, Always On, a higher tier, caching with Redis or query tuning.
03
How do you find and fix slow queries in Azure SQL Database?
Open Query Performance Insight or Query Store to find the top queries by CPU, duration and IO. Check execution plans for scans, missing indexes and parameter sniffing. Review automatic tuning recommendations to create indexes or force the last good plan. Query DMVs like sys.dm_exec_query_stats and sys.dm_db_resource_stats. If resources are maxed after tuning, scale up or add read replicas.
Relational options are Azure SQL Database, Azure SQL Managed Instance, SQL Server on VMs, and Azure Database for PostgreSQL and MySQL flexible servers. Azure Cosmos DB is the globally distributed NoSQL and vector database. Azure Cache for Redis and Azure Managed Redis provide in-memory caching. For analytics there are Synapse, Fabric and Azure Data Explorer. Choose by data model, compatibility and how much operations you want to manage.
05
Write a simple HTTP-triggered Azure Function in Python (v2 programming model).
The v2 model uses decorators in function_app.py, so no function.json is needed:
import azure.functions as func
app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION)
@app.route(route='hello', methods=['GET'])
def hello(req: func.HttpRequest) -> func.HttpResponse:
name = req.params.get('name', 'world')
return func.HttpResponse(f'Hello, {name}', status_code=200)
Callers pass the function key in the code query parameter or x-functions-key header.
06
An application on a VM must access a storage account without any keys. How do you set it up?
Enable a system-assigned or user-assigned managed identity on the VM. Assign the identity the least role needed, such as Storage Blob Data Reader on the specific container. In code, use DefaultAzureCredential or ManagedIdentityCredential from the Azure SDK. Then disable shared key access on the account. The token is fetched from the local metadata endpoint and rotated automatically by Azure.
07
A SQL database must survive a full regional outage with under 1 minute data loss. Design it.
Use Azure SQL Database Business Critical or General Purpose with zone redundancy in Central India, plus a failover group to South India. Geo-replication is asynchronous with typical lag under a few seconds, meeting the RPO. Point the app to the failover group listener, deploy the app tier in both regions behind Front Door, and test failover drills quarterly. Document RTO for the automatic policy grace period.
08
What are Virtual Machine Scale Sets and their orchestration modes?
VMSS manages a group of load-balanced VMs that scale in or out automatically on metrics or schedules. Flexible orchestration, now the default, lets you mix VM sizes, spread across zones and fault domains, and manage instances like normal VMs. Uniform mode uses identical instances from one model and is optimised for large stateless fleets. Use VMSS for stateless web tiers, batch workers and custom container hosts.
09
What are active geo-replication and failover groups?
Active geo-replication creates readable secondary databases in other regions, up to four, with asynchronous replication and manual failover per database. Failover groups manage a group of databases together, provide read-write and read-only listener endpoints that stay the same after failover, and support automatic failover by policy. Applications should use the failover group listener so connection strings do not change during a regional failover.
Flex Consumption is the recommended serverless plan: it scales to zero, bills per execution and memory, supports VNet integration and always-ready instances. The older Consumption plan scales to zero with a default 5-minute timeout. Premium keeps pre-warmed instances to avoid cold starts and supports long runs. Dedicated runs on an App Service plan. Container Apps hosting runs functions as containers. Choose by cold start tolerance, networking and run duration.
Serverless is a vCore option in General Purpose and Hyperscale that autoscales between a minimum and maximum vCore range and bills per second for compute used. In General Purpose it can auto-pause after an idle period and charge only for storage, then resume on the next connection with a short delay. It suits dev databases and apps with intermittent use, not steady heavy workloads.
Redis is an in-memory key-value store used for caching frequent database reads, storing user sessions, rate limiting, leaderboards and pub/sub. Caching a product catalogue can cut database load and bring latency from tens of milliseconds to around one. Use the cache-aside pattern with sensible TTLs. Microsoft now steers new deployments to Azure Managed Redis, which is based on Redis Enterprise.
13
Your Azure Function has slow first responses after idle periods. What can you do?
That is cold start: the plan scaled to zero and must load a new instance. Options are moving to Flex Consumption with always-ready instances or the Premium plan with pre-warmed instances, reducing package size and dependencies, and choosing a faster-starting runtime. A timer ping is a hack that is not reliable. For strict latency APIs, a dedicated plan or Container Apps with minimum replicas is better.
14
How do backups and point-in-time restore work in Azure SQL Database?
Azure takes full backups weekly, differential backups every 12 to 24 hours and log backups about every 10 minutes automatically. You can restore to any point within the short-term retention period of 1 to 35 days, default 7, as a new database. Long-term retention keeps weekly, monthly or yearly full backups for up to 10 years. Backup storage can be LRS, ZRS or geo-redundant.
15
How would you upgrade an AKS cluster in production with minimal downtime?
Check the release notes and API deprecations, then upgrade a non-prod cluster first. Set Pod Disruption Budgets and multiple replicas so draining is safe. Upgrade the control plane, then node pools one at a time using max surge so new nodes join before old ones drain. Use planned maintenance windows and auto-upgrade channels for patches. For major risk, run a blue-green cluster and switch traffic.
16
Design storage for an app storing user documents that must stay in India for 7 years.
Use a storage account in Central India with ZRS, or GZRS paired with South India which keeps data inside India. Apply time-based immutability for seven years on the archive container and lifecycle rules to move older files to Cool and Archive tiers. Encrypt with customer-managed keys in Key Vault if compliance asks, use private endpoints, and log access to Log Analytics for audits.
Slots are live copies of an app with their own hostname, available from the Standard tier. You deploy to a staging slot, warm it up and test, then swap it with production. The swap redirects traffic with near-zero downtime and can be reversed by swapping back. Slot-specific settings, such as a staging database connection string, stay with the slot instead of moving during the swap.
18
Write the commands to create an AKS cluster with a system and a user node pool.
Create the cluster with Azure CNI overlay and the system pool across zones, then add a user pool for apps:
az aks create -g rg-aks-prod -n aks-prod \
--network-plugin azure --network-plugin-mode overlay \
--nodepool-name system --node-count 3 --zones 1 2 3 \
--enable-managed-identity --attach-acr acrshopprod \
--generate-ssh-keys
az aks nodepool add -g rg-aks-prod --cluster-name aks-prod \
-n apps --mode User --node-count 3 --zones 1 2 3 \
--enable-cluster-autoscaler --min-count 3 --max-count 10
19
A developer ran a DELETE without a WHERE clause on production. How do you recover?
Stop further writes if possible and note the exact time of the mistake. Use point-in-time restore to create a new copy of the database from a minute before the delete. Then copy the missing rows back into production with INSERT SELECT across databases or a data export, rather than replacing the whole database, which would lose later legitimate changes. Afterwards restrict direct write access in production.
20
How would you reduce the cost of many idle dev and test databases?
Move them to serverless General Purpose with auto-pause, or into an elastic pool if they are always on but lightly used. Use Azure Hybrid Benefit if you own SQL licences, use the Azure Dev/Test pricing offer for non-production subscriptions, delete databases nobody has connected to in months, and use smaller backup retention and LRS backup storage for non-production.
21
What is the Hyperscale tier of Azure SQL Database?
Hyperscale separates compute from a distributed, log-based storage layer, so databases can grow up to 128 TB with fast backups through snapshots and quick restores regardless of size. You can add up to four high-availability replicas and named replicas for read scale-out. Scaling compute takes minutes. It suits large OLTP and mixed workloads, and its pricing is now competitive with General Purpose.
22
An order system needs reliable, ordered messaging between services. Would you pick Queue Storage or Service Bus, and why?
Queue Storage is cheap and simple, holds millions of messages up to 64 KB each, and suits basic background work. Service Bus is an enterprise broker with queues and topics, FIFO through sessions, duplicate detection, dead-lettering, transactions and messages up to 100 MB on Premium. Choose Service Bus for ordered or business-critical messaging like orders and payments, and Storage queues for simple, high-volume job queues.
23
How do you create a private endpoint for a storage account?
Create the private endpoint in the app subnet for the blob sub-resource, link the private DNS zone privatelink.blob.core.windows.net to the VNet, and disable public network access on the account:
az network private-endpoint create -g rg-net -n pe-st-blob \
--vnet-name vnet-hub --subnet snet-pe \
--private-connection-resource-id <storage-id> \
--group-id blob --connection-name st-blob
Then test that the name resolves to a 10.x address.
Situation: three freshers joined my team without pipeline experience. Task: make them productive in a month. Action: I created a small sample repo with a Bicep template and YAML pipeline, paired with each one on their first pull request, set review checklists and let them own one non-production pipeline each. Result: within five weeks all three were shipping changes independently and one improved our caching.
25
Tell me about a time you fixed a networking issue under pressure.
Situation: after a firewall change, payment APIs in our spoke could not reach a partner endpoint. Task: restore traffic quickly. Action: I used Network Watcher next hop and firewall logs in Log Analytics, found the new rule collection had higher priority and denied the partner FQDN, and added an explicit allow. Result: service recovered in 25 minutes, and we added pipeline-based firewall rule reviews.
26
A developer accidentally overwrote important files in Blob Storage. How do you recover and prevent it?
If versioning was on, promote the previous version; if soft delete was on, undelete within the retention period. Point-in-time restore can roll back a whole container if enabled. If none were enabled, recovery may only be from backups. Going forward, enable versioning, soft delete and Azure Backup for blobs, give developers read-only roles in production and route writes only through the application identity.
27
Explain the 5 Rs (or 6 Rs) of cloud migration in an Azure context.
Rehost moves VMs as-is using Azure Migrate. Refactor makes small changes, such as moving a web app to App Service. Rearchitect changes the design, for example splitting into microservices on AKS. Rebuild rewrites as cloud-native. Replace swaps the app for SaaS. Some lists add Retire or Retain. Azure Migrate assessments help choose per workload based on dependencies, cost and readiness.
28
What compute options does Azure offer and when do you choose each?
Virtual Machines give full OS control for legacy or custom software. Virtual Machine Scale Sets add autoscaling of identical VMs. App Service hosts web apps and APIs as PaaS. Azure Functions runs event-driven code serverlessly. AKS runs Kubernetes for container microservices, and Container Apps runs containers without managing Kubernetes. Batch handles large parallel jobs. Choose based on control needed, scaling pattern and team skills.
29
What is Durable Functions and what patterns does it support?
Durable Functions is an extension that lets you write stateful workflows in code. An orchestrator function calls activity functions, and the framework checkpoints state to storage so it survives restarts. Patterns include function chaining, fan-out/fan-in, async HTTP APIs with status polling, monitors and human interaction with timeouts. Orchestrator code must be deterministic, so avoid DateTime.Now or random values inside it.
30
How do you handle a failed release that affected customers?
Situation: a release broke login for some mobile users on a Friday evening. Task: restore service fast and prevent repeats. Action: I swapped the App Service slot back to the previous version within ten minutes, informed support, then reproduced the bug in staging and found a missing config value. Result: we added config validation and smoke tests on login to the pipeline, and wrote a blameless postmortem.
31
How would you protect storage accounts against ransomware?
Combine prevention and recovery. Use private endpoints, disable shared keys and public access, and restrict RBAC with PIM. Enable soft delete, versioning, change feed and point-in-time restore. For critical data, use immutable storage policies or vaulted Azure Backup with immutability and multi-user authorization so attackers cannot delete backups. Turn on Defender for Storage to detect malware uploads and unusual access.
32
Create an Azure SQL Database with Entra-only authentication using Azure CLI.
Create the logical server with an Entra admin group and no SQL logins, then the database:
az sql server create -g rg-data -n sql-shop-prod -l centralindia \
--enable-ad-only-auth \
--external-admin-principal-type Group \
--external-admin-name grp-sql-admins \
--external-admin-sid <group-object-id>
az sql db create -g rg-data -s sql-shop-prod -n shopdb \
--edition GeneralPurpose --family Gen5 --capacity 2 \
--zone-redundant true --backup-storage-redundancy Zone
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
34
How do you let an App Service connect to Azure SQL using its managed identity?
Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles:
CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [app-shop-prod];
ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod];
Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.
35
Create a Linux VM with Azure CLI using SSH keys and no public IP.
Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion:
az vm create \
--resource-group rg-app-dev \
--name vm-api-01 \
--image Ubuntu2204 \
--size Standard_D2s_v5 \
--vnet-name vnet-dev --subnet snet-app \
--public-ip-address '' \
--admin-username azureuser \
--generate-ssh-keys \
--zone 1
36
Describe a production incident you handled and what you learned.
Situation: an App Service API began returning 502 errors during peak hours. Task: restore service and find the root cause. Action: I scaled out to stop impact, then found in Application Insights that outbound SQL connections were exhausting SNAT ports. I added connection pooling and VNet integration with a NAT gateway. Result: errors stopped, and I wrote a postmortem and added a SNAT alert.
37
What is Azure Kubernetes Service (AKS) and what does Azure manage for you?
AKS is managed Kubernetes. Azure runs the control plane, including the API server and etcd, and handles upgrades and its availability. You manage node pools, which are VM scale sets, plus workloads, networking choices and add-ons. AKS integrates with Entra ID for cluster login, Azure CNI for pod networking, ACR for images, Key Vault via CSI driver and Azure Monitor Container Insights for logs and metrics.
38
Generate a user delegation SAS for one blob with Azure CLI.
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity:
az storage blob generate-sas \
--account-name stshopprod --container-name invoices \
--name inv-1001.pdf --permissions r \
--expiry 2026-11-12T18:00Z --https-only \
--auth-mode login --as-user --full-uri
The caller needs a role that allows generating user delegation keys.
Managed disks are block storage volumes for VMs that Azure manages as resources, with built-in redundancy. Types are Standard HDD for backups and dev, Standard SSD for light workloads, Premium SSD for production, Premium SSD v2 with independently tunable IOPS and throughput, and Ultra Disk for very high IOPS and low latency such as SAP HANA. Disks can be LRS or ZRS for some types.
ADLS Gen2 is a storage account with hierarchical namespace enabled, adding real directories, atomic renames and POSIX-style ACLs on top of Blob Storage. It is the storage layer for analytics engines such as Azure Databricks, Synapse and Microsoft Fabric. Directory operations become fast, which matters for Spark jobs. You keep Blob pricing and tiers but must plan ACLs and RBAC together.
Frequently asked questions
What does a Azure Developer do?
Azure developers build cloud applications using App Service, Functions, Container Apps, Cosmos DB, Azure SQL, Service Bus and Key Vault. They use the Azure SDKs with managed identities, add Application Insights telemetry and deploy through CI/CD pipelines. The role suits .NET, Java, Python or Node developers and maps to the AZ-204 certification, with demand at product companies and digital engineering firms.
Which skills are tested in a Azure Developer interview?
Expect questions on App Service and Functions, Cosmos DB and Azure SQL, Azure SDK, Managed identities, Application Insights. Most rounds also ask you to explain a project and solve one practical problem live.
How do I prepare for a Azure Developer interview?
Revise Azure Compute, Azure Databases, Azure Storage first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.