Skip to content
Microsoft Azure
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Azure DevOps Engineer Interview Questions & Answers

40 questions for Azure DevOps Engineer interviews — 6 easy, 27 medium, 7 hard.

About the Azure DevOps Engineer role

Azure DevOps engineers automate infrastructure and releases. They write Bicep or Terraform modules, design YAML pipelines in Azure DevOps or GitHub Actions, manage AKS clusters and container registries, and set up monitoring and rollback strategies. They work closely with developers and security teams. The role maps to AZ-400 and is one of the best-paid mid-level cloud roles in India. Strong scripting skills are expected.

Bicep and Terraform YAML pipelines AKS and ACR Git branching Monitoring and alerts
Solved for this roleStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is Azure Resource Graph?

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Azure Resource Graph is a fast query service over resource metadata across all subscriptions you can access, using KQL. It is used for inventory, compliance checks and finding orphaned resources, such as unattached disks or public IPs, much faster than looping through APIs. The portal's All resources view and Azure Policy compliance use it. Results reflect configuration, not performance metrics.
02

What is the difference between the activity log and resource logs?

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
The activity log records control-plane operations at subscription level, such as who created, updated or deleted a resource, and service health events. It is kept for 90 days unless exported. Resource logs record data-plane activity inside a resource, such as Key Vault secret reads or SQL audit events, and must be enabled with diagnostic settings to send them to Log Analytics, Storage or Event Hubs.
03

Your secure score in Defender for Cloud is low. How do you improve it?

Identity and SecurityMedium
Save to ▾
Show answer
Sort recommendations by the score increase and effort. Typical quick wins are enabling MFA for all privileged accounts, restricting management ports with just-in-time access, enabling endpoint protection and vulnerability assessment on VMs, and turning on diagnostic logs. Use Azure Policy to enforce fixes so new resources stay compliant. Assign owners and due dates through governance rules and track progress weekly.
04

Write a Resource Graph query to list unattached managed disks.

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Unattached disks keep billing, so this is a common cost check: Resources | where type =~ 'microsoft.compute/disks' | where properties.diskState =~ 'Unattached' | project name, resourceGroup, subscriptionId, sku = sku.name, sizeGb = properties.diskSizeGB Run it with az graph query -q or in the Resource Graph Explorer.
05

What is a Log Analytics workspace?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.
06

Write a GitHub Actions job that logs in to Azure with OIDC.

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Grant id-token write permission and use a federated credential on the app registration, so no secret is stored: permissions: id-token: write contents: read jobs: deploy: runs-on: ubuntu-latest environment: prod steps: - uses: actions/checkout@v4 - uses: azure/login@v2 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - run: az group list -o table
07

What is GitOps and how is it used with AKS?

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
GitOps treats a Git repository as the single source of truth for cluster configuration. An agent in the cluster, such as Flux, which AKS offers as a managed extension, or Argo CD, pulls manifests from Git and reconciles the cluster to match. Changes happen only through pull requests, which gives audit history and easy rollback by reverting commits. It also removes the need to give pipelines cluster admin credentials.
08

Explain Azure Functions hosting plans.

Azure ComputeMedium
Save to ▾
Show answer
Flex Consumption is the recommended serverless plan: it scales to zero, bills per execution and memory, supports VNet integration and always-ready instances. The older Consumption plan scales to zero with a default 5-minute timeout. Premium keeps pre-warmed instances to avoid cold starts and supports long runs. Dedicated runs on an App Service plan. Container Apps hosting runs functions as containers. Choose by cold start tolerance, networking and run duration.
09

What is the what-if operation in Bicep deployments?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.
10

What is Durable Functions and what patterns does it support?

Azure ComputeHard
Save to ▾
Show answer
Durable Functions is an extension that lets you write stateful workflows in code. An orchestrator function calls activity functions, and the framework checkpoints state to storage so it survives restarts. Patterns include function chaining, fan-out/fan-in, async HTTP APIs with status polling, monitors and human interaction with timeouts. Orchestrator code must be deterministic, so avoid DateTime.Now or random values inside it.
11

What is the difference between a VPN Gateway and ExpressRoute?

Azure NetworkingMedium
Save to ▾
Show answer
A VPN Gateway creates encrypted IPsec tunnels over the public internet, for site-to-site or point-to-site connections, and is quick and cheap to set up. ExpressRoute is a private dedicated connection through a connectivity provider with predictable latency and bandwidth up to 100 Gbps, but it does not encrypt by default. Many companies use ExpressRoute as primary and a VPN as backup.
12

Write a KQL query to find who deleted resources in the last 7 days.

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Use the AzureActivity table, filtering on successful delete operations: AzureActivity | where TimeGenerated > ago(7d) | where OperationNameValue endswith '/DELETE' | where ActivityStatusValue == 'Success' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, _ResourceId | order by TimeGenerated desc
13

Tell me about a time you fixed a networking issue under pressure.

Azure NetworkingMedium
Save to ▾
Show answer
Situation: after a firewall change, payment APIs in our spoke could not reach a partner endpoint. Task: restore traffic quickly. Action: I used Network Watcher next hop and firewall logs in Log Analytics, found the new rule collection had higher priority and denied the partner FQDN, and added an explicit allow. Result: service recovered in 25 minutes, and we added pipeline-based firewall rule reviews.
14

Explain DTU and vCore purchasing models in Azure SQL Database.

Azure DatabasesMedium
Save to ▾
Show answer
DTU bundles CPU, memory and IO into fixed Basic, Standard and Premium sizes and is simple for small apps. The vCore model lets you choose compute and storage separately, with General Purpose, Business Critical and Hyperscale tiers, provisioned or serverless compute, and Azure Hybrid Benefit for existing SQL licences. vCore is recommended for most production workloads because it is transparent and easier to compare with on-premises.
15

What is a service connection in Azure Pipelines?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
16

What are deployment slots in App Service?

Azure ComputeMedium
Save to ▾
Show answer
Slots are live copies of an app with their own hostname, available from the Standard tier. You deploy to a staging slot, warm it up and test, then swap it with production. The swap redirects traffic with near-zero downtime and can be reversed by swapping back. Slot-specific settings, such as a staging database connection string, stay with the slot instead of moving during the swap.
17

How do you work with the security team when they reject your network design?

Azure NetworkingEasy
Save to ▾
Show answer
Situation: security rejected my design because the app used public endpoints for storage and SQL. Task: meet their standards without delaying launch. Action: I met them, listed their controls, and redesigned with private endpoints, Azure Firewall egress and WAF, then shared a diagram and cost impact. Result: they approved it in one review cycle, and the design became a reusable team template.
18

What are RPO and RTO and how do they guide Azure designs?

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
RPO, recovery point objective, is the maximum acceptable data loss measured in time. RTO, recovery time objective, is how long recovery may take. A daily backup gives an RPO of up to 24 hours. Site Recovery gives an RPO of seconds to minutes and an RTO of minutes to hours. SQL failover groups give an RPO of seconds. Lower RPO and RTO cost more, so agree targets per application.
19

You need to run a nightly 3-hour data processing job cheaply. Which compute would you choose?

Azure ComputeHard
Save to ▾
Show answer
Avoid the old Consumption plan because of its execution timeout. Good options are Azure Batch or a VM Scale Set using Spot VMs with checkpointing, Container Apps jobs that run on a schedule and stop afterwards, or Durable Functions breaking work into short activities. The key is paying only while the job runs and tolerating restarts. Store input and output in Blob Storage so any worker can resume.
20

How do you enforce governance across 50 subscriptions?

Monitoring, Cost and GovernanceHard
Save to ▾
Show answer
Organise subscriptions under management groups and assign initiatives at the top: allowed regions, required tags, diagnostics, no public IPs in corp zones, Defender plans on. Use deny for critical rules and audit for the rest, with exemptions tracked. Deploy policy as code from a repo. Report compliance and secure score monthly, and use Resource Graph for inventory and cost dashboards across all subscriptions.
21

How do you handle disagreement with a developer about database design?

Azure DatabasesEasy
Save to ▾
Show answer
Situation: a developer wanted to store all order data as JSON blobs in one table. Task: agree on a design that would scale. Action: I listened to his reason, faster development, then built a small benchmark showing filter and reporting queries on both designs and proposed relational tables with a JSON column for flexible attributes. Result: we adopted the hybrid, and reporting stayed fast.
22

How do you manage Terraform state securely on Azure?

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
Store state in an Azure Storage backend with a dedicated container per environment. Blob leases provide state locking so two runs cannot write at once. Use Entra ID authentication instead of access keys, enable versioning and soft delete to recover from corruption, restrict access to the pipeline identity, and use private endpoints. Never commit state files, because they can contain secrets in plain text.
23

Write a basic Terraform configuration for a resource group and VNet with remote state.

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Configure the azurerm backend and provider, then resources: terraform { backend "azurerm" { resource_group_name = "rg-tfstate" storage_account_name = "sttfstateprod" container_name = "state" key = "network.tfstate" use_azuread_auth = true } } provider "azurerm" { features {} } resource "azurerm_resource_group" "net" { name = "rg-net-prod" location = "centralindia" } resource "azurerm_virtual_network" "hub" { name = "vnet-hub" location = azurerm_resource_group.net.location resource_group_name = azurerm_resource_group.net.name address_space = ["10.0.0.0/16"] }
24

A developer's service principal secret was committed to a public GitHub repo. What do you do?

Identity and SecurityMedium
Save to ▾
Show answer
Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.
25

What is Azure Cost Management?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
Cost Management analyses and controls Azure spending. Cost analysis shows cost by service, resource group, tag or meter with forecasts. Budgets send alerts at thresholds such as 80% and 100% of actual or forecast spend and can trigger automation. Exports send daily cost data to Storage for reporting in Power BI. It also shows reservation utilisation and supports FinOps practices like showback and chargeback to teams.
26

Your company is choosing between Bicep and Terraform for its Azure estate. What would you recommend?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Bicep is Azure-only, needs no state file, supports new resource features immediately and has native what-if previews. Terraform works across many clouds and SaaS providers, has a huge module ecosystem, and keeps a state file that must be stored securely, for example in a Blob Storage backend with locking. Choose Bicep for Azure-only teams and Terraform for multi-cloud or existing Terraform skills.
27

How do you mentor juniors on DevOps practices?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Situation: three freshers joined my team without pipeline experience. Task: make them productive in a month. Action: I created a small sample repo with a Bicep template and YAML pipeline, paired with each one on their first pull request, set review checklists and let them own one non-production pipeline each. Result: within five weeks all three were shipping changes independently and one improved our caching.
28

What is a managed identity and what types exist?

Identity and SecurityEasy
Save to ▾
Show answer
A managed identity is an Entra ID identity that Azure creates and rotates for a resource, so code can get tokens without storing secrets. A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource you can attach to many resources and that survives their deletion. User-assigned is better when several apps share access or when you pre-create role assignments.
29

How would you upgrade an AKS cluster in production with minimal downtime?

Azure ComputeHard
Save to ▾
Show answer
Check the release notes and API deprecations, then upgrade a non-prod cluster first. Set Pod Disruption Budgets and multiple replicas so draining is safe. Upgrade the control plane, then node pools one at a time using max surge so new nodes join before old ones drain. Use planned maintenance windows and auto-upgrade channels for patches. For major risk, run a blue-green cluster and switch traffic.
30

How do you configure autoscale for an App Service plan?

Azure ComputeMedium
Save to ▾
Show answer
In the plan's Scale out settings, choose rules-based autoscale or automatic scaling. A typical rule set: scale out by 1 instance when average CPU exceeds 70% for 10 minutes, scale in by 1 when below 30% for 10 minutes, minimum 2 and maximum 10 instances. Always pair scale-out with a scale-in rule and a cool-down period so the plan does not flap between sizes.
31

Write a Bicep file that creates a storage account with parameters.

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Parameters keep the template reusable across environments: param location string = resourceGroup().location @minLength(3) @maxLength(24) param name string @allowed(['Standard_LRS', 'Standard_ZRS']) param sku string = 'Standard_ZRS' resource st 'Microsoft.Storage/storageAccounts@2023-05-01' = { name: name location: location sku: { name: sku } kind: 'StorageV2' properties: { minimumTlsVersion: 'TLS1_2' allowBlobPublicAccess: false supportsHttpsTrafficOnly: true } } output blobEndpoint string = st.properties.primaryEndpoints.blob
32

Someone changed production resources manually in the portal. How do you detect and handle drift?

DevOps and Infrastructure as CodeHard
Save to ▾
Show answer
Detect drift by running Bicep what-if or terraform plan on a schedule and failing the run on unexpected differences, and by alerting on activity log write events from users rather than pipeline identities. Decide whether the manual change was a valid hotfix; if so, add it to code, otherwise redeploy to restore. Then reduce write access in production to the pipeline identity plus PIM break-glass.
33

Users report the website on App Service is slow every morning at 9 AM. How do you investigate?

Azure ComputeMedium
Save to ▾
Show answer
Check Application Insights for response times, failed requests and dependency calls around 9 AM, and App Service plan metrics for CPU, memory and instance count. A morning spike often means traffic surge with autoscale reacting too slowly, cold start after idle, or a slow SQL query under load. Fixes include scheduled scale-out before 9 AM, Always On, a higher tier, caching with Redis or query tuning.
34

Finance wants each team to pay for its own Azure usage. How do you implement this?

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Make tags like costcenter and team mandatory through Azure Policy with deny for new resources and modify to inherit from resource groups. Prefer separate subscriptions per team where possible, since subscription boundaries are the cleanest cost split. Use Cost Management views and scheduled exports grouped by tag and subscription into Power BI. Share untaggable costs like shared networking with an agreed split.
35

Generate a user delegation SAS for one blob with Azure CLI.

Azure StorageMedium
Save to ▾
Show answer
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity: az storage blob generate-sas \ --account-name stshopprod --container-name invoices \ --name inv-1001.pdf --permissions r \ --expiry 2026-11-12T18:00Z --https-only \ --auth-mode login --as-user --full-uri The caller needs a role that allows generating user delegation keys.
36

Write a KQL query to find VMs with average CPU above 80% in the last hour.

Monitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights: Perf | where TimeGenerated > ago(1h) | where ObjectName == 'Processor' and CounterName == '% Processor Time' | where InstanceName == '_Total' | summarize avgCpu = avg(CounterValue) by Computer | where avgCpu > 80 | order by avgCpu desc
37

How do you create a budget with alerts for a subscription?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
In Cost Management, choose Budgets, set the scope to the subscription or a resource group, a monthly amount and alert conditions such as 50%, 80% and 100% of actual cost and 100% of forecast. Add email recipients and an action group that can notify Teams or run an automation. Budgets do not stop spending on their own, so pair them with automation or policy if needed.
38

What are ARM deployment modes and scopes?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.
39

Explain stages, jobs, steps and environments in YAML pipelines.

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
A pipeline has stages, such as Build, Test and DeployProd, that run in sequence or parallel. Each stage has jobs, which run on one agent, and each job has steps, which are tasks or scripts. Deployment jobs target environments, which can have approvals, checks, business hours and deployment history. Templates let teams reuse stages and jobs across many repositories.
40

What deployment strategies can you use for Azure apps?

DevOps and Infrastructure as CodeMedium
Save to ▾
Show answer
Rolling updates replace instances in batches, used by VMSS and Kubernetes. Blue-green runs two environments and switches traffic, as with App Service slots. Canary sends a small percentage of traffic to the new version first, using slot traffic routing, Front Door weights or Container Apps revisions. Feature flags in App Configuration let you deploy code dark and enable features gradually without redeploying.

Frequently asked questions

What does a Azure DevOps Engineer do?

Azure DevOps engineers automate infrastructure and releases. They write Bicep or Terraform modules, design YAML pipelines in Azure DevOps or GitHub Actions, manage AKS clusters and container registries, and set up monitoring and rollback strategies. They work closely with developers and security teams. The role maps to AZ-400 and is one of the best-paid mid-level cloud roles in India. Strong scripting skills are expected.

Which skills are tested in a Azure DevOps Engineer interview?

Expect questions on Bicep and Terraform, YAML pipelines, AKS and ACR, Git branching, Monitoring and alerts. Most rounds also ask you to explain a project and solve one practical problem live.

How do I prepare for a Azure DevOps Engineer interview?

Revise DevOps and Infrastructure as Code, Azure Compute, Monitoring, Cost and Governance first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.

Topic sheets for this role

DevOps and Infrastructure as Code questionsAzure Compute questionsMonitoring, Cost and Governance questions

Other roles

Azure Cloud Support AssociateAzure AdministratorAzure DeveloperAzure Security EngineerAzure Solutions Architect

More ways to practise

Company-wise Microsoft Azure questionsExperience-wise Microsoft Azure questionsRole-wise Microsoft Azure questionsCity-wise Microsoft Azure questionsMost asked Microsoft Azure questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsMicrosoft Azure mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsMicrosoft Azure topic sheets