40 questions with answers for candidates with Freshers — 23 easy, 17 medium.
What interviewers expect: freshers
Interviewers check cloud basics and hands-on practice: service models, subscriptions and resource groups, VMs, storage redundancy, VNets and NSGs, RBAC roles and simple CLI commands. Expect questions about your projects and labs, and why you chose Azure. AZ-900 or AZ-104 certification helps shortlisting, but you must explain what you built and how you fixed problems.
This set is weighted towards Azure Fundamentals (10), Azure Compute (7), Azure Storage (5), Azure Networking (5).
Azure fundamentals and pricing VMs and App Service Storage and networking basics CLI and portal labs
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you build and push a container image to ACR without Docker installed?
Use ACR Tasks to build in the cloud from your source folder:
az acr build --registry acrshopprod \
--image shop-api:$(git rev-parse --short HEAD) .
ACR Tasks can also rebuild automatically on a Git commit or when the base image is updated, which helps patch OS vulnerabilities without manual work.
02
What is Microsoft Azure and which service models does it offer?
Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.
ARM is the deployment and management layer of Azure. Every request from the portal, CLI, PowerShell, SDKs or Bicep goes through the ARM API, which authenticates the caller, checks RBAC and Policy, and forwards the call to the resource provider. Because all tools hit the same API, you get consistent results, tagging, locks and activity logs no matter how the change was made.
Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.
05
Explain the 5 Rs (or 6 Rs) of cloud migration in an Azure context.
Rehost moves VMs as-is using Azure Migrate. Refactor makes small changes, such as moving a web app to App Service. Rearchitect changes the design, for example splitting into microservices on AKS. Rebuild rewrites as cloud-native. Replace swaps the app for SaaS. Some lists add Retire or Retain. Azure Migrate assessments help choose per workload based on dependencies, cost and readiness.
06
What is Azure Files and when would you use Azure File Sync?
Azure Files provides fully managed SMB and NFS shares that VMs and on-premises machines can mount, useful for lift-and-shift of apps expecting a file server. Azure File Sync installs an agent on Windows Servers to sync shares to Azure Files and use cloud tiering, keeping hot files locally and old files in the cloud. It helps branch offices share data without large local storage.
Relational options are Azure SQL Database, Azure SQL Managed Instance, SQL Server on VMs, and Azure Database for PostgreSQL and MySQL flexible servers. Azure Cosmos DB is the globally distributed NoSQL and vector database. Azure Cache for Redis and Azure Managed Redis provide in-memory caching. For analytics there are Synapse, Fabric and Azure Data Explorer. Choose by data model, compatibility and how much operations you want to manage.
08
Explain the built-in roles Owner, Contributor, Reader and User Access Administrator.
Owner has full access to resources and can assign roles to others. Contributor can create and manage all resources but cannot grant access or manage role assignments. Reader can only view resources. User Access Administrator can manage role assignments but not resources. Follow least privilege: most engineers need Contributor on their own resource groups and Reader elsewhere, with Owner held by very few people.
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
10
Your storage costs are growing fast because of old logs. What do you do?
Use Storage insights and Cost Analysis to find which containers and tiers drive cost. Enable last access tracking and apply lifecycle rules that move logs to Cool, then Cold or Archive, and delete after the retention period required by policy. Check for unnecessary GRS replication on non-critical data and leftover snapshots. Compress logs before upload and stop verbose logging at the source.
11
Write a Bicep file that creates a storage account with parameters.
Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
Service Health shows the health of Azure services in your regions: service issues happening now, planned maintenance, health advisories and security advisories, plus retirement notices. Resource Health shows if a specific resource, such as a VM, is available and why not. Set activity log alerts on Service Health so the team gets notified for incidents affecting their subscriptions and regions, instead of finding out from users.
16
What is Azure App Service and what does an App Service plan define?
App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.
17
What are Virtual Machine Scale Sets and their orchestration modes?
VMSS manages a group of load-balanced VMs that scale in or out automatically on metrics or schedules. Flexible orchestration, now the default, lets you mix VM sizes, spread across zones and fault domains, and manage instances like normal VMs. Uniform mode uses identical instances from one model and is optimised for large stateless fleets. Use VMSS for stateless web tiers, batch workers and custom container hosts.
Series are optimised for workload type: B for burstable low-cost, D for general purpose, E for memory heavy like SQL Server, F for compute intensive, L for storage throughput, N for GPU and M for very large memory such as SAP HANA. Start from CPU, memory, disk IOPS and network needs, test with real load, then right-size using Azure Advisor recommendations after a few weeks of metrics.
19
Store and read a secret from Key Vault using Azure CLI.
Create an RBAC-enabled vault, grant yourself Key Vault Secrets Officer, then set and read the secret:
az keyvault create -g rg-sec -n kv-shop-prod \
--location centralindia --enable-rbac-authorization true
az keyvault secret set --vault-name kv-shop-prod \
--name SqlPassword --value 'S3cure#Pass'
az keyvault secret show --vault-name kv-shop-prod \
--name SqlPassword --query value -o tsv
20
Create a VNet with two subnets and an NSG rule using Azure CLI.
An NSG is a stateful packet filter with allow and deny rules on source, destination, port and protocol, processed by priority from 100 to 4096, lower number first. It attaches to a subnet, a NIC or both, and both must allow the traffic. Default rules allow VNet-to-VNet and outbound internet traffic and deny other inbound traffic. Service tags and application security groups simplify rules.
22
An order system needs reliable, ordered messaging between services. Would you pick Queue Storage or Service Bus, and why?
Queue Storage is cheap and simple, holds millions of messages up to 64 KB each, and suits basic background work. Service Bus is an enterprise broker with queues and topics, FIFO through sessions, duplicate detection, dead-lettering, transactions and messages up to 100 MB on Premium. Choose Service Bus for ordered or business-critical messaging like orders and payments, and Storage queues for simple, high-volume job queues.
Cost Management analyses and controls Azure spending. Cost analysis shows cost by service, resource group, tag or meter with forecasts. Budgets send alerts at thresholds such as 80% and 100% of actual or forecast spend and can trigger automation. Exports send daily cost data to Storage for reporting in Power BI. It also shows reservation utilisation and supports FinOps practices like showback and chargeback to teams.
Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.
25
Create a Linux VM with Azure CLI using SSH keys and no public IP.
Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion:
az vm create \
--resource-group rg-app-dev \
--name vm-api-01 \
--image Ubuntu2204 \
--size Standard_D2s_v5 \
--vnet-name vnet-dev --subnet snet-app \
--public-ip-address '' \
--admin-username azureuser \
--generate-ssh-keys \
--zone 1
26
Write a Cosmos DB NoSQL query to get a customer's orders above 5000 rupees.
Filter on the partition key so the query hits one partition and stays cheap:
SELECT c.id, c.orderDate, c.total
FROM c
WHERE c.customerId = @customerId
AND c.total > 5000
ORDER BY c.orderDate DESC
ORDER BY on orderDate needs a range index, which the default indexing policy includes. Check the RU charge in the response headers.
27
A VM is not reachable over RDP. Walk through your troubleshooting.
Check the VM is running and passed boot diagnostics via the serial console or screenshot. Use Network Watcher IP flow verify and effective security rules to see if an NSG blocks port 3389. Check the route table, any firewall and whether the VM has a public IP or you should use Bastion. Inside the OS, use Run Command to check the RDP service and Windows firewall. Reset the configuration if needed.
Azure Bastion is a managed PaaS service that gives RDP and SSH access to VMs through the browser or native client over TLS, without giving the VMs public IPs. It is deployed into a dedicated subnet named AzureBastionSubnet in the VNet. This removes exposed ports 3389 and 22 from the internet, a common attack path. Pair it with just-in-time access from Defender for Cloud for tighter control.
29
What is a resource group and what rules apply to it?
A resource group is a logical container for resources that share a lifecycle, for example everything for one app environment. A resource belongs to exactly one group, groups cannot be nested, and deleting a group deletes everything inside it. The group has a location that stores metadata, but resources inside can live in other regions. Resources can be moved between groups for most resource types.
30
An application on a VM must access a storage account without any keys. How do you set it up?
Enable a system-assigned or user-assigned managed identity on the VM. Assign the identity the least role needed, such as Storage Blob Data Reader on the specific container. In code, use DefaultAzureCredential or ManagedIdentityCredential from the Azure SDK. Then disable shared key access on the account. The token is fetched from the local metadata endpoint and rotated automatically by Azure.
31
How do you work with the security team when they reject your network design?
Situation: security rejected my design because the app used public endpoints for storage and SQL. Task: meet their standards without delaying launch. Action: I met them, listed their controls, and redesigned with private endpoints, Azure Firewall egress and WAF, then shared a diagram and cost impact. Result: they approved it in one review cycle, and the design became a reusable team template.
A managed identity is an Entra ID identity that Azure creates and rotates for a resource, so code can get tokens without storing secrets. A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource you can attach to many resources and that survives their deletion. User-assigned is better when several apps share access or when you pre-create role assignments.
33
Describe a time you had to choose between speed of delivery and data safety.
Situation: a release deadline pushed us to skip enabling backups and soft delete on a new storage account. Task: deliver on time without risking customer files. Action: I explained to the lead that enabling soft delete, versioning and a backup policy took under an hour through our Bicep module, and added it to the same pull request. Result: we shipped on time, and a month later versioning saved a file a user overwrote.
34
What is the difference between CapEx and OpEx, and how does Azure change it?
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
35
How do Azure SLAs work and how do you calculate a composite SLA?
An SLA is Microsoft's uptime commitment per service, with service credits if it is missed. When services depend on each other in series, multiply their SLAs. An App Service at 99.95% calling Azure SQL at 99.99% gives about 0.9995 x 0.9999 = 99.94%. Adding redundancy, such as a second region behind Front Door, raises the combined figure because both paths must fail together.
36
Why do you want to build a career in Microsoft Azure?
Situation: during my internship I saw most clients running Microsoft workloads like Windows Server, SQL Server and Active Directory. Task: I wanted skills that match that demand. Action: I cleared AZ-900, then studied AZ-104 and built labs with VNets, App Service and Bicep. Result: I can now deploy and troubleshoot real environments, and I want to grow toward an Azure architect role over the next few years.
Security duties are split between Microsoft and the customer. Microsoft always owns physical datacenters, hosts and the network fabric. The customer always owns data, identities, accounts and devices. The middle layers move with the service model: in IaaS you patch the OS and configure firewalls; in PaaS Microsoft patches the OS and runtime; in SaaS you mainly manage users and data.
38
Compare Azure Load Balancer, Application Gateway, Front Door and Traffic Manager.
Load Balancer works at layer 4 (TCP/UDP) inside a region. Application Gateway is a regional layer 7 load balancer with path routing, TLS termination and an optional WAF. Front Door is a global layer 7 entry point with anycast, CDN caching and WAF. Traffic Manager is DNS-based global routing for any protocol. Use Front Door for global web apps and Load Balancer for non-HTTP traffic.
39
What is the difference between an availability set and an availability zone?
An availability set spreads VMs across fault domains (separate racks, power and switches) and update domains (rebooted at different times) inside one datacenter, giving a 99.95% SLA. Availability zones place VMs in physically separate datacenters within a region, giving 99.99%. Zones protect against a full datacenter outage; availability sets only protect against rack and maintenance failures. New designs prefer zones where the region supports them.
40
Tell me about a time you learned a new Azure service quickly to deliver a task.
Situation: our team needed event-driven processing and nobody had used Azure Functions. Task: I had one week to build a proof of concept. Action: I completed the Microsoft Learn module, built a blob-triggered function in a sandbox subscription, added Application Insights and shared a short demo and runbook. Result: the POC was approved, went live in three weeks and replaced a polling VM, cutting cost noticeably.
Frequently asked questions
What is asked in Microsoft Azure interviews for Freshers?
Interviewers check cloud basics and hands-on practice: service models, subscriptions and resource groups, VMs, storage redundancy, VNets and NSGs, RBAC roles and simple CLI commands. Expect questions about your projects and labs, and why you chose Azure. AZ-900 or AZ-104 certification helps shortlisting, but you must explain what you built and how you fixed problems.
How many questions should I practise before a Microsoft Azure interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for Freshers?
Focus first on Azure fundamentals and pricing, VMs and App Service, Storage and networking basics, CLI and portal labs.