Hard Microsoft Azure Interview Questions

Show answer

Durable Functions is an extension that lets you write stateful workflows in code. An orchestrator function calls activity functions, and the framework checkpoints state to storage so it survives restarts. Patterns include function chaining, fan-out/fan-in, async HTTP APIs with status polling, monitors and human interaction with timeouts. Orchestrator code must be deterministic, so avoid DateTime.Now or random values inside it.

Your team of four engineers must run 12 containerised microservices. Would you choose AKS or Azure Container Apps?

Show answer

AKS gives full Kubernetes: custom operators, service meshes, node pool control and any Helm chart, but you own upgrades and cluster operations. Container Apps is serverless containers built on Kubernetes, KEDA and Envoy, with scale to zero, revisions, traffic splitting and Dapr, without exposing the Kubernetes API. Pick Container Apps for microservices and APIs with a small ops team, and AKS when you need deep platform control.

Write the commands to create an AKS cluster with a system and a user node pool.

Show answer

Create the cluster with Azure CNI overlay and the system pool across zones, then add a user pool for apps: az aks create -g rg-aks-prod -n aks-prod \ --network-plugin azure --network-plugin-mode overlay \ --nodepool-name system --node-count 3 --zones 1 2 3 \ --enable-managed-identity --attach-acr acrshopprod \ --generate-ssh-keys az aks nodepool add -g rg-aks-prod --cluster-name aks-prod \ -n apps --mode User --node-count 3 --zones 1 2 3 \ --enable-cluster-autoscaler --min-count 3 --max-count 10

You need to run a nightly 3-hour data processing job cheaply. Which compute would you choose?

Show answer

Avoid the old Consumption plan because of its execution timeout. Good options are Azure Batch or a VM Scale Set using Spot VMs with checkpointing, Container Apps jobs that run on a schedule and stop afterwards, or Durable Functions breaking work into short activities. The key is paying only while the job runs and tolerating restarts. Store input and output in Blob Storage so any worker can resume.

Design a highly available web tier for an e-commerce site during a festival sale.

Show answer

Run the app on App Service Premium v3 or a VM Scale Set spread across three availability zones in Central India. Put Azure Front Door in front for global load balancing, WAF and caching of static content, with a secondary region on standby. Pre-scale before the sale using scheduled rules, add Redis for sessions and catalogue caching, and load test with Azure Load Testing beforehand.

How would you upgrade an AKS cluster in production with minimal downtime?

Show answer

Check the release notes and API deprecations, then upgrade a non-prod cluster first. Set Pod Disruption Budgets and multiple replicas so draining is safe. Upgrade the control plane, then node pools one at a time using max surge so new nodes join before old ones drain. Use planned maintenance windows and auto-upgrade channels for patches. For major risk, run a blue-green cluster and switch traffic.

How do you create a private endpoint for a storage account?

Show answer

Create the private endpoint in the app subnet for the blob sub-resource, link the private DNS zone privatelink.blob.core.windows.net to the VNet, and disable public network access on the account: az network private-endpoint create -g rg-net -n pe-st-blob \ --vnet-name vnet-hub --subnet snet-pe \ --private-connection-resource-id <storage-id> \ --group-id blob --connection-name st-blob Then test that the name resolves to a 10.x address.

How would you protect storage accounts against ransomware?

Show answer

Combine prevention and recovery. Use private endpoints, disable shared keys and public access, and restrict RBAC with PIM. Enable soft delete, versioning, change feed and point-in-time restore. For critical data, use immutable storage policies or vaulted Azure Backup with immutability and multi-user authorization so attackers cannot delete backups. Turn on Defender for Storage to detect malware uploads and unusual access.

How do you migrate 200 TB of on-premises data to Azure when the internet link is slow?

Show answer

Calculate transfer time first: 200 TB over a 1 Gbps link at 70% efficiency takes almost a month. Use Azure Data Box devices shipped to your site, copy data locally and send them back for upload into the storage account. Then run AzCopy or Azure File Sync to sync the changes made after shipping. For ongoing large flows, consider ExpressRoute.

Design storage for an app storing user documents that must stay in India for 7 years.

Show answer

Use a storage account in Central India with ZRS, or GZRS paired with South India which keeps data inside India. Apply time-based immutability for seven years on the archive container and lifecycle rules to move older files to Cool and Archive tiers. Encrypt with customer-managed keys in Key Vault if compliance asks, use private endpoints, and log access to Log Analytics for audits.

What is the difference between a service endpoint and a private endpoint?

Show answer

A service endpoint extends the VNet identity to a PaaS service so its firewall can allow your subnet, but the service still uses its public IP. A private endpoint puts a private IP from your subnet on a specific resource instance, so traffic never needs the public endpoint and works from peered networks and on-premises. Private endpoints are preferred for strict security but need private DNS setup.

Explain the hub-spoke network topology.

Show answer

The hub VNet holds shared services: Azure Firewall, VPN or ExpressRoute gateways, Bastion and DNS resolvers. Each workload gets its own spoke VNet peered to the hub, with UDRs sending traffic through the firewall. This centralises security and connectivity while isolating workloads. For many regions and branches, Azure Virtual WAN provides a Microsoft-managed hub with automatic transit routing.

Create a route table that sends internet traffic to Azure Firewall.

Show answer

Add a default route with next hop Virtual appliance pointing to the firewall private IP, then attach it to the spoke subnet: az network route-table create -g rg-net -n rt-spoke1 az network route-table route create -g rg-net \ --route-table-name rt-spoke1 -n default-to-fw \ --address-prefix 0.0.0.0/0 \ --next-hop-type VirtualAppliance --next-hop-ip-address 10.0.1.4 az network vnet subnet update -g rg-net --vnet-name vnet-spoke1 \ -n snet-app --route-table rt-spoke1

How do you plan IP address space for VNets in an enterprise?

Show answer

Allocate from a central IP plan that does not overlap with on-premises, other clouds or future acquisitions, because overlapping ranges cannot be peered or routed. Give each region a large block, for example 10.10.0.0/14, then carve /22 or /24 spokes. Size subnets for growth and remember AKS, App Gateway and private endpoints consume many IPs. Document allocations in an IPAM tool such as Azure Virtual Network Manager IPAM.

An App Service cannot connect to an Azure SQL database behind a private endpoint. How do you troubleshoot?

Show answer

Confirm the app has regional VNet integration into a subnet that can reach the private endpoint subnet. Check DNS first: from the Kudu console, nslookup the SQL server name; it must resolve to the private IP through privatelink.database.windows.net linked to the VNet. Then check NSGs, UDRs sending traffic to a firewall that blocks port 1433, and whether SQL public access is disabled as expected.

Your company needs a reliable private link from its Pune datacenter to Azure. What do you propose?

Show answer

Propose ExpressRoute through a provider at the Pune or Mumbai peering location with private peering into a hub VNet in Central India, sized for current and forecast bandwidth. Add a site-to-site VPN as a failover path, or a second ExpressRoute circuit at another peering location for higher resilience. Use BGP for route exchange, and encrypt traffic with MACsec or IPsec if compliance requires.

How would you protect a public web application from attacks like SQL injection and DDoS?

Show answer

Put Azure Front Door Premium or Application Gateway with WAF in front of the app, using the managed Default Rule Set based on OWASP plus bot protection and rate limits. Enable Azure DDoS Network Protection on the VNet for layer 3 and 4 attacks on public IPs. Lock the app so it accepts traffic only from Front Door, using access restrictions with the service tag and the Front Door ID header.

Partners need to allowlist a fixed outbound IP from your AKS cluster. How do you do it?

Show answer

Configure the cluster's outbound type as a managed or user-assigned NAT Gateway with a static public IP, or route egress through Azure Firewall using userDefinedRouting so all traffic leaves from the firewall's public IP. Share that IP with partners. NAT Gateway is simpler and gives many SNAT ports, while Azure Firewall adds FQDN filtering and logging for compliance.

What is workload identity federation?

Show answer

Workload identity federation lets external workloads such as GitHub Actions, Kubernetes pods or other clouds get Entra ID tokens by exchanging their own OIDC tokens, without storing client secrets. You add a federated credential on an app registration or user-assigned managed identity that trusts a specific issuer and subject, such as a repo branch. AKS Workload ID uses this for pods to access Azure resources.

Write a Bicep snippet for a custom Azure Policy that denies resources outside India regions.

Show answer

Define the rule with an allowed list and a deny effect, then assign it at a management group: resource pol 'Microsoft.Authorization/policyDefinitions@2023-04-01' = { name: 'allowed-india-regions' properties: { policyType: 'Custom' mode: 'Indexed' policyRule: { if: { field: 'location' notIn: ['centralindia', 'southindia', 'westindia'] } then: { effect: 'deny' } } } }

Design identity and access for a multi-team Azure platform in a bank.

Show answer

Use Entra ID groups mapped to roles per team and environment, with no direct user assignments. Make production access eligible-only through PIM with approval and MFA, and require phishing-resistant MFA and compliant devices via Conditional Access. Use managed identities and workload federation for apps and pipelines. Keep break-glass accounts excluded from policies but monitored. Run quarterly access reviews and stream logs to Sentinel.

How would you secure an AKS cluster?

Show answer

Use Entra ID integration with Kubernetes RBAC and disable local accounts. Make the API server private or restrict authorized IP ranges. Run workloads with Workload ID instead of secrets, keep secrets in Key Vault through the CSI driver, and apply Azure Policy for Kubernetes to block privileged pods. Enable Defender for Containers, use network policies, scan images in ACR and route egress through Azure Firewall.

What is the Hyperscale tier of Azure SQL Database?

Show answer

Hyperscale separates compute from a distributed, log-based storage layer, so databases can grow up to 128 TB with fast backups through snapshots and quick restores regardless of size. You can add up to four high-availability replicas and named replicas for read scale-out. Scaling compute takes minutes. It suits large OLTP and mixed workloads, and its pricing is now competitive with General Purpose.

What are active geo-replication and failover groups?

Show answer

Active geo-replication creates readable secondary databases in other regions, up to four, with asynchronous replication and manual failover per database. Failover groups manage a group of databases together, provide read-write and read-only listener endpoints that stay the same after failover, and support automatic failover by policy. Applications should use the failover group listener so connection strings do not change during a regional failover.

How do you choose a partition key in Cosmos DB?

Show answer

Pick a property with high cardinality that spreads requests and storage evenly and that most queries filter on, such as userId or tenantId. Each logical partition is limited to 20 GB, so avoid keys like country or status that create hot partitions. If no single property works, use a synthetic key or hierarchical partition keys. The partition key cannot be changed later without migrating data.

Explain the five consistency levels in Cosmos DB.

Show answer

Strong guarantees linearizable reads but adds latency across regions. Bounded staleness lets reads lag by a set number of versions or time. Session, the default, guarantees read-your-own-writes within a client session. Consistent prefix ensures reads never see writes out of order. Eventual is fastest and cheapest with no ordering guarantee. Most apps use Session; stronger levels cost more RUs and latency.

How do you migrate an on-premises SQL Server database to Azure SQL Managed Instance?

Show answer

Assess with Azure Migrate or the Azure SQL migration extension in Azure Data Studio to find compatibility issues and size the target. For minimal downtime, use the Managed Instance link or Log Replay Service to continuously replicate, then cut over in minutes. For smaller databases, an offline native backup to Blob Storage and RESTORE FROM URL works. Test application connectivity and performance before switching.

Your Cosmos DB requests are failing with 429 errors. What do you do?

Show answer

429 means requests exceeded provisioned RU/s. Check Insights for normalized RU consumption per partition. If one partition is hot, the partition key is the problem. If usage is even, enable autoscale or raise RU/s. Reduce RU cost by using point reads instead of queries, excluding unused paths from indexing and smaller documents. SDKs retry 429s automatically, so tune retry options too.

A SQL database must survive a full regional outage with under 1 minute data loss. Design it.

Show answer

Use Azure SQL Database Business Critical or General Purpose with zone redundancy in Central India, plus a failover group to South India. Geo-replication is asynchronous with typical lag under a few seconds, meeting the RPO. Point the app to the failover group listener, deploy the app tier in both regions behind Front Door, and test failover drills quarterly. Document RTO for the automatic policy grace period.

Should you use Cosmos DB or Azure SQL for a new e-commerce application?

Show answer

Use Azure SQL for orders, payments and inventory, which need joins, transactions and strong consistency. Use Cosmos DB for high-volume, flexible-schema data such as product catalogue, shopping carts, user activity or session data needing global low latency. Many systems combine both. If the team knows SQL well and scale is moderate, starting with Azure SQL alone is simpler and cheaper.

How do you manage Terraform state securely on Azure?

Show answer

Store state in an Azure Storage backend with a dedicated container per environment. Blob leases provide state locking so two runs cannot write at once. Use Entra ID authentication instead of access keys, enable versioning and soft delete to recover from corruption, restrict access to the pipeline identity, and use private endpoints. Never commit state files, because they can contain secrets in plain text.

What is GitOps and how is it used with AKS?

Show answer

GitOps treats a Git repository as the single source of truth for cluster configuration. An agent in the cluster, such as Flux, which AKS offers as a managed extension, or Argo CD, pulls manifests from Git and reconciles the cluster to match. Changes happen only through pull requests, which gives audit history and easy rollback by reverting commits. It also removes the need to give pipelines cluster admin credentials.

Write an Azure Pipelines YAML that builds a .NET app and deploys it to App Service.

Show answer

Build and publish an artifact, then deploy in a stage tied to an environment with approvals: trigger: branches: { include: [main] } pool: { vmImage: ubuntu-latest } stages: - stage: Build jobs: - job: build steps: - script: dotnet publish -c Release -o $(Build.ArtifactStagingDirectory) - publish: $(Build.ArtifactStagingDirectory) artifact: app - stage: Deploy jobs: - deployment: web environment: prod strategy: runOnce: deploy: steps: - task: AzureWebApp@1 inputs: azureSubscription: sc-shop-prod appName: app-shop-prod package: $(Pipeline.Workspace)/app

Someone changed production resources manually in the portal. How do you detect and handle drift?

Show answer

Detect drift by running Bicep what-if or terraform plan on a schedule and failing the run on unexpected differences, and by alerting on activity log write events from users rather than pipeline identities. Decide whether the manual change was a valid hotfix; if so, add it to code, otherwise redeploy to restore. Then reduce write access in production to the pipeline identity plus PIM break-glass.

How do you manage secrets and configuration for many environments in pipelines?

Show answer

Keep non-secret settings in parameter files or Azure App Configuration per environment. Keep secrets in Key Vault per environment and let apps read them via managed identity or Key Vault references, so pipelines rarely handle them. When pipelines need secrets, link variable groups to Key Vault and use environment approvals. Never echo secrets in logs and prefer federated identities over stored credentials.

A deployment to production failed halfway. How do you design pipelines to handle this?

Show answer

Make deployments idempotent so rerunning the same template converges to the right state. Use slot swaps or blue-green so the old version keeps serving until the new one passes health checks, and roll back by swapping back. Keep database migrations backward compatible, using expand and contract, so the old code still works. Add smoke tests and automatic rollback, and alert the team with logs.

How would you structure IaC repositories for a platform team supporting 30 app teams?

Show answer

Separate a platform repo for landing zone, networking and policies from shared versioned modules published to a Bicep registry in ACR or a Terraform module registry. App teams consume modules in their own repos with pinned versions. Use pull request checks: linting, what-if or plan, policy tests and security scanning with tools like Checkov or PSRule. Document module contracts and use semantic versioning for breaking changes.

How do you enable diagnostic settings at scale for all resources?

Show answer

Use Azure Policy with deployIfNotExists definitions, such as the built-in initiatives for enabling resource logs to a Log Analytics workspace by category group. Assign them at the management group, create a remediation task for existing resources and let new resources be configured automatically. This avoids teams forgetting to enable logs, which is common when resources are created outside the pipeline.

How do you design monitoring for a production microservices app on AKS?

Show answer

Enable Container Insights and Managed Prometheus with Managed Grafana for cluster and pod metrics. Instrument services with OpenTelemetry sending to Application Insights for distributed tracing. Send logs to a central Log Analytics workspace using cheaper table plans for verbose logs. Define SLOs for latency and error rate, alert on them through action groups and build dashboards and runbooks for common failures.

Your Log Analytics bill is very high. How do you reduce it?

Show answer

Run the usage query on the Usage table to see which tables and resources ingest most. Remove debug or duplicate logs at the source, use data collection rules with transformations to drop columns or filter rows, and move verbose tables to Basic or Auxiliary plans. Set a daily cap for non-production workspaces, shorten interactive retention and use commitment tiers if ingestion is steady above 100 GB per day.

Design a disaster recovery plan for a VM-based application in Central India.

Show answer

Agree RPO and RTO with the business. Replicate VMs to South India with Azure Site Recovery, configure recovery plans that start the database first, then app and web tiers, and pre-create the network. Use Traffic Manager or Front Door for DNS failover. Back up data separately with Azure Backup in case of corruption. Run test failovers into an isolated VNet every quarter.

Users say an API is failing but no alert fired. What do you change?

Show answer

Check whether alerts measured the right signal: CPU alerts miss application errors. Add alerts on user-facing SLIs, such as failed request rate, p95 latency and availability tests from multiple locations in Application Insights. Make sure the action group has correct recipients and that alert processing rules are not suppressing it. Review the incident timeline and add the missing signals to the on-call runbook.

How do you enforce governance across 50 subscriptions?