HCLTech Microsoft Azure Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About HCLTech hiring for Microsoft Azure roles
HCLTech is an Indian multinational IT services and consulting company providing digital engineering, cloud, infrastructure, software products and data services. It works with clients in sectors such as financial services, manufacturing, life sciences and telecom. In India it hires for software engineers, test engineers, data analysts and data engineers through campus drives and programmes like TechBee.
For Microsoft Azure roles, this HCLTech practice set focuses most on Monitoring, Cost and Governance (6), DevOps and Infrastructure as Code (5), Azure Compute (4), Identity and Security (4). It has 13 easy, 17 medium questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Noida, India
Main India offices
Noida, Chennai, Bengaluru, Hyderabad, Lucknow
HCLTech Microsoft Azure interview process
Online assessment (aptitude + technical)
Technical interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for HCLTechStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you create a budget with alerts for a subscription?
In Cost Management, choose Budgets, set the scope to the subscription or a resource group, a monthly amount and alert conditions such as 50%, 80% and 100% of actual cost and 100% of forecast. Add email recipients and an action group that can notify Teams or run an automation. Budgets do not stop spending on their own, so pair them with automation or policy if needed.
02
Explain the hierarchy of management groups, subscriptions, resource groups and resources.
A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.
Spot VMs use spare Azure capacity at discounts that can reach about 90%, but Azure can evict them with 30 seconds notice when it needs capacity or the price passes your limit. Use them for interruptible work such as batch rendering, CI build agents, test environments and big data jobs with checkpointing. Never use them for stateful production databases or anything that cannot tolerate sudden loss.
ARM is the deployment and management layer of Azure. Every request from the portal, CLI, PowerShell, SDKs or Bicep goes through the ARM API, which authenticates the caller, checks RBAC and Policy, and forwards the call to the resource provider. Because all tools hit the same API, you get consistent results, tagging, locks and activity logs no matter how the change was made.
05
What is Azure Monitor and what data does it collect?
Azure Monitor is the unified monitoring platform for Azure and hybrid resources. It collects metrics, which are numeric time series stored for 93 days, and logs, which are records stored in Log Analytics workspaces and queried with KQL. Sources include platform metrics, activity logs, resource logs through diagnostic settings, VM guest data through the Azure Monitor Agent and app telemetry from Application Insights.
Azure Boards tracks work items, sprints and backlogs. Azure Repos hosts Git repositories with branch policies. Azure Pipelines runs CI/CD on Microsoft-hosted or self-hosted agents. Azure Test Plans manages manual and exploratory testing. Azure Artifacts hosts NuGet, npm, Maven and Python feeds. Many Indian service companies still run client projects on Azure DevOps, while product companies often use GitHub Actions.
07
You are setting up Azure DNS for a new domain. What are the steps?
Create a public DNS zone in Azure DNS for the domain, note the four Azure name servers it shows, and update the NS records at your domain registrar to those servers. Add records such as an A alias record pointing to the Front Door or public IP and CNAME for www. Verify with nslookup. Apply a lock on the zone so records cannot be deleted accidentally.
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
Metric alerts evaluate metrics such as CPU above 80% and can be dynamic with machine-learned thresholds. Log search alerts run KQL queries on a schedule. Activity log alerts fire on control-plane events or Service Health incidents. Smart detection in Application Insights finds anomalies. Alerts trigger action groups that send emails, SMS, Teams messages, webhooks or run Functions, Logic Apps and Automation runbooks.
Peering connects two VNets over the Microsoft backbone with low latency, either in the same region or globally. Traffic stays private and is billed per GB. Peering is not transitive: if A peers with B and B peers with C, A cannot reach C. To route through a hub, use a network virtual appliance or Azure Firewall with user-defined routes, or use Azure Virtual WAN.
11
Create a Linux VM with Azure CLI using SSH keys and no public IP.
Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion:
az vm create \
--resource-group rg-app-dev \
--name vm-api-01 \
--image Ubuntu2204 \
--size Standard_D2s_v5 \
--vnet-name vnet-dev --subnet snet-app \
--public-ip-address '' \
--admin-username azureuser \
--generate-ssh-keys \
--zone 1
Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.
13
What is the difference between an availability set and an availability zone?
An availability set spreads VMs across fault domains (separate racks, power and switches) and update domains (rebooted at different times) inside one datacenter, giving a 99.95% SLA. Availability zones place VMs in physically separate datacenters within a region, giving 99.99%. Zones protect against a full datacenter outage; availability sets only protect against rack and maintenance failures. New designs prefer zones where the region supports them.
14
What is the difference between a VPN Gateway and ExpressRoute?
A VPN Gateway creates encrypted IPsec tunnels over the public internet, for site-to-site or point-to-site connections, and is quick and cheap to set up. ExpressRoute is a private dedicated connection through a connectivity provider with predictable latency and bandwidth up to 100 Gbps, but it does not encrypt by default. Many companies use ExpressRoute as primary and a VPN as backup.
15
Read a blob in Python using DefaultAzureCredential.
DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored:
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient
url = 'https://stshopprod.blob.core.windows.net'
client = BlobServiceClient(url, credential=DefaultAzureCredential())
blob = client.get_blob_client('invoices', '2026/inv-1001.pdf')
data = blob.download_blob().readall()
print(len(data))
16
What is the difference between CapEx and OpEx, and how does Azure change it?
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
17
What is Azure Policy and how is it different from RBAC?
RBAC controls who can do actions. Azure Policy controls what resources and settings are allowed, whoever deploys them. Policies use effects such as deny, audit, append, modify, deployIfNotExists and auditIfNotExists. For example, deny public IPs on VMs or deploy diagnostic settings automatically. Group policies into initiatives, assign them at management groups and view compliance on the dashboard.
Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.
19
What is Azure Cosmos DB and which APIs does it support?
Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.
PIM gives just-in-time, time-bound access to privileged Entra ID roles and Azure RBAC roles. Users are eligible, not permanently assigned, and must activate the role for a few hours with justification, MFA and optionally approval. Every activation is audited and access reviews remove stale eligibility. It reduces standing admin access, which is a key control against compromised accounts. It needs Entra ID P2 or governance licensing.
21
What is Azure Files and when would you use Azure File Sync?
Azure Files provides fully managed SMB and NFS shares that VMs and on-premises machines can mount, useful for lift-and-shift of apps expecting a file server. Azure File Sync installs an agent on Windows Servers to sync shares to Azure Files and use cloud tiering, keeping hot files locally and old files in the cloud. It helps branch offices share data without large local storage.
22
Write a Resource Graph query to list unattached managed disks.
Unattached disks keep billing, so this is a common cost check:
Resources
| where type =~ 'microsoft.compute/disks'
| where properties.diskState =~ 'Unattached'
| project name, resourceGroup, subscriptionId,
sku = sku.name, sizeGb = properties.diskSizeGB
Run it with az graph query -q or in the Resource Graph Explorer.
23
How do you keep up with security changes in Azure?
Situation: Azure releases security changes every month, and missing one can expose our systems. Task: stay current without losing project time. Action: I follow Azure Updates and the Azure Security blog, read the monthly Defender for Cloud changes, review Service Health retirement notices and spend an hour weekly in a lab. Result: our team was ready for the mandatory MFA rollout for Azure sign-ins before it was enforced.
24
A VM is not reachable over RDP. Walk through your troubleshooting.
Check the VM is running and passed boot diagnostics via the serial console or screenshot. Use Network Watcher IP flow verify and effective security rules to see if an NSG blocks port 3389. Check the route table, any firewall and whether the VM has a public IP or you should use Bastion. Inside the OS, use Run Command to check the RDP service and Windows firewall. Reset the configuration if needed.
25
Explain stages, jobs, steps and environments in YAML pipelines.
A pipeline has stages, such as Build, Test and DeployProd, that run in sequence or parallel. Each stage has jobs, which run on one agent, and each job has steps, which are tasks or scripts. Deployment jobs target environments, which can have approvals, checks, business hours and deployment history. Templates let teams reuse stages and jobs across many repositories.
26
Explain DTU and vCore purchasing models in Azure SQL Database.
DTU bundles CPU, memory and IO into fixed Basic, Standard and Premium sizes and is simple for small apps. The vCore model lets you choose compute and storage separately, with General Purpose, Business Critical and Hyperscale tiers, provisioned or serverless compute, and Azure Hybrid Benefit for existing SQL licences. vCore is recommended for most production workloads because it is transparent and easier to compare with on-premises.
27
Write a KQL query for the top 10 slowest requests in Application Insights over the last day.
Query the requests table, summarise duration and sort:
requests
| where timestamp > ago(1d)
| summarize count(), avgDuration = avg(duration),
p95 = percentile(duration, 95) by name
| top 10 by p95 desc
In a workspace-based resource, the table is AppRequests with TimeGenerated and DurationMs columns instead.
28
Your company is choosing between Bicep and Terraform for its Azure estate. What would you recommend?
Bicep is Azure-only, needs no state file, supports new resource features immediately and has native what-if previews. Terraform works across many clouds and SaaS providers, has a huge module ecosystem, and keeps a state file that must be stored securely, for example in a Blob Storage backend with locking. Choose Bicep for Azure-only teams and Terraform for multi-cloud or existing Terraform skills.
Azure Resource Graph is a fast query service over resource metadata across all subscriptions you can access, using KQL. It is used for inventory, compliance checks and finding orphaned resources, such as unattached disks or public IPs, much faster than looping through APIs. The portal's All resources view and Azure Policy compliance use it. Results reflect configuration, not performance metrics.
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
Tips to crack the HCLTech Microsoft Azure interview
Revise programming basics, SQL and networking fundamentals, as HCLTech roles span applications and infrastructure services.
Learn about HCLTech's software products business, HCLSoftware, and its engineering and R&D services.
Be clear and honest about your preferred domain and shift flexibility, as some roles involve support or global time zones.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; HCLTech interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the HCLTech Microsoft Azure interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Technical interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the HCLTech Microsoft Azure interview?
This practice set leans on Monitoring, Cost and Governance (6), DevOps and Infrastructure as Code (5), Azure Compute (4), Identity and Security (4). Revise those first, then practise explaining one or two of your own projects end to end, because most HCLTech interviewers ask you to walk through real work.
Are these the exact questions asked at HCLTech?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like HCLTech's. They are not a leaked or verified list of past questions.
Where does HCLTech hire Microsoft Azure professionals in India?
HCLTech has large teams in Noida, Chennai, Bengaluru, Hyderabad, Lucknow. Openings and locations change often, so check the HCLTech careers page and filter by city and experience.