Hexaware Microsoft Azure Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Hexaware hiring for Microsoft Azure roles
Hexaware Technologies is an Indian IT services company offering cloud, application, testing, data and business process services. It promotes an automation-first approach and serves clients in financial services, healthcare, travel and manufacturing. In India it hires for software engineers, test engineers, data analysts and data engineers.
For Microsoft Azure roles, this Hexaware practice set focuses most on Monitoring, Cost and Governance (7), DevOps and Infrastructure as Code (7), Azure Fundamentals (6), Identity and Security (4). It has 12 easy, 16 medium, 2 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Navi Mumbai, India
Main India offices
Navi Mumbai, Chennai, Pune, Bengaluru, Noida
Hexaware Microsoft Azure interview process
Online assessment (aptitude + coding)
Communication assessment
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for HexawareStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Cost Management analyses and controls Azure spending. Cost analysis shows cost by service, resource group, tag or meter with forecasts. Budgets send alerts at thresholds such as 80% and 100% of actual or forecast spend and can trigger automation. Exports send daily cost data to Storage for reporting in Power BI. It also shows reservation utilisation and supports FinOps practices like showback and chargeback to teams.
02
A developer ran a DELETE without a WHERE clause on production. How do you recover?
Stop further writes if possible and note the exact time of the mistake. Use point-in-time restore to create a new copy of the database from a minute before the delete. Then copy the missing rows back into production with INSERT SELECT across databases or a data export, rather than replacing the whole database, which would lose later legitimate changes. Afterwards restrict direct write access in production.
Metric alerts evaluate metrics such as CPU above 80% and can be dynamic with machine-learned thresholds. Log search alerts run KQL queries on a schedule. Activity log alerts fire on control-plane events or Service Health incidents. Smart detection in Application Insights finds anomalies. Alerts trigger action groups that send emails, SMS, Teams messages, webhooks or run Functions, Logic Apps and Automation runbooks.
04
How do you handle a failed release that affected customers?
Situation: a release broke login for some mobile users on a Friday evening. Task: restore service fast and prevent repeats. Action: I swapped the App Service slot back to the previous version within ten minutes, informed support, then reproduced the bug in staging and found a missing config value. Result: we added config validation and smoke tests on login to the pipeline, and wrote a blameless postmortem.
05
Write a GitHub Actions job that logs in to Azure with OIDC.
Grant id-token write permission and use a federated credential on the app registration, so no secret is stored:
permissions:
id-token: write
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
environment: prod
steps:
- uses: actions/checkout@v4
- uses: azure/login@v2
with:
client-id: ${{ vars.AZURE_CLIENT_ID }}
tenant-id: ${{ vars.AZURE_TENANT_ID }}
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
- run: az group list -o table
Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.
07
Read a blob in Python using DefaultAzureCredential.
DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored:
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient
url = 'https://stshopprod.blob.core.windows.net'
client = BlobServiceClient(url, credential=DefaultAzureCredential())
blob = client.get_blob_client('invoices', '2026/inv-1001.pdf')
data = blob.download_blob().readall()
print(len(data))
08
What are RPO and RTO and how do they guide Azure designs?
RPO, recovery point objective, is the maximum acceptable data loss measured in time. RTO, recovery time objective, is how long recovery may take. A daily backup gives an RPO of up to 24 hours. Site Recovery gives an RPO of seconds to minutes and an RTO of minutes to hours. SQL failover groups give an RPO of seconds. Lower RPO and RTO cost more, so agree targets per application.
Service Health shows the health of Azure services in your regions: service issues happening now, planned maintenance, health advisories and security advisories, plus retirement notices. Resource Health shows if a specific resource, such as a VM, is available and why not. Set activity log alerts on Service Health so the team gets notified for incidents affecting their subscriptions and regions, instead of finding out from users.
10
How do you create a resource group and list resources using Azure CLI?
Log in, select the subscription, create the group with tags, then list its resources in a table:
az login
az account set --subscription 'Prod-Sub'
az group create --name rg-shop-prod --location centralindia --tags env=prod owner=shop
az resource list --resource-group rg-shop-prod --output table
The --query flag with JMESPath filters output, for example --query '[].name'.
11
What is Azure Policy and how is it different from RBAC?
RBAC controls who can do actions. Azure Policy controls what resources and settings are allowed, whoever deploys them. Policies use effects such as deny, audit, append, modify, deployIfNotExists and auditIfNotExists. For example, deny public IPs on VMs or deploy diagnostic settings automatically. Group policies into initiatives, assign them at management groups and view compliance on the dashboard.
12
How do Azure SLAs work and how do you calculate a composite SLA?
An SLA is Microsoft's uptime commitment per service, with service credits if it is missed. When services depend on each other in series, multiply their SLAs. An App Service at 99.95% calling Azure SQL at 99.99% gives about 0.9995 x 0.9999 = 99.94%. Adding redundancy, such as a second region behind Front Door, raises the combined figure because both paths must fail together.
Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.
14
A developer's service principal secret was committed to a public GitHub repo. What do you do?
Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.
Azure Resource Graph is a fast query service over resource metadata across all subscriptions you can access, using KQL. It is used for inventory, compliance checks and finding orphaned resources, such as unattached disks or public IPs, much faster than looping through APIs. The portal's All resources view and Azure Policy compliance use it. Results reflect configuration, not performance metrics.
16
How do you reference Key Vault secrets in App Service app settings?
Enable a managed identity on the app, grant it Key Vault Secrets User on the vault, then set the app setting value to a Key Vault reference: @Microsoft.KeyVault(SecretUri=https://kv-shop-prod.vault.azure.net/secrets/SqlPassword/). The app reads it as a normal environment variable. Omitting the version makes App Service pick up rotated secrets automatically within about a day, or on restart.
17
Users say an API is failing but no alert fired. What do you change?
Check whether alerts measured the right signal: CPU alerts miss application errors. Add alerts on user-facing SLIs, such as failed request rate, p95 latency and availability tests from multiple locations in Application Insights. Make sure the action group has correct recipients and that alert processing rules are not suppressing it. Review the incident timeline and add the missing signals to the on-call runbook.
18
What is Bicep and how does it relate to ARM templates?
Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.
19
Your manager asks you to estimate the monthly cost of a new Azure application. How do you do it?
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
20
Explain stages, jobs, steps and environments in YAML pipelines.
A pipeline has stages, such as Build, Test and DeployProd, that run in sequence or parallel. Each stage has jobs, which run on one agent, and each job has steps, which are tasks or scripts. Deployment jobs target environments, which can have approvals, checks, business hours and deployment history. Templates let teams reuse stages and jobs across many repositories.
21
Write an Azure Pipelines YAML that builds a .NET app and deploys it to App Service.
What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.
24
Why do you want to build a career in Microsoft Azure?
Situation: during my internship I saw most clients running Microsoft workloads like Windows Server, SQL Server and Active Directory. Task: I wanted skills that match that demand. Action: I cleared AZ-900, then studied AZ-104 and built labs with VNets, App Service and Bicep. Result: I can now deploy and troubleshoot real environments, and I want to grow toward an Azure architect role over the next few years.
25
Tell me about a time you automated a manual process.
Situation: our team created test environments by hand, taking two days each. Task: make it self-service. Action: I wrote Bicep modules for the app, database and networking and a pipeline with parameters for environment name, plus an auto-delete tag cleaned up nightly by an Automation runbook. Result: environments took 20 minutes, and idle test cost dropped by about 30%.
26
What is Microsoft Azure and which service models does it offer?
Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.
27
Tell me about a time you learned a new Azure service quickly to deliver a task.
Situation: our team needed event-driven processing and nobody had used Azure Functions. Task: I had one week to build a proof of concept. Action: I completed the Microsoft Learn module, built a blob-triggered function in a sandbox subscription, added Application Insights and shared a short demo and runbook. Result: the POC was approved, went live in three weeks and replaced a polling VM, cutting cost noticeably.
28
You are setting up Azure DNS for a new domain. What are the steps?
Create a public DNS zone in Azure DNS for the domain, note the four Azure name servers it shows, and update the NS records at your domain registrar to those servers. Add records such as an A alias record pointing to the Front Door or public IP and CNAME for www. Verify with nslookup. Apply a lock on the zone so records cannot be deleted accidentally.
29
Write a KQL query to find who deleted resources in the last 7 days.
Use the AzureActivity table, filtering on successful delete operations:
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue endswith '/DELETE'
| where ActivityStatusValue == 'Success'
| project TimeGenerated, Caller, OperationNameValue,
ResourceGroup, _ResourceId
| order by TimeGenerated desc
UDRs are custom routes in a route table attached to a subnet, overriding Azure system routes. A common use is sending 0.0.0.0/0 from spoke subnets to Azure Firewall in the hub, with next hop type Virtual appliance, so all outbound traffic is inspected. Mistakes in UDRs are a top cause of connectivity issues, so check effective routes on the NIC when troubleshooting.
Tips to crack the Hexaware Microsoft Azure interview
Practise aptitude and simple coding questions under time pressure for the online assessment.
Revise automation testing basics with Selenium and API testing, as quality engineering is an important service line.
Learn about Hexaware's automation and cloud focus and its key industry verticals for company questions.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Hexaware interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Hexaware Microsoft Azure interview?
Candidates usually go through 4 stages: Online assessment (aptitude + coding); Communication assessment; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Hexaware Microsoft Azure interview?
This practice set leans on Monitoring, Cost and Governance (7), DevOps and Infrastructure as Code (7), Azure Fundamentals (6), Identity and Security (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Hexaware interviewers ask you to walk through real work.
Are these the exact questions asked at Hexaware?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like Hexaware's. They are not a leaked or verified list of past questions.
Where does Hexaware hire Microsoft Azure professionals in India?
Hexaware has large teams in Navi Mumbai, Chennai, Pune, Bengaluru, Noida. Openings and locations change often, so check the Hexaware careers page and filter by city and experience.