36 practice questions with answers for Microsoft Azure interviews in Chandigarh.
Microsoft Azure jobs in Chandigarh
Chandigarh, Mohali and Panchkula form the Tricity IT cluster, with IT-services firms, SaaS companies and start-ups in Mohali's IT City and Chandigarh's IT Park. Interviews usually check strong fundamentals and practical tool skills.
Below are 36 questions that match the mix of service, product and domain employers hiring azure cloud support associates in Chandigarh.
Solved for ChandigarhStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do backups and point-in-time restore work in Azure SQL Database?
Azure takes full backups weekly, differential backups every 12 to 24 hours and log backups about every 10 minutes automatically. You can restore to any point within the short-term retention period of 1 to 35 days, default 7, as a new database. Long-term retention keeps weekly, monthly or yearly full backups for up to 10 years. Backup storage can be LRS, ZRS or geo-redundant.
Disable shared key access where possible and use Entra ID with RBAC roles like Storage Blob Data Reader. Use managed identities for apps. Disable public blob access, require TLS 1.2, restrict the firewall to selected VNets, or use private endpoints and disable public network access. Enable soft delete, versioning and Defender for Storage, and keep keys, if any, in Key Vault with rotation.
04
An application on a VM must access a storage account without any keys. How do you set it up?
Enable a system-assigned or user-assigned managed identity on the VM. Assign the identity the least role needed, such as Storage Blob Data Reader on the specific container. In code, use DefaultAzureCredential or ManagedIdentityCredential from the Azure SDK. Then disable shared key access on the account. The token is fetched from the local metadata endpoint and rotated automatically by Azure.
05
How do you handle a situation where a cloud bill suddenly doubled?
Situation: our monthly Azure bill jumped from about 6 lakh to 12 lakh rupees. Task: find the cause within two days. Action: I used Cost Analysis grouped by resource and meter, found a Log Analytics workspace ingesting verbose debug logs and forgotten premium disks from a test. I fixed log levels, set a daily cap, deleted orphans and added budgets with alerts. Result: costs returned to normal the next month.
A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.
07
How do you manage secrets and configuration for many environments in pipelines?
Keep non-secret settings in parameter files or Azure App Configuration per environment. Keep secrets in Key Vault per environment and let apps read them via managed identity or Key Vault references, so pipelines rarely handle them. When pipelines need secrets, link variable groups to Key Vault and use environment approvals. Never echo secrets in logs and prefer federated identities over stored credentials.
08
How do you create a private endpoint for a storage account?
Create the private endpoint in the app subnet for the blob sub-resource, link the private DNS zone privatelink.blob.core.windows.net to the VNet, and disable public network access on the account:
az network private-endpoint create -g rg-net -n pe-st-blob \
--vnet-name vnet-hub --subnet snet-pe \
--private-connection-resource-id <storage-id> \
--group-id blob --connection-name st-blob
Then test that the name resolves to a 10.x address.
09
Create a Linux VM with Azure CLI using SSH keys and no public IP.
Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion:
az vm create \
--resource-group rg-app-dev \
--name vm-api-01 \
--image Ubuntu2204 \
--size Standard_D2s_v5 \
--vnet-name vnet-dev --subnet snet-app \
--public-ip-address '' \
--admin-username azureuser \
--generate-ssh-keys \
--zone 1
10
A developer's service principal secret was committed to a public GitHub repo. What do you do?
Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.
Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.
12
Your secure score in Defender for Cloud is low. How do you improve it?
Sort recommendations by the score increase and effort. Typical quick wins are enabling MFA for all privileged accounts, restricting management ports with just-in-time access, enabling endpoint protection and vulnerability assessment on VMs, and turning on diagnostic logs. Use Azure Policy to enforce fixes so new resources stay compliant. Assign owners and due dates through governance rules and track progress weekly.
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
14
Generate a user delegation SAS for one blob with Azure CLI.
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity:
az storage blob generate-sas \
--account-name stshopprod --container-name invoices \
--name inv-1001.pdf --permissions r \
--expiry 2026-11-12T18:00Z --https-only \
--auth-mode login --as-user --full-uri
The caller needs a role that allows generating user delegation keys.
15
Your Azure Function has slow first responses after idle periods. What can you do?
That is cold start: the plan scaled to zero and must load a new instance. Options are moving to Flex Consumption with always-ready instances or the Premium plan with pre-warmed instances, reducing package size and dependencies, and choosing a faster-starting runtime. A timer ping is a hack that is not reliable. For strict latency APIs, a dedicated plan or Container Apps with minimum replicas is better.
16
Write a KQL query to find VMs with average CPU above 80% in the last hour.
Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights:
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == 'Processor' and CounterName == '% Processor Time'
| where InstanceName == '_Total'
| summarize avgCpu = avg(CounterValue) by Computer
| where avgCpu > 80
| order by avgCpu desc
17
Write a lifecycle management rule to tier and delete log blobs.
Create the logical server with an Entra admin group and no SQL logins, then the database:
az sql server create -g rg-data -n sql-shop-prod -l centralindia \
--enable-ad-only-auth \
--external-admin-principal-type Group \
--external-admin-name grp-sql-admins \
--external-admin-sid <group-object-id>
az sql db create -g rg-data -s sql-shop-prod -n shopdb \
--edition GeneralPurpose --family Gen5 --capacity 2 \
--zone-redundant true --backup-storage-redundancy Zone
Slots are live copies of an app with their own hostname, available from the Standard tier. You deploy to a staging slot, warm it up and test, then swap it with production. The swap redirects traffic with near-zero downtime and can be reversed by swapping back. Slot-specific settings, such as a staging database connection string, stay with the slot instead of moving during the swap.
20
How do you configure autoscale for an App Service plan?
In the plan's Scale out settings, choose rules-based autoscale or automatic scaling. A typical rule set: scale out by 1 instance when average CPU exceeds 70% for 10 minutes, scale in by 1 when below 30% for 10 minutes, minimum 2 and maximum 10 instances. Always pair scale-out with a scale-in rule and a cool-down period so the plan does not flap between sizes.
21
Why do you want to build a career in Microsoft Azure?
Situation: during my internship I saw most clients running Microsoft workloads like Windows Server, SQL Server and Active Directory. Task: I wanted skills that match that demand. Action: I cleared AZ-900, then studied AZ-104 and built labs with VNets, App Service and Bicep. Result: I can now deploy and troubleshoot real environments, and I want to grow toward an Azure architect role over the next few years.
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
23
You run a SaaS app with 300 small tenant databases whose usage peaks at different times. How do you host them cost-effectively?
An elastic pool shares a set of resources, in eDTUs or vCores, among many Azure SQL databases on one logical server. It suits SaaS apps with a database per tenant, where individual usage peaks at different times. Instead of sizing each database for its peak, you size the pool for combined usage and set per-database min and max limits. Too many busy databases at once will contend for resources.
24
What is the difference between a VPN Gateway and ExpressRoute?
A VPN Gateway creates encrypted IPsec tunnels over the public internet, for site-to-site or point-to-site connections, and is quick and cheap to set up. ExpressRoute is a private dedicated connection through a connectivity provider with predictable latency and bandwidth up to 100 Gbps, but it does not encrypt by default. Many companies use ExpressRoute as primary and a VPN as backup.
Peering connects two VNets over the Microsoft backbone with low latency, either in the same region or globally. Traffic stays private and is billed per GB. Peering is not transitive: if A peers with B and B peers with C, A cannot reach C. To route through a hub, use a network virtual appliance or Azure Firewall with user-defined routes, or use Azure Virtual WAN.
26
Users say an API is failing but no alert fired. What do you change?
Check whether alerts measured the right signal: CPU alerts miss application errors. Add alerts on user-facing SLIs, such as failed request rate, p95 latency and availability tests from multiple locations in Application Insights. Make sure the action group has correct recipients and that alert processing rules are not suppressing it. Review the incident timeline and add the missing signals to the on-call runbook.
27
What is the difference between Entra ID roles and Azure RBAC roles?
Entra ID roles, such as Global Administrator or User Administrator, control the directory: users, groups, app registrations and tenant settings. Azure RBAC roles, such as Owner, Contributor and Reader, control Azure resources at management group, subscription, resource group or resource scope. A Global Administrator has no resource access by default, though they can elevate themselves to User Access Administrator at root scope.
A NAT Gateway provides outbound internet connectivity for a subnet using one or more static public IPs. It gives a large pool of SNAT ports, avoiding the port exhaustion common with default outbound or Load Balancer outbound rules, and gives a fixed IP that partners can allowlist. Since default outbound access is being retired for new VNets, explicit outbound methods like NAT Gateway are recommended.
29
What is Azure Files and when would you use Azure File Sync?
Azure Files provides fully managed SMB and NFS shares that VMs and on-premises machines can mount, useful for lift-and-shift of apps expecting a file server. Azure File Sync installs an agent on Windows Servers to sync shares to Azure Files and use cloud tiering, keeping hot files locally and old files in the cloud. It helps branch offices share data without large local storage.
30
What is Azure Kubernetes Service (AKS) and what does Azure manage for you?
AKS is managed Kubernetes. Azure runs the control plane, including the API server and etcd, and handles upgrades and its availability. You manage node pools, which are VM scale sets, plus workloads, networking choices and add-ons. AKS integrates with Entra ID for cluster login, Azure CNI for pod networking, ACR for images, Key Vault via CSI driver and Azure Monitor Container Insights for logs and metrics.
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
32
Which Network Watcher tools do you use to troubleshoot connectivity?
IP flow verify tells you if an NSG rule allows or denies a specific packet and which rule matched. Next hop shows where routing sends traffic. Connection troubleshoot tests reachability from a VM to an endpoint. Effective security rules and effective routes show the combined result on a NIC. VNet flow logs record traffic for analysis with Traffic Analytics. Packet capture records traffic on a VM.
33
Describe a production incident you handled and what you learned.
Situation: an App Service API began returning 502 errors during peak hours. Task: restore service and find the root cause. Action: I scaled out to stop impact, then found in Application Insights that outbound SQL connections were exhausting SNAT ports. I added connection pooling and VNet integration with a NAT gateway. Result: errors stopped, and I wrote a postmortem and added a SNAT alert.
34
Tell me about a time you automated a manual process.
Situation: our team created test environments by hand, taking two days each. Task: make it self-service. Action: I wrote Bicep modules for the app, database and networking and a pipeline with parameters for environment name, plus an auto-delete tag cleaned up nightly by an Automation runbook. Result: environments took 20 minutes, and idle test cost dropped by about 30%.
35
Write a KQL query to find who deleted resources in the last 7 days.
Use the AzureActivity table, filtering on successful delete operations:
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue endswith '/DELETE'
| where ActivityStatusValue == 'Success'
| project TimeGenerated, Caller, OperationNameValue,
ResourceGroup, _ResourceId
| order by TimeGenerated desc
36
Write a Bicep snippet for a custom Azure Policy that denies resources outside India regions.
Define the rule with an allowed list and a deny effect, then assign it at a management group:
resource pol 'Microsoft.Authorization/policyDefinitions@2023-04-01' = {
name: 'allowed-india-regions'
properties: {
policyType: 'Custom'
mode: 'Indexed'
policyRule: {
if: {
field: 'location'
notIn: ['centralindia', 'southindia', 'westindia']
}
then: { effect: 'deny' }
}
}
}
Few big employers listed in Chandigarh?
Many Chandigarh candidates also apply to teams in Gurgaon and to remote or hybrid roles. Practise the Gurgaon set as well.
Which companies hire Microsoft Azure professionals in Chandigarh?
Companies with large offices in Chandigarh include many IT services and product firms. Use their company pages below to practise employer-specific sets.
Are Microsoft Azure interviews in Chandigarh different from other cities?
The questions depend more on the company than the city. Chandigarh's mix of employers decides the style: Interviews usually check strong fundamentals and practical tool skills
How do I find Microsoft Azure jobs in Chandigarh?
Shortlist companies with Chandigarh offices, keep your CV focused on Microsoft Azure projects, apply on company career pages and job portals with the Chandigarh filter, and practise the questions on this page before each interview.