Skip to content

Microsoft Azure Interview Questions in Chennai

36 practice questions with answers for Microsoft Azure interviews in Chennai.

Microsoft Azure jobs in Chennai

Chennai is a long-standing IT-services and SaaS hub along OMR, with strong demand for testing, data and support-engineering roles. Many companies here hire freshers in large batches and train them on the job.

Below are 36 questions that match the mix of service, product and domain employers hiring azure cloud support associates in Chennai.

Solved for ChennaiStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

Write a basic Terraform configuration for a resource group and VNet with remote state.

Save to ▾
Show answer
Configure the azurerm backend and provider, then resources: terraform { backend "azurerm" { resource_group_name = "rg-tfstate" storage_account_name = "sttfstateprod" container_name = "state" key = "network.tfstate" use_azuread_auth = true } } provider "azurerm" { features {} } resource "azurerm_resource_group" "net" { name = "rg-net-prod" location = "centralindia" } resource "azurerm_virtual_network" "hub" { name = "vnet-hub" location = azurerm_resource_group.net.location resource_group_name = azurerm_resource_group.net.name address_space = ["10.0.0.0/16"] }
02

What are triggers and bindings in Azure Functions?

Save to ▾
Show answer
A trigger is what starts a function, and each function has exactly one: HTTP, Timer, Blob, Queue, Service Bus, Event Grid, Event Hubs or Cosmos DB change feed. Bindings declaratively connect inputs and outputs, for example reading a blob and writing to a queue without writing SDK code. They reduce boilerplate, but for complex error handling or batching you may still use the SDK directly.
03

How would you reduce the cost of many idle dev and test databases?

Save to ▾
Show answer
Move them to serverless General Purpose with auto-pause, or into an elastic pool if they are always on but lightly used. Use Azure Hybrid Benefit if you own SQL licences, use the Azure Dev/Test pricing offer for non-production subscriptions, delete databases nobody has connected to in months, and use smaller backup retention and LRS backup storage for non-production.
04

Write a Bicep snippet for a custom Azure Policy that denies resources outside India regions.

Save to ▾
Show answer
Define the rule with an allowed list and a deny effect, then assign it at a management group: resource pol 'Microsoft.Authorization/policyDefinitions@2023-04-01' = { name: 'allowed-india-regions' properties: { policyType: 'Custom' mode: 'Indexed' policyRule: { if: { field: 'location' notIn: ['centralindia', 'southindia', 'westindia'] } then: { effect: 'deny' } } } }
05

Write a KQL query to find who deleted resources in the last 7 days.

Save to ▾
Show answer
Use the AzureActivity table, filtering on successful delete operations: AzureActivity | where TimeGenerated > ago(7d) | where OperationNameValue endswith '/DELETE' | where ActivityStatusValue == 'Success' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, _ResourceId | order by TimeGenerated desc
06

Tell me about a time you improved database performance.

Save to ▾
Show answer
Situation: our reports page took 14 seconds to load on Azure SQL. Task: bring it under two seconds. Action: Query Store showed one query scanning a 40 million row table. I added a covering index, rewrote a correlated subquery as a join and cached the result in Redis for five minutes. Result: load time fell to about 800 ms and DTU usage dropped, so we avoided a tier upgrade.
07

How do you find and fix slow queries in Azure SQL Database?

Save to ▾
Show answer
Open Query Performance Insight or Query Store to find the top queries by CPU, duration and IO. Check execution plans for scans, missing indexes and parameter sniffing. Review automatic tuning recommendations to create indexes or force the last good plan. Query DMVs like sys.dm_exec_query_stats and sys.dm_db_resource_stats. If resources are maxed after tuning, scale up or add read replicas.
08

What are Request Units (RUs) in Cosmos DB?

Save to ▾
Show answer
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
09

Tell me about a time you led a migration of workloads to Azure.

Save to ▾
Show answer
Situation: our company had to exit a leased datacenter in nine months with 120 VMs. Task: lead the compute migration. Action: I ran Azure Migrate assessments, grouped VMs by dependency into waves, rehosted most with Azure Migrate and moved web apps to App Service, with rollback plans for each wave. Result: we finished a month early and cut monthly run cost by about 25% after right-sizing.
10

Why would you use Azure Cache for Redis?

Save to ▾
Show answer
Redis is an in-memory key-value store used for caching frequent database reads, storing user sessions, rate limiting, leaderboards and pub/sub. Caching a product catalogue can cut database load and bring latency from tens of milliseconds to around one. Use the cache-aside pattern with sensible TTLs. Microsoft now steers new deployments to Azure Managed Redis, which is based on Redis Enterprise.
11

How do you create a budget with alerts for a subscription?

Save to ▾
Show answer
In Cost Management, choose Budgets, set the scope to the subscription or a resource group, a monthly amount and alert conditions such as 50%, 80% and 100% of actual cost and 100% of forecast. Add email recipients and an action group that can notify Teams or run an automation. Budgets do not stop spending on their own, so pair them with automation or policy if needed.
12

What is a NAT Gateway and why would you use it?

Save to ▾
Show answer
A NAT Gateway provides outbound internet connectivity for a subnet using one or more static public IPs. It gives a large pool of SNAT ports, avoiding the port exhaustion common with default outbound or Load Balancer outbound rules, and gives a fixed IP that partners can allowlist. Since default outbound access is being retired for new VNets, explicit outbound methods like NAT Gateway are recommended.
13

What is Microsoft Entra ID?

Save to ▾
Show answer
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
14

Write a GitHub Actions job that logs in to Azure with OIDC.

Save to ▾
Show answer
Grant id-token write permission and use a federated credential on the app registration, so no secret is stored: permissions: id-token: write contents: read jobs: deploy: runs-on: ubuntu-latest environment: prod steps: - uses: actions/checkout@v4 - uses: azure/login@v2 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - run: az group list -o table
15

What is Microsoft Azure and which service models does it offer?

Save to ▾
Show answer
Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.
16

What is Azure Resource Graph?

Save to ▾
Show answer
Azure Resource Graph is a fast query service over resource metadata across all subscriptions you can access, using KQL. It is used for inventory, compliance checks and finding orphaned resources, such as unattached disks or public IPs, much faster than looping through APIs. The portal's All resources view and Azure Policy compliance use it. Results reflect configuration, not performance metrics.
17

How would you protect a public web application from attacks like SQL injection and DDoS?

Save to ▾
Show answer
Put Azure Front Door Premium or Application Gateway with WAF in front of the app, using the managed Default Rule Set based on OWASP plus bot protection and rate limits. Enable Azure DDoS Network Protection on the VNet for layer 3 and 4 attacks on public IPs. Lock the app so it accepts traffic only from Front Door, using access restrictions with the service tag and the Front Door ID header.
18

What are user-defined routes (UDRs)?

Save to ▾
Show answer
UDRs are custom routes in a route table attached to a subnet, overriding Azure system routes. A common use is sending 0.0.0.0/0 from spoke subnets to Azure Firewall in the hub, with next hop type Virtual appliance, so all outbound traffic is inspected. Mistakes in UDRs are a top cause of connectivity issues, so check effective routes on the NIC when troubleshooting.
19

What are active geo-replication and failover groups?

Save to ▾
Show answer
Active geo-replication creates readable secondary databases in other regions, up to four, with asynchronous replication and manual failover per database. Failover groups manage a group of databases together, provide read-write and read-only listener endpoints that stay the same after failover, and support automatic failover by policy. Applications should use the failover group listener so connection strings do not change during a regional failover.
20

What is the shared responsibility model in Azure?

Save to ▾
Show answer
Security duties are split between Microsoft and the customer. Microsoft always owns physical datacenters, hosts and the network fabric. The customer always owns data, identities, accounts and devices. The middle layers move with the service model: in IaaS you patch the OS and configure firewalls; in PaaS Microsoft patches the OS and runtime; in SaaS you mainly manage users and data.
21

What are deployment slots in App Service?

Save to ▾
Show answer
Slots are live copies of an app with their own hostname, available from the Standard tier. You deploy to a staging slot, warm it up and test, then swap it with production. The swap redirects traffic with near-zero downtime and can be reversed by swapping back. Slot-specific settings, such as a staging database connection string, stay with the slot instead of moving during the swap.
22

You run a SaaS app with 300 small tenant databases whose usage peaks at different times. How do you host them cost-effectively?

Save to ▾
Show answer
An elastic pool shares a set of resources, in eDTUs or vCores, among many Azure SQL databases on one logical server. It suits SaaS apps with a database per tenant, where individual usage peaks at different times. Instead of sizing each database for its peak, you size the pool for combined usage and set per-database min and max limits. Too many busy databases at once will contend for resources.
23

What is the difference between an app registration and a service principal?

Save to ▾
Show answer
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
24

Explain the 5 Rs (or 6 Rs) of cloud migration in an Azure context.

Save to ▾
Show answer
Rehost moves VMs as-is using Azure Migrate. Refactor makes small changes, such as moving a web app to App Service. Rearchitect changes the design, for example splitting into microservices on AKS. Rebuild rewrites as cloud-native. Replace swaps the app for SaaS. Some lists add Retire or Retain. Azure Migrate assessments help choose per workload based on dependencies, cost and readiness.
25

What is the difference between CapEx and OpEx, and how does Azure change it?

Save to ▾
Show answer
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
26

A team accidentally deleted a production resource group. How do you prevent this in future?

Save to ▾
Show answer
First recover what is possible: soft delete or backups for storage, Key Vault, SQL and VMs. Then add CanNotDelete locks on production groups, remove Owner and Contributor rights from individual users, and grant access through Entra groups with Privileged Identity Management for just-in-time elevation. Deploy infrastructure through pipelines only, and set activity log alerts on delete operations so the team is notified instantly.
27

A developer's service principal secret was committed to a public GitHub repo. What do you do?

Save to ▾
Show answer
Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.
28

What is a managed identity and what types exist?

Save to ▾
Show answer
A managed identity is an Entra ID identity that Azure creates and rotates for a resource, so code can get tokens without storing secrets. A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource you can attach to many resources and that survives their deletion. User-assigned is better when several apps share access or when you pre-create role assignments.
29

Tell me about a time you set up monitoring that caught a problem early.

Save to ▾
Show answer
Situation: our order service had silent failures that customers reported hours later. Task: detect them first. Action: I added Application Insights availability tests and a log alert on failed dependency calls to the payment gateway, routed to Teams and on-call. Result: two weeks later the alert caught an expired partner certificate within five minutes, and we fixed it before most users noticed.
30

What are soft delete, versioning and immutable storage for blobs?

Save to ▾
Show answer
Soft delete keeps deleted blobs or containers for a retention period so you can restore them. Versioning saves the previous version automatically each time a blob is overwritten. Immutable storage applies time-based retention or legal hold policies in WORM mode, so nobody, not even an admin, can delete or change data until it expires. Regulated firms use immutability for audit records and ransomware protection.
31

What is a Log Analytics workspace?

Save to ▾
Show answer
A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.
32

What is Azure Data Lake Storage Gen2?

Save to ▾
Show answer
ADLS Gen2 is a storage account with hierarchical namespace enabled, adding real directories, atomic renames and POSIX-style ACLs on top of Blob Storage. It is the storage layer for analytics engines such as Azure Databricks, Synapse and Microsoft Fabric. Directory operations become fast, which matters for Spark jobs. You keep Blob pricing and tiers but must plan ACLs and RBAC together.
33

What is Application Insights?

Save to ▾
Show answer
Application Insights is the APM feature of Azure Monitor. It collects requests, dependencies, exceptions, traces and custom events from apps through OpenTelemetry-based SDKs or auto-instrumentation in App Service, Functions and AKS. Features include the application map, live metrics, failure and performance analysis, availability tests and distributed tracing. Workspace-based resources store data in Log Analytics so you can join it with infrastructure logs.
34

Your storage costs are growing fast because of old logs. What do you do?

Save to ▾
Show answer
Use Storage insights and Cost Analysis to find which containers and tiers drive cost. Enable last access tracking and apply lifecycle rules that move logs to Cool, then Cold or Archive, and delete after the retention period required by policy. Check for unnecessary GRS replication on non-critical data and leftover snapshots. Compress logs before upload and stop verbose logging at the source.
35

What is Azure Key Vault and what can it store?

Save to ▾
Show answer
Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.
36

Create a VNet with two subnets and an NSG rule using Azure CLI.

Save to ▾
Show answer
Create the VNet, add subnets, then an NSG that allows HTTPS and attach it: az network vnet create -g rg-net -n vnet-app \ --address-prefixes 10.20.0.0/16 \ --subnet-name snet-web --subnet-prefixes 10.20.1.0/24 az network vnet subnet create -g rg-net --vnet-name vnet-app \ -n snet-db --address-prefixes 10.20.2.0/24 az network nsg create -g rg-net -n nsg-web az network nsg rule create -g rg-net --nsg-name nsg-web -n allow-https \ --priority 100 --direction Inbound --access Allow \ --protocol Tcp --destination-port-ranges 443 az network vnet subnet update -g rg-net --vnet-name vnet-app \ -n snet-web --network-security-group nsg-web

Companies with offices in Chennai (11)

Frequently asked questions

Which companies hire Microsoft Azure professionals in Chennai?

Companies with large offices in Chennai include TCS, Infosys, Wipro, Cognizant, Capgemini, HCLTech, Tech Mahindra, LTIMindtree, Mphasis, Hexaware. Use their company pages below to practise employer-specific sets.

Are Microsoft Azure interviews in Chennai different from other cities?

The questions depend more on the company than the city. Chennai's mix of employers decides the style: Many companies here hire freshers in large batches and train them on the job

How do I find Microsoft Azure jobs in Chennai?

Shortlist companies with Chennai offices, keep your CV focused on Microsoft Azure projects, apply on company career pages and job portals with the Chennai filter, and practise the questions on this page before each interview.