36 practice questions with answers for Microsoft Azure interviews in Coimbatore.
Microsoft Azure jobs in Coimbatore
Coimbatore has a growing IT-services and engineering-services market around TIDEL Park and its SEZs, supported by a large pool of engineering graduates. Many roles are with delivery centres of bigger IT firms.
Below are 36 questions that match the mix of service, product and domain employers hiring azure cloud support associates in Coimbatore.
Solved for CoimbatoreStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
02
How do you create a budget with alerts for a subscription?
In Cost Management, choose Budgets, set the scope to the subscription or a resource group, a monthly amount and alert conditions such as 50%, 80% and 100% of actual cost and 100% of forecast. Add email recipients and an action group that can notify Teams or run an automation. Budgets do not stop spending on their own, so pair them with automation or policy if needed.
03
Create an Azure SQL Database with Entra-only authentication using Azure CLI.
Create the logical server with an Entra admin group and no SQL logins, then the database:
az sql server create -g rg-data -n sql-shop-prod -l centralindia \
--enable-ad-only-auth \
--external-admin-principal-type Group \
--external-admin-name grp-sql-admins \
--external-admin-sid <group-object-id>
az sql db create -g rg-data -s sql-shop-prod -n shopdb \
--edition GeneralPurpose --family Gen5 --capacity 2 \
--zone-redundant true --backup-storage-redundancy Zone
04
A team accidentally deleted a production resource group. How do you prevent this in future?
First recover what is possible: soft delete or backups for storage, Key Vault, SQL and VMs. Then add CanNotDelete locks on production groups, remove Owner and Contributor rights from individual users, and grant access through Entra groups with Privileged Identity Management for just-in-time elevation. Deploy infrastructure through pipelines only, and set activity log alerts on delete operations so the team is notified instantly.
05
Design a disaster recovery plan for a VM-based application in Central India.
Agree RPO and RTO with the business. Replicate VMs to South India with Azure Site Recovery, configure recovery plans that start the database first, then app and web tiers, and pre-create the network. Use Traffic Manager or Front Door for DNS failover. Back up data separately with Azure Backup in case of corruption. Run test failovers into an isolated VNet every quarter.
06
Your secure score in Defender for Cloud is low. How do you improve it?
Sort recommendations by the score increase and effort. Typical quick wins are enabling MFA for all privileged accounts, restricting management ports with just-in-time access, enabling endpoint protection and vulnerability assessment on VMs, and turning on diagnostic logs. Use Azure Policy to enforce fixes so new resources stay compliant. Assign owners and due dates through governance rules and track progress weekly.
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
08
Your manager asks you to estimate the monthly cost of a new Azure application. How do you do it?
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
09
Read a blob in Python using DefaultAzureCredential.
DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored:
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient
url = 'https://stshopprod.blob.core.windows.net'
client = BlobServiceClient(url, credential=DefaultAzureCredential())
blob = client.get_blob_client('invoices', '2026/inv-1001.pdf')
data = blob.download_blob().readall()
print(len(data))
10
How do you prioritise when several alerts fire at the same time?
Situation: during a release night, CPU, disk and payment error alerts fired together. Task: decide what to handle first. Action: I ranked by customer impact, so payment failures came first, checked Service Health for a platform issue, assigned disk and CPU checks to a teammate and kept a running update in the incident channel. Result: payments recovered quickly and we tuned the noisy CPU alerts afterwards.
11
Write a KQL query to find VMs with average CPU above 80% in the last hour.
Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights:
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == 'Processor' and CounterName == '% Processor Time'
| where InstanceName == '_Total'
| summarize avgCpu = avg(CounterValue) by Computer
| where avgCpu > 80
| order by avgCpu desc
12
What is Azure Firewall and how is it different from an NSG?
Azure Firewall is a managed, stateful, centralised firewall with network and application rules, FQDN filtering, threat intelligence and, in the Premium SKU, TLS inspection and IDPS. NSGs are distributed basic filters on subnets and NICs. Typically NSGs control traffic within and between subnets, while Azure Firewall in a hub controls internet egress and cross-spoke traffic with central logging.
13
What is Azure Kubernetes Service (AKS) and what does Azure manage for you?
AKS is managed Kubernetes. Azure runs the control plane, including the API server and etcd, and handles upgrades and its availability. You manage node pools, which are VM scale sets, plus workloads, networking choices and add-ons. AKS integrates with Entra ID for cluster login, Azure CNI for pod networking, ACR for images, Key Vault via CSI driver and Azure Monitor Container Insights for logs and metrics.
Metric alerts evaluate metrics such as CPU above 80% and can be dynamic with machine-learned thresholds. Log search alerts run KQL queries on a schedule. Activity log alerts fire on control-plane events or Service Health incidents. Smart detection in Application Insights finds anomalies. Alerts trigger action groups that send emails, SMS, Teams messages, webhooks or run Functions, Logic Apps and Automation runbooks.
15
Explain the hierarchy of management groups, subscriptions, resource groups and resources.
A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.
A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.
17
Why do you want to build a career in Microsoft Azure?
Situation: during my internship I saw most clients running Microsoft workloads like Windows Server, SQL Server and Active Directory. Task: I wanted skills that match that demand. Action: I cleared AZ-900, then studied AZ-104 and built labs with VNets, App Service and Bicep. Result: I can now deploy and troubleshoot real environments, and I want to grow toward an Azure architect role over the next few years.
18
Write a basic Terraform configuration for a resource group and VNet with remote state.
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
20
Which Network Watcher tools do you use to troubleshoot connectivity?
IP flow verify tells you if an NSG rule allows or denies a specific packet and which rule matched. Next hop shows where routing sends traffic. Connection troubleshoot tests reachability from a VM to an endpoint. Effective security rules and effective routes show the combined result on a NIC. VNet flow logs record traffic for analysis with Traffic Analytics. Packet capture records traffic on a VM.
21
How do you find and fix slow queries in Azure SQL Database?
Open Query Performance Insight or Query Store to find the top queries by CPU, duration and IO. Check execution plans for scans, missing indexes and parameter sniffing. Review automatic tuning recommendations to create indexes or force the last good plan. Query DMVs like sys.dm_exec_query_stats and sys.dm_db_resource_stats. If resources are maxed after tuning, scale up or add read replicas.
Azure DNS hosts public DNS zones on Microsoft's global name servers so you can manage records like A and CNAME with RBAC. Private DNS zones resolve names only inside linked VNets, used for internal names and private endpoints. For hybrid name resolution, Azure DNS Private Resolver lets on-premises DNS forward queries into Azure and Azure forward queries back on-premises without custom DNS VMs.
23
Generate a user delegation SAS for one blob with Azure CLI.
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity:
az storage blob generate-sas \
--account-name stshopprod --container-name invoices \
--name inv-1001.pdf --permissions r \
--expiry 2026-11-12T18:00Z --https-only \
--auth-mode login --as-user --full-uri
The caller needs a role that allows generating user delegation keys.
24
Tell me about a time you improved database performance.
Situation: our reports page took 14 seconds to load on Azure SQL. Task: bring it under two seconds. Action: Query Store showed one query scanning a 40 million row table. I added a covering index, rewrote a correlated subquery as a join and cached the result in Redis for five minutes. Result: load time fell to about 800 ms and DTU usage dropped, so we avoided a tier upgrade.
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
27
Explain the storage redundancy options LRS, ZRS, GRS and GZRS.
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
28
Your VMs run 24x7, but their sizes and regions change every few months. Would you buy reservations or a savings plan?
Reservations give a big discount, up to about 72% versus pay-as-you-go, when you commit to a specific VM family, region and term of one or three years. Savings plans commit to a fixed hourly spend for one or three years and apply flexibly across VM sizes, regions, App Service and Functions Premium. Use reservations for very stable workloads and savings plans when your sizes or regions change.
Peering connects two VNets over the Microsoft backbone with low latency, either in the same region or globally. Traffic stays private and is billed per GB. Peering is not transitive: if A peers with B and B peers with C, A cannot reach C. To route through a hub, use a network virtual appliance or Azure Firewall with user-defined routes, or use Azure Virtual WAN.
30
What are resource locks and when would you use them?
Locks protect resources from accidental change. CanNotDelete allows reads and updates but blocks deletion; ReadOnly allows only reads, which can break operations like listing storage keys. Locks apply to a subscription, group or resource and are inherited. Teams put CanNotDelete on production resource groups, DNS zones and ExpressRoute circuits. Only Owner or User Access Administrator roles can remove locks by default.
Export a similar built-in role as JSON, keep only needed Actions and DataActions, set AssignableScopes and create it:
az role definition list --name 'Virtual Machine Contributor' > vm-op.json
# edit: Name 'VM Operator', Actions:
# Microsoft.Compute/virtualMachines/read
# Microsoft.Compute/virtualMachines/start/action
# Microsoft.Compute/virtualMachines/restart/action
# Microsoft.Compute/virtualMachines/deallocate/action
az role definition create --role-definition vm-op.json
32
Your Azure Function has slow first responses after idle periods. What can you do?
That is cold start: the plan scaled to zero and must load a new instance. Options are moving to Flex Consumption with always-ready instances or the Premium plan with pre-warmed instances, reducing package size and dependencies, and choosing a faster-starting runtime. A timer ping is a hack that is not reliable. For strict latency APIs, a dedicated plan or Container Apps with minimum replicas is better.
33
How do you create a resource group and list resources using Azure CLI?
Log in, select the subscription, create the group with tags, then list its resources in a table:
az login
az account set --subscription 'Prod-Sub'
az group create --name rg-shop-prod --location centralindia --tags env=prod owner=shop
az resource list --resource-group rg-shop-prod --output table
The --query flag with JMESPath filters output, for example --query '[].name'.
34
How do you handle a failed release that affected customers?
Situation: a release broke login for some mobile users on a Friday evening. Task: restore service fast and prevent repeats. Action: I swapped the App Service slot back to the previous version within ten minutes, informed support, then reproduced the bug in staging and found a missing config value. Result: we added config validation and smoke tests on login to the pipeline, and wrote a blameless postmortem.
35
How do you migrate an on-premises SQL Server database to Azure SQL Managed Instance?
Assess with Azure Migrate or the Azure SQL migration extension in Azure Data Studio to find compatibility issues and size the target. For minimal downtime, use the Managed Instance link or Log Replay Service to continuously replicate, then cut over in minutes. For smaller databases, an offline native backup to Blob Storage and RESTORE FROM URL works. Test application connectivity and performance before switching.
36
What is a Shared Access Signature (SAS) and what types exist?
A SAS is a signed URL token granting limited access to storage for a set time and permissions, such as read-only for one blob for one hour. A user delegation SAS is signed with Entra ID credentials and is the most secure. A service SAS and an account SAS are signed with the account key. Always use HTTPS, short expiry and stored access policies so tokens can be revoked.
Few big employers listed in Coimbatore?
Many Coimbatore candidates also apply to teams in Chennai and to remote or hybrid roles. Practise the Chennai set as well.
Which companies hire Microsoft Azure professionals in Coimbatore?
Companies with large offices in Coimbatore include many IT services and product firms. Use their company pages below to practise employer-specific sets.
Are Microsoft Azure interviews in Coimbatore different from other cities?
The questions depend more on the company than the city. Coimbatore's mix of employers decides the style: Many roles are with delivery centres of bigger IT firms
How do I find Microsoft Azure jobs in Coimbatore?
Shortlist companies with Coimbatore offices, keep your CV focused on Microsoft Azure projects, apply on company career pages and job portals with the Coimbatore filter, and practise the questions on this page before each interview.