36 practice questions with answers for Microsoft Azure interviews in Indore.
Microsoft Azure jobs in Indore
Indore is one of central India's fastest-growing IT hubs, with IT-services campuses and product start-ups in its Super Corridor and IT parks. Companies here hire many freshers and value hands-on project work.
Below are 36 questions that match the mix of service, product and domain employers hiring azure cloud support associates in Indore.
Solved for IndoreStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.
02
Write a KQL query to find who deleted resources in the last 7 days.
Use the AzureActivity table, filtering on successful delete operations:
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue endswith '/DELETE'
| where ActivityStatusValue == 'Success'
| project TimeGenerated, Caller, OperationNameValue,
ResourceGroup, _ResourceId
| order by TimeGenerated desc
03
Explain DTU and vCore purchasing models in Azure SQL Database.
DTU bundles CPU, memory and IO into fixed Basic, Standard and Premium sizes and is simple for small apps. The vCore model lets you choose compute and storage separately, with General Purpose, Business Critical and Hyperscale tiers, provisioned or serverless compute, and Azure Hybrid Benefit for existing SQL licences. vCore is recommended for most production workloads because it is transparent and easier to compare with on-premises.
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
05
How do you keep up with security changes in Azure?
Situation: Azure releases security changes every month, and missing one can expose our systems. Task: stay current without losing project time. Action: I follow Azure Updates and the Azure Security blog, read the monthly Defender for Cloud changes, review Service Health retirement notices and spend an hour weekly in a lab. Result: our team was ready for the mandatory MFA rollout for Azure sign-ins before it was enforced.
Use Entra ID integration with Kubernetes RBAC and disable local accounts. Make the API server private or restrict authorized IP ranges. Run workloads with Workload ID instead of secrets, keep secrets in Key Vault through the CSI driver, and apply Azure Policy for Kubernetes to block privileged pods. Enable Defender for Containers, use network policies, scan images in ACR and route egress through Azure Firewall.
07
Describe a production incident you handled and what you learned.
Situation: an App Service API began returning 502 errors during peak hours. Task: restore service and find the root cause. Action: I scaled out to stop impact, then found in Application Insights that outbound SQL connections were exhausting SNAT ports. I added connection pooling and VNet integration with a NAT gateway. Result: errors stopped, and I wrote a postmortem and added a SNAT alert.
08
Explain the built-in roles Owner, Contributor, Reader and User Access Administrator.
Owner has full access to resources and can assign roles to others. Contributor can create and manage all resources but cannot grant access or manage role assignments. Reader can only view resources. User Access Administrator can manage role assignments but not resources. Follow least privilege: most engineers need Contributor on their own resource groups and Reader elsewhere, with Owner held by very few people.
UDRs are custom routes in a route table attached to a subnet, overriding Azure system routes. A common use is sending 0.0.0.0/0 from spoke subnets to Azure Firewall in the hub, with next hop type Virtual appliance, so all outbound traffic is inspected. Mistakes in UDRs are a top cause of connectivity issues, so check effective routes on the NIC when troubleshooting.
10
How do you design monitoring for a production microservices app on AKS?
Enable Container Insights and Managed Prometheus with Managed Grafana for cluster and pod metrics. Instrument services with OpenTelemetry sending to Application Insights for distributed tracing. Send logs to a central Log Analytics workspace using cheaper table plans for verbose logs. Define SLOs for latency and error rate, alert on them through action groups and build dashboards and runbooks for common failures.
11
Write a basic Terraform configuration for a resource group and VNet with remote state.
Azure Arc extends the Azure control plane to servers, Kubernetes clusters and data services running on-premises or in other clouds. Once connected, those machines appear as Azure resources, so you can apply Azure Policy, RBAC, tags, Defender for Cloud, Update Manager and monitoring to them. It suits hybrid companies that keep some servers in their own datacenter but want one governance model.
13
Assign a role to a group at resource group scope with Azure CLI.
Look up the group object ID, then create the role assignment with the narrowest scope:
GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv)
az role assignment create \
--assignee-object-id $GROUP_ID \
--assignee-principal-type Group \
--role Contributor \
--scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev
Assigning to groups instead of users keeps access easy to audit.
14
Tell me about a time you fixed a networking issue under pressure.
Situation: after a firewall change, payment APIs in our spoke could not reach a partner endpoint. Task: restore traffic quickly. Action: I used Network Watcher next hop and firewall logs in Log Analytics, found the new rule collection had higher priority and denied the partner FQDN, and added an explicit allow. Result: service recovered in 25 minutes, and we added pipeline-based firewall rule reviews.
15
What is the difference between an app registration and a service principal?
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.
Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.
18
Tell me about a time you set up monitoring that caught a problem early.
Situation: our order service had silent failures that customers reported hours later. Task: detect them first. Action: I added Application Insights availability tests and a log alert on failed dependency calls to the payment gateway, routed to Teams and on-call. Result: two weeks later the alert caught an expired partner certificate within five minutes, and we fixed it before most users noticed.
Workload identity federation lets external workloads such as GitHub Actions, Kubernetes pods or other clouds get Entra ID tokens by exchanging their own OIDC tokens, without storing client secrets. You add a federated credential on an app registration or user-assigned managed identity that trusts a specific issuer and subject, such as a repo branch. AKS Workload ID uses this for pods to access Azure resources.
20
Write a GitHub Actions job that logs in to Azure with OIDC.
Grant id-token write permission and use a federated credential on the app registration, so no secret is stored:
permissions:
id-token: write
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
environment: prod
steps:
- uses: actions/checkout@v4
- uses: azure/login@v2
with:
client-id: ${{ vars.AZURE_CLIENT_ID }}
tenant-id: ${{ vars.AZURE_TENANT_ID }}
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
- run: az group list -o table
Managed disks are block storage volumes for VMs that Azure manages as resources, with built-in redundancy. Types are Standard HDD for backups and dev, Standard SSD for light workloads, Premium SSD for production, Premium SSD v2 with independently tunable IOPS and throughput, and Ultra Disk for very high IOPS and low latency such as SAP HANA. Disks can be LRS or ZRS for some types.
22
How do you manage secrets and configuration for many environments in pipelines?
Keep non-secret settings in parameter files or Azure App Configuration per environment. Keep secrets in Key Vault per environment and let apps read them via managed identity or Key Vault references, so pipelines rarely handle them. When pipelines need secrets, link variable groups to Key Vault and use environment approvals. Never echo secrets in logs and prefer federated identities over stored credentials.
23
A VM in a spoke cannot reach a VM in another spoke. What could be wrong?
Peering is not transitive, so spoke to spoke traffic needs a route through the hub. Check that both spokes have UDRs pointing the other spoke's range to the hub firewall, that peerings allow forwarded traffic, and that firewall network rules allow the flow. Then check NSGs on both subnets and NICs and the guest OS firewall. Use Network Watcher next hop and IP flow verify to confirm.
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
A lifecycle policy is a rule set on a storage account that automatically moves or deletes blobs based on age, last access or last modified time. For example, move logs to Cool after 30 days, to Archive after 90 days and delete after 365 days. It runs once a day and removes the need for custom cleanup scripts, which saves real money on large log or backup containers.
Defender for Cloud is a cloud security posture management and workload protection platform. The free foundational tier gives a secure score and recommendations based on the Microsoft cloud security benchmark. Paid Defender plans add threat detection for servers, storage, SQL, containers, Key Vault and App Service, vulnerability scanning and attack path analysis. It also covers AWS and GCP accounts and on-premises servers through Arc.
An NSG is a stateful packet filter with allow and deny rules on source, destination, port and protocol, processed by priority from 100 to 4096, lower number first. It attaches to a subnet, a NIC or both, and both must allow the traffic. Default rules allow VNet-to-VNet and outbound internet traffic and deny other inbound traffic. Service tags and application security groups simplify rules.
28
Explain stages, jobs, steps and environments in YAML pipelines.
A pipeline has stages, such as Build, Test and DeployProd, that run in sequence or parallel. Each stage has jobs, which run on one agent, and each job has steps, which are tasks or scripts. Deployment jobs target environments, which can have approvals, checks, business hours and deployment history. Templates let teams reuse stages and jobs across many repositories.
29
A developer accidentally overwrote important files in Blob Storage. How do you recover and prevent it?
If versioning was on, promote the previous version; if soft delete was on, undelete within the retention period. Point-in-time restore can roll back a whole container if enabled. If none were enabled, recovery may only be from backups. Going forward, enable versioning, soft delete and Azure Backup for blobs, give developers read-only roles in production and route writes only through the application identity.
30
What is Azure App Service and what does an App Service plan define?
App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.
31
Write a lifecycle management rule to tier and delete log blobs.
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
33
What is the what-if operation in Bicep deployments?
What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.
34
A team accidentally deleted a production resource group. How do you prevent this in future?
First recover what is possible: soft delete or backups for storage, Key Vault, SQL and VMs. Then add CanNotDelete locks on production groups, remove Owner and Contributor rights from individual users, and grant access through Entra groups with Privileged Identity Management for just-in-time elevation. Deploy infrastructure through pipelines only, and set activity log alerts on delete operations so the team is notified instantly.
35
Partners need to allowlist a fixed outbound IP from your AKS cluster. How do you do it?
Configure the cluster's outbound type as a managed or user-assigned NAT Gateway with a static public IP, or route egress through Azure Firewall using userDefinedRouting so all traffic leaves from the firewall's public IP. Share that IP with partners. NAT Gateway is simpler and gives many SNAT ports, while Azure Firewall adds FQDN filtering and logging for compliance.
36
Write an Azure Pipelines YAML that builds a .NET app and deploys it to App Service.
Which companies hire Microsoft Azure professionals in Indore?
Companies with large offices in Indore include many IT services and product firms. Use their company pages below to practise employer-specific sets.
Are Microsoft Azure interviews in Indore different from other cities?
The questions depend more on the company than the city. Indore's mix of employers decides the style: Companies here hire many freshers and value hands-on project work
How do I find Microsoft Azure jobs in Indore?
Shortlist companies with Indore offices, keep your CV focused on Microsoft Azure projects, apply on company career pages and job portals with the Indore filter, and practise the questions on this page before each interview.