36 practice questions with answers for Microsoft Azure interviews in Kochi.
Microsoft Azure jobs in Kochi
Kochi's Infopark and SmartCity host IT-services firms, product companies and start-ups, making it Kerala's largest tech job market along with Thiruvananthapuram. Testing and data roles are common in its service and product teams.
Below are 36 questions that match the mix of service, product and domain employers hiring azure cloud support associates in Kochi.
Solved for KochiStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you configure autoscale for an App Service plan?
In the plan's Scale out settings, choose rules-based autoscale or automatic scaling. A typical rule set: scale out by 1 instance when average CPU exceeds 70% for 10 minutes, scale in by 1 when below 30% for 10 minutes, minimum 2 and maximum 10 instances. Always pair scale-out with a scale-in rule and a cool-down period so the plan does not flap between sizes.
02
Compare Azure Load Balancer, Application Gateway, Front Door and Traffic Manager.
Load Balancer works at layer 4 (TCP/UDP) inside a region. Application Gateway is a regional layer 7 load balancer with path routing, TLS termination and an optional WAF. Front Door is a global layer 7 entry point with anycast, CDN caching and WAF. Traffic Manager is DNS-based global routing for any protocol. Use Front Door for global web apps and Load Balancer for non-HTTP traffic.
03
What is Azure Kubernetes Service (AKS) and what does Azure manage for you?
AKS is managed Kubernetes. Azure runs the control plane, including the API server and etcd, and handles upgrades and its availability. You manage node pools, which are VM scale sets, plus workloads, networking choices and add-ons. AKS integrates with Entra ID for cluster login, Azure CNI for pod networking, ACR for images, Key Vault via CSI driver and Azure Monitor Container Insights for logs and metrics.
04
What is the difference between a VPN Gateway and ExpressRoute?
A VPN Gateway creates encrypted IPsec tunnels over the public internet, for site-to-site or point-to-site connections, and is quick and cheap to set up. ExpressRoute is a private dedicated connection through a connectivity provider with predictable latency and bandwidth up to 100 Gbps, but it does not encrypt by default. Many companies use ExpressRoute as primary and a VPN as backup.
05
A developer accidentally overwrote important files in Blob Storage. How do you recover and prevent it?
If versioning was on, promote the previous version; if soft delete was on, undelete within the retention period. Point-in-time restore can roll back a whole container if enabled. If none were enabled, recovery may only be from backups. Going forward, enable versioning, soft delete and Azure Backup for blobs, give developers read-only roles in production and route writes only through the application identity.
06
Your company needs a reliable private link from its Pune datacenter to Azure. What do you propose?
Propose ExpressRoute through a provider at the Pune or Mumbai peering location with private peering into a hub VNet in Central India, sized for current and forecast bandwidth. Add a site-to-site VPN as a failover path, or a second ExpressRoute circuit at another peering location for higher resilience. Use BGP for route exchange, and encrypt traffic with MACsec or IPsec if compliance requires.
07
What is the what-if operation in Bicep deployments?
What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.
08
Read a blob in Python using DefaultAzureCredential.
DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored:
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient
url = 'https://stshopprod.blob.core.windows.net'
client = BlobServiceClient(url, credential=DefaultAzureCredential())
blob = client.get_blob_client('invoices', '2026/inv-1001.pdf')
data = blob.download_blob().readall()
print(len(data))
Disable shared key access where possible and use Entra ID with RBAC roles like Storage Blob Data Reader. Use managed identities for apps. Disable public blob access, require TLS 1.2, restrict the firewall to selected VNets, or use private endpoints and disable public network access. Enable soft delete, versioning and Defender for Storage, and keep keys, if any, in Key Vault with rotation.
UDRs are custom routes in a route table attached to a subnet, overriding Azure system routes. A common use is sending 0.0.0.0/0 from spoke subnets to Azure Firewall in the hub, with next hop type Virtual appliance, so all outbound traffic is inspected. Mistakes in UDRs are a top cause of connectivity issues, so check effective routes on the NIC when troubleshooting.
11
How do you document and hand over a network design to the operations team?
Situation: I designed a hub-spoke network that a separate operations team would run. Task: make sure they could support it without calling me. Action: I wrote a short design note with diagrams, IP plan, routing and firewall rule ownership, kept everything in Bicep, and ran two walkthrough sessions with troubleshooting exercises using Network Watcher. Result: they handled the first three incidents independently.
Azure Boards tracks work items, sprints and backlogs. Azure Repos hosts Git repositories with branch policies. Azure Pipelines runs CI/CD on Microsoft-hosted or self-hosted agents. Azure Test Plans manages manual and exploratory testing. Azure Artifacts hosts NuGet, npm, Maven and Python feeds. Many Indian service companies still run client projects on Azure DevOps, while product companies often use GitHub Actions.
13
Your Azure Function has slow first responses after idle periods. What can you do?
That is cold start: the plan scaled to zero and must load a new instance. Options are moving to Flex Consumption with always-ready instances or the Premium plan with pre-warmed instances, reducing package size and dependencies, and choosing a faster-starting runtime. A timer ping is a hack that is not reliable. For strict latency APIs, a dedicated plan or Container Apps with minimum replicas is better.
14
How do you design an Azure subscription strategy for a large enterprise with many business units?
Use management groups that mirror governance needs rather than the org chart, for example Platform, Corp landing zones, Online landing zones and Sandbox. Give each application or business unit its own subscriptions per environment to isolate quotas, cost and blast radius. Automate subscription vending with pre-wired networking, policy and RBAC. Keep the hierarchy shallow, ideally three or four levels, to avoid policy confusion.
15
What is Azure Monitor and what data does it collect?
Azure Monitor is the unified monitoring platform for Azure and hybrid resources. It collects metrics, which are numeric time series stored for 93 days, and logs, which are records stored in Log Analytics workspaces and queried with KQL. Sources include platform metrics, activity logs, resource logs through diagnostic settings, VM guest data through the Azure Monitor Agent and app telemetry from Application Insights.
It is Microsoft's guidance for building quality workloads, organised into five pillars: reliability, security, cost optimization, operational excellence and performance efficiency. Each pillar has design principles, checklists and trade-offs. Azure Advisor and the Well-Architected Review tool score workloads against it. In design interviews, structure answers by pillar to show you considered failure, security and cost, not only features.
ADLS Gen2 is a storage account with hierarchical namespace enabled, adding real directories, atomic renames and POSIX-style ACLs on top of Blob Storage. It is the storage layer for analytics engines such as Azure Databricks, Synapse and Microsoft Fabric. Directory operations become fast, which matters for Spark jobs. You keep Blob pricing and tiers but must plan ACLs and RBAC together.
An NSG is a stateful packet filter with allow and deny rules on source, destination, port and protocol, processed by priority from 100 to 4096, lower number first. It attaches to a subnet, a NIC or both, and both must allow the traffic. Default rules allow VNet-to-VNet and outbound internet traffic and deny other inbound traffic. Service tags and application security groups simplify rules.
Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.
20
Your pipeline takes 40 minutes. How do you speed it up?
Profile which stages are slow. Cache dependencies like NuGet or npm packages, run unit tests and linting in parallel jobs, and split slow integration tests to run only on main or nightly. Use self-hosted or Managed DevOps Pools agents with warm caches for big builds, build container images with layer caching, and deploy only changed services in a monorepo using path filters.
21
How do you handle disagreement with a developer about database design?
Situation: a developer wanted to store all order data as JSON blobs in one table. Task: agree on a design that would scale. Action: I listened to his reason, faster development, then built a small benchmark showing filter and reporting queries on both designs and proposed relational tables with a JSON column for flexible attributes. Result: we adopted the hybrid, and reporting stayed fast.
22
You run a SaaS app with 300 small tenant databases whose usage peaks at different times. How do you host them cost-effectively?
An elastic pool shares a set of resources, in eDTUs or vCores, among many Azure SQL databases on one logical server. It suits SaaS apps with a database per tenant, where individual usage peaks at different times. Instead of sizing each database for its peak, you size the pool for combined usage and set per-database min and max limits. Too many busy databases at once will contend for resources.
23
Write a simple HTTP-triggered Azure Function in Python (v2 programming model).
The v2 model uses decorators in function_app.py, so no function.json is needed:
import azure.functions as func
app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION)
@app.route(route='hello', methods=['GET'])
def hello(req: func.HttpRequest) -> func.HttpResponse:
name = req.params.get('name', 'world')
return func.HttpResponse(f'Hello, {name}', status_code=200)
Callers pass the function key in the code query parameter or x-functions-key header.
24
What compute options does Azure offer and when do you choose each?
Virtual Machines give full OS control for legacy or custom software. Virtual Machine Scale Sets add autoscaling of identical VMs. App Service hosts web apps and APIs as PaaS. Azure Functions runs event-driven code serverlessly. AKS runs Kubernetes for container microservices, and Container Apps runs containers without managing Kubernetes. Batch handles large parallel jobs. Choose based on control needed, scaling pattern and team skills.
25
Explain DTU and vCore purchasing models in Azure SQL Database.
DTU bundles CPU, memory and IO into fixed Basic, Standard and Premium sizes and is simple for small apps. The vCore model lets you choose compute and storage separately, with General Purpose, Business Critical and Hyperscale tiers, provisioned or serverless compute, and Azure Hybrid Benefit for existing SQL licences. vCore is recommended for most production workloads because it is transparent and easier to compare with on-premises.
26
How do you give an external auditor read-only access to your Azure environment for two weeks?
Invite the auditor as a B2B guest user in Entra ID, add them to a group, and assign the Reader role, plus Security Reader if they review Defender findings, at the required scope through PIM with a two-week expiry. Require MFA through Conditional Access for guests. Avoid sharing accounts. After the audit, an access review or expiry removes access automatically, with all activity logged.
27
A developer's service principal secret was committed to a public GitHub repo. What do you do?
Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.
28
What are soft delete, versioning and immutable storage for blobs?
Soft delete keeps deleted blobs or containers for a retention period so you can restore them. Versioning saves the previous version automatically each time a blob is overwritten. Immutable storage applies time-based retention or legal hold policies in WORM mode, so nobody, not even an admin, can delete or change data until it expires. Regulated firms use immutability for audit records and ransomware protection.
29
An application on a VM must access a storage account without any keys. How do you set it up?
Enable a system-assigned or user-assigned managed identity on the VM. Assign the identity the least role needed, such as Storage Blob Data Reader on the specific container. In code, use DefaultAzureCredential or ManagedIdentityCredential from the Azure SDK. Then disable shared key access on the account. The token is fetched from the local metadata endpoint and rotated automatically by Azure.
30
Store and read a secret from Key Vault using Azure CLI.
Create an RBAC-enabled vault, grant yourself Key Vault Secrets Officer, then set and read the secret:
az keyvault create -g rg-sec -n kv-shop-prod \
--location centralindia --enable-rbac-authorization true
az keyvault secret set --vault-name kv-shop-prod \
--name SqlPassword --value 'S3cure#Pass'
az keyvault secret show --vault-name kv-shop-prod \
--name SqlPassword --query value -o tsv
Managed disks are block storage volumes for VMs that Azure manages as resources, with built-in redundancy. Types are Standard HDD for backups and dev, Standard SSD for light workloads, Premium SSD for production, Premium SSD v2 with independently tunable IOPS and throughput, and Ultra Disk for very high IOPS and low latency such as SAP HANA. Disks can be LRS or ZRS for some types.
PIM gives just-in-time, time-bound access to privileged Entra ID roles and Azure RBAC roles. Users are eligible, not permanently assigned, and must activate the role for a few hours with justification, MFA and optionally approval. Every activation is audited and access reviews remove stale eligibility. It reduces standing admin access, which is a key control against compromised accounts. It needs Entra ID P2 or governance licensing.
33
How do backups and point-in-time restore work in Azure SQL Database?
Azure takes full backups weekly, differential backups every 12 to 24 hours and log backups about every 10 minutes automatically. You can restore to any point within the short-term retention period of 1 to 35 days, default 7, as a new database. Long-term retention keeps weekly, monthly or yearly full backups for up to 10 years. Backup storage can be LRS, ZRS or geo-redundant.
Pick a property with high cardinality that spreads requests and storage evenly and that most queries filter on, such as userId or tenantId. Each logical partition is limited to 20 GB, so avoid keys like country or status that create hot partitions. If no single property works, use a synthetic key or hierarchical partition keys. The partition key cannot be changed later without migrating data.
35
What is Azure App Service and what does an App Service plan define?
App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.
36
Generate a user delegation SAS for one blob with Azure CLI.
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity:
az storage blob generate-sas \
--account-name stshopprod --container-name invoices \
--name inv-1001.pdf --permissions r \
--expiry 2026-11-12T18:00Z --https-only \
--auth-mode login --as-user --full-uri
The caller needs a role that allows generating user delegation keys.
Which companies hire Microsoft Azure professionals in Kochi?
Companies with large offices in Kochi include EY. Use their company pages below to practise employer-specific sets.
Are Microsoft Azure interviews in Kochi different from other cities?
The questions depend more on the company than the city. Kochi's mix of employers decides the style: Testing and data roles are common in its service and product teams
How do I find Microsoft Azure jobs in Kochi?
Shortlist companies with Kochi offices, keep your CV focused on Microsoft Azure projects, apply on company career pages and job portals with the Kochi filter, and practise the questions on this page before each interview.