36 practice questions with answers for Microsoft Azure interviews in Lucknow.
Microsoft Azure jobs in Lucknow
Lucknow's tech job market is smaller but growing, led by IT-services delivery centres, government-tech projects and start-ups. Many Lucknow candidates target Noida and Gurgaon roles or remote jobs, so interviews follow the NCR pattern.
Below are 36 questions that match the mix of service, product and domain employers hiring azure cloud support associates in Lucknow.
Solved for LucknowStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Export a similar built-in role as JSON, keep only needed Actions and DataActions, set AssignableScopes and create it:
az role definition list --name 'Virtual Machine Contributor' > vm-op.json
# edit: Name 'VM Operator', Actions:
# Microsoft.Compute/virtualMachines/read
# Microsoft.Compute/virtualMachines/start/action
# Microsoft.Compute/virtualMachines/restart/action
# Microsoft.Compute/virtualMachines/deallocate/action
az role definition create --role-definition vm-op.json
02
Finance wants each team to pay for its own Azure usage. How do you implement this?
Make tags like costcenter and team mandatory through Azure Policy with deny for new resources and modify to inherit from resource groups. Prefer separate subscriptions per team where possible, since subscription boundaries are the cleanest cost split. Use Cost Management views and scheduled exports grouped by tag and subscription into Power BI. Share untaggable costs like shared networking with an agreed split.
03
Your company is choosing between Bicep and Terraform for its Azure estate. What would you recommend?
Bicep is Azure-only, needs no state file, supports new resource features immediately and has native what-if previews. Terraform works across many clouds and SaaS providers, has a huge module ecosystem, and keeps a state file that must be stored securely, for example in a Blob Storage backend with locking. Choose Bicep for Azure-only teams and Terraform for multi-cloud or existing Terraform skills.
04
How do you find and fix slow queries in Azure SQL Database?
Open Query Performance Insight or Query Store to find the top queries by CPU, duration and IO. Check execution plans for scans, missing indexes and parameter sniffing. Review automatic tuning recommendations to create indexes or force the last good plan. Query DMVs like sys.dm_exec_query_stats and sys.dm_db_resource_stats. If resources are maxed after tuning, scale up or add read replicas.
05
How do you plan IP address space for VNets in an enterprise?
Allocate from a central IP plan that does not overlap with on-premises, other clouds or future acquisitions, because overlapping ranges cannot be peered or routed. Give each region a large block, for example 10.10.0.0/14, then carve /22 or /24 spokes. Size subnets for growth and remember AKS, App Gateway and private endpoints consume many IPs. Document allocations in an IPAM tool such as Azure Virtual Network Manager IPAM.
06
What services does an Azure Storage account provide?
A general-purpose v2 storage account offers Blob Storage for objects, Azure Files for SMB and NFS file shares, Queue Storage for simple messaging and Table Storage for key-value NoSQL data. Data Lake Storage Gen2 is Blob Storage with hierarchical namespace enabled for analytics. Each account has a globally unique name that forms endpoints like name.blob.core.windows.net, and settings such as redundancy and network rules apply account-wide.
07
Write a KQL query to find VMs with average CPU above 80% in the last hour.
Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights:
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == 'Processor' and CounterName == '% Processor Time'
| where InstanceName == '_Total'
| summarize avgCpu = avg(CounterValue) by Computer
| where avgCpu > 80
| order by avgCpu desc
08
Write a Resource Graph query to list unattached managed disks.
Unattached disks keep billing, so this is a common cost check:
Resources
| where type =~ 'microsoft.compute/disks'
| where properties.diskState =~ 'Unattached'
| project name, resourceGroup, subscriptionId,
sku = sku.name, sizeGb = properties.diskSizeGB
Run it with az graph query -q or in the Resource Graph Explorer.
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
Metric alerts evaluate metrics such as CPU above 80% and can be dynamic with machine-learned thresholds. Log search alerts run KQL queries on a schedule. Activity log alerts fire on control-plane events or Service Health incidents. Smart detection in Application Insights finds anomalies. Alerts trigger action groups that send emails, SMS, Teams messages, webhooks or run Functions, Logic Apps and Automation runbooks.
11
Your Azure Function has slow first responses after idle periods. What can you do?
That is cold start: the plan scaled to zero and must load a new instance. Options are moving to Flex Consumption with always-ready instances or the Premium plan with pre-warmed instances, reducing package size and dependencies, and choosing a faster-starting runtime. A timer ping is a hack that is not reliable. For strict latency APIs, a dedicated plan or Container Apps with minimum replicas is better.
A NAT Gateway provides outbound internet connectivity for a subnet using one or more static public IPs. It gives a large pool of SNAT ports, avoiding the port exhaustion common with default outbound or Load Balancer outbound rules, and gives a fixed IP that partners can allowlist. Since default outbound access is being retired for new VNets, explicit outbound methods like NAT Gateway are recommended.
Azure Resource Graph is a fast query service over resource metadata across all subscriptions you can access, using KQL. It is used for inventory, compliance checks and finding orphaned resources, such as unattached disks or public IPs, much faster than looping through APIs. The portal's All resources view and Azure Policy compliance use it. Results reflect configuration, not performance metrics.
14
Write a lifecycle management rule to tier and delete log blobs.
Move them to serverless General Purpose with auto-pause, or into an elastic pool if they are always on but lightly used. Use Azure Hybrid Benefit if you own SQL licences, use the Azure Dev/Test pricing offer for non-production subscriptions, delete databases nobody has connected to in months, and use smaller backup retention and LRS backup storage for non-production.
16
Explain DTU and vCore purchasing models in Azure SQL Database.
DTU bundles CPU, memory and IO into fixed Basic, Standard and Premium sizes and is simple for small apps. The vCore model lets you choose compute and storage separately, with General Purpose, Business Critical and Hyperscale tiers, provisioned or serverless compute, and Azure Hybrid Benefit for existing SQL licences. vCore is recommended for most production workloads because it is transparent and easier to compare with on-premises.
17
An order system needs reliable, ordered messaging between services. Would you pick Queue Storage or Service Bus, and why?
Queue Storage is cheap and simple, holds millions of messages up to 64 KB each, and suits basic background work. Service Bus is an enterprise broker with queues and topics, FIFO through sessions, duplicate detection, dead-lettering, transactions and messages up to 100 MB on Premium. Choose Service Bus for ordered or business-critical messaging like orders and payments, and Storage queues for simple, high-volume job queues.
18
Design a disaster recovery plan for a VM-based application in Central India.
Agree RPO and RTO with the business. Replicate VMs to South India with Azure Site Recovery, configure recovery plans that start the database first, then app and web tiers, and pre-create the network. Use Traffic Manager or Front Door for DNS failover. Back up data separately with Azure Backup in case of corruption. Run test failovers into an isolated VNet every quarter.
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
20
What is Microsoft Azure and which service models does it offer?
Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.
21
Tell me about a time you set up monitoring that caught a problem early.
Situation: our order service had silent failures that customers reported hours later. Task: detect them first. Action: I added Application Insights availability tests and a log alert on failed dependency calls to the payment gateway, routed to Teams and on-call. Result: two weeks later the alert caught an expired partner certificate within five minutes, and we fixed it before most users noticed.
22
Tell me about a time you pushed back on a request that broke security rules.
Situation: a project manager asked me to give a vendor Owner access to production to speed up a fix. Task: unblock the vendor without breaking policy. Action: I explained the risk, then created a time-bound PIM eligible Contributor role on just one resource group with approval, and paired with the vendor during the change. Result: the fix shipped the same day and the audit had no findings.
23
A team accidentally deleted a production resource group. How do you prevent this in future?
First recover what is possible: soft delete or backups for storage, Key Vault, SQL and VMs. Then add CanNotDelete locks on production groups, remove Owner and Contributor rights from individual users, and grant access through Entra groups with Privileged Identity Management for just-in-time elevation. Deploy infrastructure through pipelines only, and set activity log alerts on delete operations so the team is notified instantly.
24
How do you reference Key Vault secrets in App Service app settings?
Enable a managed identity on the app, grant it Key Vault Secrets User on the vault, then set the app setting value to a Key Vault reference: @Microsoft.KeyVault(SecretUri=https://kv-shop-prod.vault.azure.net/secrets/SqlPassword/). The app reads it as a normal environment variable. Omitting the version makes App Service pick up rotated secrets automatically within about a day, or on restart.
25
Write a Cosmos DB NoSQL query to get a customer's orders above 5000 rupees.
Filter on the partition key so the query hits one partition and stays cheap:
SELECT c.id, c.orderDate, c.total
FROM c
WHERE c.customerId = @customerId
AND c.total > 5000
ORDER BY c.orderDate DESC
ORDER BY on orderDate needs a range index, which the default indexing policy includes. Check the RU charge in the response headers.
26
What is Azure Files and when would you use Azure File Sync?
Azure Files provides fully managed SMB and NFS shares that VMs and on-premises machines can mount, useful for lift-and-shift of apps expecting a file server. Azure File Sync installs an agent on Windows Servers to sync shares to Azure Files and use cloud tiering, keeping hot files locally and old files in the cloud. It helps branch offices share data without large local storage.
Microsoft runs Central India (Pune), South India (Chennai) and West India (Mumbai) as public regions, plus Jio India West and Jio India Central for specific customers. Central India supports availability zones. Indian companies pick these regions for low latency and for data residency needs such as RBI guidelines on payment data, often pairing Central India with South India for disaster recovery.
28
What is a Shared Access Signature (SAS) and what types exist?
A SAS is a signed URL token granting limited access to storage for a set time and permissions, such as read-only for one blob for one hour. A user delegation SAS is signed with Entra ID credentials and is the most secure. A service SAS and an account SAS are signed with the account key. Always use HTTPS, short expiry and stored access policies so tokens can be revoked.
29
Create an Azure SQL Database with Entra-only authentication using Azure CLI.
Create the logical server with an Entra admin group and no SQL logins, then the database:
az sql server create -g rg-data -n sql-shop-prod -l centralindia \
--enable-ad-only-auth \
--external-admin-principal-type Group \
--external-admin-name grp-sql-admins \
--external-admin-sid <group-object-id>
az sql db create -g rg-data -s sql-shop-prod -n shopdb \
--edition GeneralPurpose --family Gen5 --capacity 2 \
--zone-redundant true --backup-storage-redundancy Zone
30
What is the difference between a service endpoint and a private endpoint?
A service endpoint extends the VNet identity to a PaaS service so its firewall can allow your subnet, but the service still uses its public IP. A private endpoint puts a private IP from your subnet on a specific resource instance, so traffic never needs the public endpoint and works from peered networks and on-premises. Private endpoints are preferred for strict security but need private DNS setup.
31
Describe a production incident you handled and what you learned.
Situation: an App Service API began returning 502 errors during peak hours. Task: restore service and find the root cause. Action: I scaled out to stop impact, then found in Application Insights that outbound SQL connections were exhausting SNAT ports. I added connection pooling and VNet integration with a NAT gateway. Result: errors stopped, and I wrote a postmortem and added a SNAT alert.
32
How do you build and push a container image to ACR without Docker installed?
Use ACR Tasks to build in the cloud from your source folder:
az acr build --registry acrshopprod \
--image shop-api:$(git rev-parse --short HEAD) .
ACR Tasks can also rebuild automatically on a Git commit or when the base image is updated, which helps patch OS vulnerabilities without manual work.
33
What are soft delete, versioning and immutable storage for blobs?
Soft delete keeps deleted blobs or containers for a retention period so you can restore them. Versioning saves the previous version automatically each time a blob is overwritten. Immutable storage applies time-based retention or legal hold policies in WORM mode, so nobody, not even an admin, can delete or change data until it expires. Regulated firms use immutability for audit records and ransomware protection.
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
35
What is the difference between Entra ID roles and Azure RBAC roles?
Entra ID roles, such as Global Administrator or User Administrator, control the directory: users, groups, app registrations and tenant settings. Azure RBAC roles, such as Owner, Contributor and Reader, control Azure resources at management group, subscription, resource group or resource scope. A Global Administrator has no resource access by default, though they can elevate themselves to User Access Administrator at root scope.
36
What is the difference between an availability set and an availability zone?
An availability set spreads VMs across fault domains (separate racks, power and switches) and update domains (rebooted at different times) inside one datacenter, giving a 99.95% SLA. Availability zones place VMs in physically separate datacenters within a region, giving 99.99%. Zones protect against a full datacenter outage; availability sets only protect against rack and maintenance failures. New designs prefer zones where the region supports them.
Which companies hire Microsoft Azure professionals in Lucknow?
Companies with large offices in Lucknow include HCLTech. Use their company pages below to practise employer-specific sets.
Are Microsoft Azure interviews in Lucknow different from other cities?
The questions depend more on the company than the city. Lucknow's mix of employers decides the style: Many Lucknow candidates target Noida and Gurgaon roles or remote jobs, so interviews follow the NCR pattern
How do I find Microsoft Azure jobs in Lucknow?
Shortlist companies with Lucknow offices, keep your CV focused on Microsoft Azure projects, apply on company career pages and job portals with the Lucknow filter, and practise the questions on this page before each interview.