Microsoft Azure Interview Questions in Noida

Configure the azurerm backend and provider, then resources: terraform { backend "azurerm" { resource_group_name = "rg-tfstate" storage_account_name = "sttfstateprod" container_name = "state" key = "network.tfstate" use_azuread_auth = true } } provider "azurerm" { features {} } resource "azurerm_resource_group" "net" { name = "rg-net-prod" location = "centralindia" } resource "azurerm_virtual_network" "hub" { name = "vnet-hub" location = azurerm_resource_group.net.location resource_group_name = azurerm_resource_group.net.name address_space = ["10.0.0.0/16"] }

Define the rule with an allowed list and a deny effect, then assign it at a management group: resource pol 'Microsoft.Authorization/policyDefinitions@2023-04-01' = { name: 'allowed-india-regions' properties: { policyType: 'Custom' mode: 'Indexed' policyRule: { if: { field: 'location' notIn: ['centralindia', 'southindia', 'westindia'] } then: { effect: 'deny' } } } }

Unattached disks keep billing, so this is a common cost check: Resources | where type =~ 'microsoft.compute/disks' | where properties.diskState =~ 'Unattached' | project name, resourceGroup, subscriptionId, sku = sku.name, sizeGb = properties.diskSizeGB Run it with az graph query -q or in the Resource Graph Explorer.

Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles: CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [app-shop-prod]; ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod]; Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.

Use ACR Tasks to build in the cloud from your source folder: az acr build --registry acrshopprod \ --image shop-api:$(git rev-parse --short HEAD) . ACR Tasks can also rebuild automatically on a Git commit or when the base image is updated, which helps patch OS vulnerabilities without manual work.

Export a similar built-in role as JSON, keep only needed Actions and DataActions, set AssignableScopes and create it: az role definition list --name 'Virtual Machine Contributor' > vm-op.json # edit: Name 'VM Operator', Actions: # Microsoft.Compute/virtualMachines/read # Microsoft.Compute/virtualMachines/start/action # Microsoft.Compute/virtualMachines/restart/action # Microsoft.Compute/virtualMachines/deallocate/action az role definition create --role-definition vm-op.json

Grant id-token write permission and use a federated credential on the app registration, so no secret is stored: permissions: id-token: write contents: read jobs: deploy: runs-on: ubuntu-latest environment: prod steps: - uses: actions/checkout@v4 - uses: azure/login@v2 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - run: az group list -o table

Peering must be created from each side. Allow forwarded traffic if a hub firewall routes it: az network vnet peering create -g rg-net -n hub-to-spoke1 \ --vnet-name vnet-hub --remote-vnet vnet-spoke1 \ --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit az network vnet peering create -g rg-net -n spoke1-to-hub \ --vnet-name vnet-spoke1 --remote-vnet vnet-hub \ --allow-vnet-access --allow-forwarded-traffic --use-remote-gateways

Filter Get-AzVM output on the Tags hashtable and export the result for review: Connect-AzAccount Get-AzVM | Where-Object { -not $_.Tags -or -not $_.Tags.ContainsKey('env') } | Select-Object Name, ResourceGroupName, Location | Export-Csv untagged-vms.csv -NoTypeInformation For large estates, Azure Resource Graph queries are faster across many subscriptions.

Look up the group object ID, then create the role assignment with the narrowest scope: GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv) az role assignment create \ --assignee-object-id $GROUP_ID \ --assignee-principal-type Group \ --role Contributor \ --scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev Assigning to groups instead of users keeps access easy to audit.

Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights: Perf | where TimeGenerated > ago(1h) | where ObjectName == 'Processor' and CounterName == '% Processor Time' | where InstanceName == '_Total' | summarize avgCpu = avg(CounterValue) by Computer | where avgCpu > 80 | order by avgCpu desc

Query the requests table, summarise duration and sort: requests | where timestamp > ago(1d) | summarize count(), avgDuration = avg(duration), p95 = percentile(duration, 95) by name | top 10 by p95 desc In a workspace-based resource, the table is AppRequests with TimeGenerated and DurationMs columns instead.