KPMG Microsoft Azure Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About KPMG hiring for Microsoft Azure roles
KPMG is one of the Big Four professional services networks, providing audit, tax and advisory services. KPMG in India and its global delivery centres support clients with technology consulting, data and analytics, risk advisory and cybersecurity. It hires in India for analysts and consultants in data analytics, governance and risk, IT audit, testing and ERP implementation.
For Microsoft Azure roles, this KPMG practice set focuses most on Azure Compute (7), Azure Storage (5), Identity and Security (5), Monitoring, Cost and Governance (5). It has 9 easy, 17 medium, 4 hard questions, so you can start easy and work up to the harder ones.
Company type
Consulting
Headquarters
Amstelveen, Netherlands
Main India offices
Gurugram, Bengaluru, Mumbai, Hyderabad, Pune
KPMG Microsoft Azure interview process
Online assessment or screening test
Technical interview
Managerial or case round
Partner or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for KPMGStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
ADLS Gen2 is a storage account with hierarchical namespace enabled, adding real directories, atomic renames and POSIX-style ACLs on top of Blob Storage. It is the storage layer for analytics engines such as Azure Databricks, Synapse and Microsoft Fabric. Directory operations become fast, which matters for Spark jobs. You keep Blob pricing and tiers but must plan ACLs and RBAC together.
02
A developer's service principal secret was committed to a public GitHub repo. What do you do?
Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
04
Tell me about a time you automated a manual process.
Situation: our team created test environments by hand, taking two days each. Task: make it self-service. Action: I wrote Bicep modules for the app, database and networking and a pipeline with parameters for environment name, plus an auto-delete tag cleaned up nightly by an Automation runbook. Result: environments took 20 minutes, and idle test cost dropped by about 30%.
Export a similar built-in role as JSON, keep only needed Actions and DataActions, set AssignableScopes and create it:
az role definition list --name 'Virtual Machine Contributor' > vm-op.json
# edit: Name 'VM Operator', Actions:
# Microsoft.Compute/virtualMachines/read
# Microsoft.Compute/virtualMachines/start/action
# Microsoft.Compute/virtualMachines/restart/action
# Microsoft.Compute/virtualMachines/deallocate/action
az role definition create --role-definition vm-op.json
06
What is the difference between an availability set and an availability zone?
An availability set spreads VMs across fault domains (separate racks, power and switches) and update domains (rebooted at different times) inside one datacenter, giving a 99.95% SLA. Availability zones place VMs in physically separate datacenters within a region, giving 99.99%. Zones protect against a full datacenter outage; availability sets only protect against rack and maintenance failures. New designs prefer zones where the region supports them.
07
Create a Linux VM with Azure CLI using SSH keys and no public IP.
Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion:
az vm create \
--resource-group rg-app-dev \
--name vm-api-01 \
--image Ubuntu2204 \
--size Standard_D2s_v5 \
--vnet-name vnet-dev --subnet snet-app \
--public-ip-address '' \
--admin-username azureuser \
--generate-ssh-keys \
--zone 1
08
Explain the storage redundancy options LRS, ZRS, GRS and GZRS.
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
Slots are live copies of an app with their own hostname, available from the Standard tier. You deploy to a staging slot, warm it up and test, then swap it with production. The swap redirects traffic with near-zero downtime and can be reversed by swapping back. Slot-specific settings, such as a staging database connection string, stay with the slot instead of moving during the swap.
Azure Backup protects data by taking scheduled backups of VMs, SQL and SAP HANA in VMs, Azure Files, blobs, disks and on-premises servers into Recovery Services or Backup vaults, with retention policies, soft delete and immutability. Azure Site Recovery replicates whole VMs continuously to another region or from on-premises to Azure for disaster recovery, with recovery plans for orchestrated failover. Backup is for restoring data; Site Recovery is for business continuity.
Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.
12
Tell me about a time you pushed back on a request that broke security rules.
Situation: a project manager asked me to give a vendor Owner access to production to speed up a fix. Task: unblock the vendor without breaking policy. Action: I explained the risk, then created a time-bound PIM eligible Contributor role on just one resource group with approval, and paired with the vendor during the change. Result: the fix shipped the same day and the audit had no findings.
Managed disks are block storage volumes for VMs that Azure manages as resources, with built-in redundancy. Types are Standard HDD for backups and dev, Standard SSD for light workloads, Premium SSD for production, Premium SSD v2 with independently tunable IOPS and throughput, and Ultra Disk for very high IOPS and low latency such as SAP HANA. Disks can be LRS or ZRS for some types.
14
Write a KQL query to find VMs with average CPU above 80% in the last hour.
Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights:
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == 'Processor' and CounterName == '% Processor Time'
| where InstanceName == '_Total'
| summarize avgCpu = avg(CounterValue) by Computer
| where avgCpu > 80
| order by avgCpu desc
15
How do you enable diagnostic settings at scale for all resources?
Use Azure Policy with deployIfNotExists definitions, such as the built-in initiatives for enabling resource logs to a Log Analytics workspace by category group. Assign them at the management group, create a remediation task for existing resources and let new resources be configured automatically. This avoids teams forgetting to enable logs, which is common when resources are created outside the pipeline.
16
Tell me about a time you led a migration of workloads to Azure.
Situation: our company had to exit a leased datacenter in nine months with 120 VMs. Task: lead the compute migration. Action: I ran Azure Migrate assessments, grouped VMs by dependency into waves, rehosted most with Azure Migrate and moved web apps to App Service, with rollback plans for each wave. Result: we finished a month early and cut monthly run cost by about 25% after right-sizing.
17
Users report the website on App Service is slow every morning at 9 AM. How do you investigate?
Check Application Insights for response times, failed requests and dependency calls around 9 AM, and App Service plan metrics for CPU, memory and instance count. A morning spike often means traffic surge with autoscale reacting too slowly, cold start after idle, or a slow SQL query under load. Fixes include scheduled scale-out before 9 AM, Always On, a higher tier, caching with Redis or query tuning.
Series are optimised for workload type: B for burstable low-cost, D for general purpose, E for memory heavy like SQL Server, F for compute intensive, L for storage throughput, N for GPU and M for very large memory such as SAP HANA. Start from CPU, memory, disk IOPS and network needs, test with real load, then right-size using Azure Advisor recommendations after a few weeks of metrics.
19
Write a lifecycle management rule to tier and delete log blobs.
Confirm the app has regional VNet integration into a subnet that can reach the private endpoint subnet. Check DNS first: from the Kudu console, nslookup the SQL server name; it must resolve to the private IP through privatelink.database.windows.net linked to the VNet. Then check NSGs, UDRs sending traffic to a firewall that blocks port 1433, and whether SQL public access is disabled as expected.
21
How do you prioritise when several alerts fire at the same time?
Situation: during a release night, CPU, disk and payment error alerts fired together. Task: decide what to handle first. Action: I ranked by customer impact, so payment failures came first, checked Service Health for a platform issue, assigned disk and CPU checks to a teammate and kept a running update in the incident channel. Result: payments recovered quickly and we tuned the noisy CPU alerts afterwards.
22
How would you reduce the cost of many idle dev and test databases?
Move them to serverless General Purpose with auto-pause, or into an elastic pool if they are always on but lightly used. Use Azure Hybrid Benefit if you own SQL licences, use the Azure Dev/Test pricing offer for non-production subscriptions, delete databases nobody has connected to in months, and use smaller backup retention and LRS backup storage for non-production.
23
Partners need to allowlist a fixed outbound IP from your AKS cluster. How do you do it?
Configure the cluster's outbound type as a managed or user-assigned NAT Gateway with a static public IP, or route egress through Azure Firewall using userDefinedRouting so all traffic leaves from the firewall's public IP. Share that IP with partners. NAT Gateway is simpler and gives many SNAT ports, while Azure Firewall adds FQDN filtering and logging for compliance.
24
What compute options does Azure offer and when do you choose each?
Virtual Machines give full OS control for legacy or custom software. Virtual Machine Scale Sets add autoscaling of identical VMs. App Service hosts web apps and APIs as PaaS. Azure Functions runs event-driven code serverlessly. AKS runs Kubernetes for container microservices, and Container Apps runs containers without managing Kubernetes. Batch handles large parallel jobs. Choose based on control needed, scaling pattern and team skills.
25
Create a route table that sends internet traffic to Azure Firewall.
Add a default route with next hop Virtual appliance pointing to the firewall private IP, then attach it to the spoke subnet:
az network route-table create -g rg-net -n rt-spoke1
az network route-table route create -g rg-net \
--route-table-name rt-spoke1 -n default-to-fw \
--address-prefix 0.0.0.0/0 \
--next-hop-type VirtualAppliance --next-hop-ip-address 10.0.1.4
az network vnet subnet update -g rg-net --vnet-name vnet-spoke1 \
-n snet-app --route-table rt-spoke1
Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.
A lifecycle policy is a rule set on a storage account that automatically moves or deletes blobs based on age, last access or last modified time. For example, move logs to Cool after 30 days, to Archive after 90 days and delete after 365 days. It runs once a day and removes the need for custom cleanup scripts, which saves real money on large log or backup containers.
28
Finance wants each team to pay for its own Azure usage. How do you implement this?
Make tags like costcenter and team mandatory through Azure Policy with deny for new resources and modify to inherit from resource groups. Prefer separate subscriptions per team where possible, since subscription boundaries are the cleanest cost split. Use Cost Management views and scheduled exports grouped by tag and subscription into Power BI. Share untaggable costs like shared networking with an agreed split.
29
You run a SaaS app with 300 small tenant databases whose usage peaks at different times. How do you host them cost-effectively?
An elastic pool shares a set of resources, in eDTUs or vCores, among many Azure SQL databases on one logical server. It suits SaaS apps with a database per tenant, where individual usage peaks at different times. Instead of sizing each database for its peak, you size the pool for combined usage and set per-database min and max limits. Too many busy databases at once will contend for resources.
30
Store and read a secret from Key Vault using Azure CLI.
Create an RBAC-enabled vault, grant yourself Key Vault Secrets Officer, then set and read the secret:
az keyvault create -g rg-sec -n kv-shop-prod \
--location centralindia --enable-rbac-authorization true
az keyvault secret set --vault-name kv-shop-prod \
--name SqlPassword --value 'S3cure#Pass'
az keyvault secret show --vault-name kv-shop-prod \
--name SqlPassword --query value -o tsv
Tips to crack the KPMG Microsoft Azure interview
Learn basics of IT audit, internal controls and risk frameworks, since advisory roles often combine data with governance work.
Practise structured answers for guesstimates and business problems, explaining assumptions clearly step by step.
Prepare examples of working with stakeholders and meeting deadlines, which are common themes in Big Four interviews.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; KPMG interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the KPMG Microsoft Azure interview?
Candidates usually go through 4 stages: Online assessment or screening test; Technical interview; Managerial or case round; Partner or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the KPMG Microsoft Azure interview?
This practice set leans on Azure Compute (7), Azure Storage (5), Identity and Security (5), Monitoring, Cost and Governance (5). Revise those first, then practise explaining one or two of your own projects end to end, because most KPMG interviewers ask you to walk through real work.
Are these the exact questions asked at KPMG?
No. These are curated practice questions that match the skills and difficulty usually tested in consulting interviews like KPMG's. They are not a leaked or verified list of past questions.
Where does KPMG hire Microsoft Azure professionals in India?
KPMG has large teams in Gurugram, Bengaluru, Mumbai, Hyderabad, Pune. Openings and locations change often, so check the KPMG careers page and filter by city and experience.