LTIMindtree Microsoft Azure Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About LTIMindtree hiring for Microsoft Azure roles
LTIMindtree is an Indian IT services and consulting company formed by the merger of Larsen and Toubro Infotech and Mindtree, and part of the L&T Group. It provides cloud, data, ERP, testing and digital engineering services for global clients. It hires for software engineers, test engineers, data analysts, data engineers and ERP consultants.
For Microsoft Azure roles, this LTIMindtree practice set focuses most on Monitoring, Cost and Governance (7), Azure Networking (6), Azure Storage (4), DevOps and Infrastructure as Code (3). It has 12 easy, 16 medium, 2 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Mumbai, India
Main India offices
Mumbai, Pune, Bengaluru, Chennai, Hyderabad
LTIMindtree Microsoft Azure interview process
Online assessment (aptitude + reasoning)
Coding test
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for LTIMindtreeStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.
03
Assign a role to a group at resource group scope with Azure CLI.
Look up the group object ID, then create the role assignment with the narrowest scope:
GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv)
az role assignment create \
--assignee-object-id $GROUP_ID \
--assignee-principal-type Group \
--role Contributor \
--scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev
Assigning to groups instead of users keeps access easy to audit.
Application Insights is the APM feature of Azure Monitor. It collects requests, dependencies, exceptions, traces and custom events from apps through OpenTelemetry-based SDKs or auto-instrumentation in App Service, Functions and AKS. Features include the application map, live metrics, failure and performance analysis, availability tests and distributed tracing. Workspace-based resources store data in Log Analytics so you can join it with infrastructure logs.
05
What is Azure Cosmos DB and which APIs does it support?
Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.
06
How do you enable diagnostic settings at scale for all resources?
Use Azure Policy with deployIfNotExists definitions, such as the built-in initiatives for enabling resource logs to a Log Analytics workspace by category group. Assign them at the management group, create a remediation task for existing resources and let new resources be configured automatically. This avoids teams forgetting to enable logs, which is common when resources are created outside the pipeline.
Spot VMs use spare Azure capacity at discounts that can reach about 90%, but Azure can evict them with 30 seconds notice when it needs capacity or the price passes your limit. Use them for interruptible work such as batch rendering, CI build agents, test environments and big data jobs with checkpointing. Never use them for stateful production databases or anything that cannot tolerate sudden loss.
08
Write a Cosmos DB NoSQL query to get a customer's orders above 5000 rupees.
Filter on the partition key so the query hits one partition and stays cheap:
SELECT c.id, c.orderDate, c.total
FROM c
WHERE c.customerId = @customerId
AND c.total > 5000
ORDER BY c.orderDate DESC
ORDER BY on orderDate needs a range index, which the default indexing policy includes. Check the RU charge in the response headers.
Azure Resource Graph is a fast query service over resource metadata across all subscriptions you can access, using KQL. It is used for inventory, compliance checks and finding orphaned resources, such as unattached disks or public IPs, much faster than looping through APIs. The portal's All resources view and Azure Policy compliance use it. Results reflect configuration, not performance metrics.
10
What is Azure Firewall and how is it different from an NSG?
Azure Firewall is a managed, stateful, centralised firewall with network and application rules, FQDN filtering, threat intelligence and, in the Premium SKU, TLS inspection and IDPS. NSGs are distributed basic filters on subnets and NICs. Typically NSGs control traffic within and between subnets, while Azure Firewall in a hub controls internet egress and cross-spoke traffic with central logging.
Service Health shows the health of Azure services in your regions: service issues happening now, planned maintenance, health advisories and security advisories, plus retirement notices. Resource Health shows if a specific resource, such as a VM, is available and why not. Set activity log alerts on Service Health so the team gets notified for incidents affecting their subscriptions and regions, instead of finding out from users.
12
Explain stages, jobs, steps and environments in YAML pipelines.
A pipeline has stages, such as Build, Test and DeployProd, that run in sequence or parallel. Each stage has jobs, which run on one agent, and each job has steps, which are tasks or scripts. Deployment jobs target environments, which can have approvals, checks, business hours and deployment history. Templates let teams reuse stages and jobs across many repositories.
13
Explain the storage redundancy options LRS, ZRS, GRS and GZRS.
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
14
Your manager asks you to estimate the monthly cost of a new Azure application. How do you do it?
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
Pick a property with high cardinality that spreads requests and storage evenly and that most queries filter on, such as userId or tenantId. Each logical partition is limited to 20 GB, so avoid keys like country or status that create hot partitions. If no single property works, use a synthetic key or hierarchical partition keys. The partition key cannot be changed later without migrating data.
Azure Bastion is a managed PaaS service that gives RDP and SSH access to VMs through the browser or native client over TLS, without giving the VMs public IPs. It is deployed into a dedicated subnet named AzureBastionSubnet in the VNet. This removes exposed ports 3389 and 22 from the internet, a common attack path. Pair it with just-in-time access from Defender for Cloud for tighter control.
17
Compare Azure Load Balancer, Application Gateway, Front Door and Traffic Manager.
Load Balancer works at layer 4 (TCP/UDP) inside a region. Application Gateway is a regional layer 7 load balancer with path routing, TLS termination and an optional WAF. Front Door is a global layer 7 entry point with anycast, CDN caching and WAF. Traffic Manager is DNS-based global routing for any protocol. Use Front Door for global web apps and Load Balancer for non-HTTP traffic.
18
Generate a user delegation SAS for one blob with Azure CLI.
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity:
az storage blob generate-sas \
--account-name stshopprod --container-name invoices \
--name inv-1001.pdf --permissions r \
--expiry 2026-11-12T18:00Z --https-only \
--auth-mode login --as-user --full-uri
The caller needs a role that allows generating user delegation keys.
19
How do you document and hand over a network design to the operations team?
Situation: I designed a hub-spoke network that a separate operations team would run. Task: make sure they could support it without calling me. Action: I wrote a short design note with diagrams, IP plan, routing and firewall rule ownership, kept everything in Bicep, and ran two walkthrough sessions with troubleshooting exercises using Network Watcher. Result: they handled the first three incidents independently.
Disable shared key access where possible and use Entra ID with RBAC roles like Storage Blob Data Reader. Use managed identities for apps. Disable public blob access, require TLS 1.2, restrict the firewall to selected VNets, or use private endpoints and disable public network access. Enable soft delete, versioning and Defender for Storage, and keep keys, if any, in Key Vault with rotation.
ARM is the deployment and management layer of Azure. Every request from the portal, CLI, PowerShell, SDKs or Bicep goes through the ARM API, which authenticates the caller, checks RBAC and Policy, and forwards the call to the resource provider. Because all tools hit the same API, you get consistent results, tagging, locks and activity logs no matter how the change was made.
22
Write a KQL query to find who deleted resources in the last 7 days.
Use the AzureActivity table, filtering on successful delete operations:
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue endswith '/DELETE'
| where ActivityStatusValue == 'Success'
| project TimeGenerated, Caller, OperationNameValue,
ResourceGroup, _ResourceId
| order by TimeGenerated desc
23
Create a VNet with two subnets and an NSG rule using Azure CLI.
Azure Files provides fully managed SMB and NFS shares that VMs and on-premises machines can mount, useful for lift-and-shift of apps expecting a file server. Azure File Sync installs an agent on Windows Servers to sync shares to Azure Files and use cloud tiering, keeping hot files locally and old files in the cloud. It helps branch offices share data without large local storage.
An NSG is a stateful packet filter with allow and deny rules on source, destination, port and protocol, processed by priority from 100 to 4096, lower number first. It attaches to a subnet, a NIC or both, and both must allow the traffic. Default rules allow VNet-to-VNet and outbound internet traffic and deny other inbound traffic. Service tags and application security groups simplify rules.
Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.
27
What is the difference between an app registration and a service principal?
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.
29
Tell me about a time you fixed a networking issue under pressure.
Situation: after a firewall change, payment APIs in our spoke could not reach a partner endpoint. Task: restore traffic quickly. Action: I used Network Watcher next hop and firewall logs in Log Analytics, found the new rule collection had higher priority and denied the partner FQDN, and added an explicit allow. Result: service recovered in 25 minutes, and we added pipeline-based firewall rule reviews.
30
Store and read a secret from Key Vault using Azure CLI.
Create an RBAC-enabled vault, grant yourself Key Vault Secrets Officer, then set and read the secret:
az keyvault create -g rg-sec -n kv-shop-prod \
--location centralindia --enable-rbac-authorization true
az keyvault secret set --vault-name kv-shop-prod \
--name SqlPassword --value 'S3cure#Pass'
az keyvault secret show --vault-name kv-shop-prod \
--name SqlPassword --query value -o tsv
Tips to crack the LTIMindtree Microsoft Azure interview
Practise aptitude, logical reasoning and basic coding questions, as the online assessment is usually the first filter.
Revise SQL, OOP and testing fundamentals, plus any cloud or data tools you list on your resume.
Learn about the L&T Group background and the LTI and Mindtree merger to answer company-related questions.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; LTIMindtree interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the LTIMindtree Microsoft Azure interview?
Candidates usually go through 4 stages: Online assessment (aptitude + reasoning); Coding test; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the LTIMindtree Microsoft Azure interview?
This practice set leans on Monitoring, Cost and Governance (7), Azure Networking (6), Azure Storage (4), DevOps and Infrastructure as Code (3). Revise those first, then practise explaining one or two of your own projects end to end, because most LTIMindtree interviewers ask you to walk through real work.
Are these the exact questions asked at LTIMindtree?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like LTIMindtree's. They are not a leaked or verified list of past questions.
Where does LTIMindtree hire Microsoft Azure professionals in India?
LTIMindtree has large teams in Mumbai, Pune, Bengaluru, Chennai, Hyderabad. Openings and locations change often, so check the LTIMindtree careers page and filter by city and experience.