Mphasis Microsoft Azure Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Mphasis hiring for Microsoft Azure roles
Mphasis is an Indian IT services company, majority-owned by Blackstone, providing cloud, application, testing, data and cognitive services. It has a strong presence in banking, financial services and insurance clients. In India it hires for software engineers, test engineers, data analysts and data engineers, often for BFSI-focused projects.
For Microsoft Azure roles, this Mphasis practice set focuses most on Identity and Security (7), Monitoring, Cost and Governance (6), Azure Fundamentals (5), Azure Storage (5). It has 12 easy, 16 medium, 2 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Bengaluru, India
Main India offices
Bengaluru, Pune, Chennai
Mphasis Microsoft Azure interview process
Online assessment (aptitude + reasoning)
Coding test
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for MphasisStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Your manager asks you to estimate the monthly cost of a new Azure application. How do you do it?
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
Defender for Cloud is a cloud security posture management and workload protection platform. The free foundational tier gives a secure score and recommendations based on the Microsoft cloud security benchmark. Paid Defender plans add threat detection for servers, storage, SQL, containers, Key Vault and App Service, vulnerability scanning and attack path analysis. It also covers AWS and GCP accounts and on-premises servers through Arc.
03
Explain the storage redundancy options LRS, ZRS, GRS and GZRS.
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
Disable shared key access where possible and use Entra ID with RBAC roles like Storage Blob Data Reader. Use managed identities for apps. Disable public blob access, require TLS 1.2, restrict the firewall to selected VNets, or use private endpoints and disable public network access. Enable soft delete, versioning and Defender for Storage, and keep keys, if any, in Key Vault with rotation.
05
What is Bicep and how does it relate to ARM templates?
Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.
PIM gives just-in-time, time-bound access to privileged Entra ID roles and Azure RBAC roles. Users are eligible, not permanently assigned, and must activate the role for a few hours with justification, MFA and optionally approval. Every activation is audited and access reviews remove stale eligibility. It reduces standing admin access, which is a key control against compromised accounts. It needs Entra ID P2 or governance licensing.
07
What deployment strategies can you use for Azure apps?
Rolling updates replace instances in batches, used by VMSS and Kubernetes. Blue-green runs two environments and switches traffic, as with App Service slots. Canary sends a small percentage of traffic to the new version first, using slot traffic routing, Front Door weights or Container Apps revisions. Feature flags in App Configuration let you deploy code dark and enable features gradually without redeploying.
08
What is the difference between the activity log and resource logs?
The activity log records control-plane operations at subscription level, such as who created, updated or deleted a resource, and service health events. It is kept for 90 days unless exported. Resource logs record data-plane activity inside a resource, such as Key Vault secret reads or SQL audit events, and must be enabled with diagnostic settings to send them to Log Analytics, Storage or Event Hubs.
09
How do you document and hand over a network design to the operations team?
Situation: I designed a hub-spoke network that a separate operations team would run. Task: make sure they could support it without calling me. Action: I wrote a short design note with diagrams, IP plan, routing and firewall rule ownership, kept everything in Bicep, and ran two walkthrough sessions with troubleshooting exercises using Network Watcher. Result: they handled the first three incidents independently.
10
What are RPO and RTO and how do they guide Azure designs?
RPO, recovery point objective, is the maximum acceptable data loss measured in time. RTO, recovery time objective, is how long recovery may take. A daily backup gives an RPO of up to 24 hours. Site Recovery gives an RPO of seconds to minutes and an RTO of minutes to hours. SQL failover groups give an RPO of seconds. Lower RPO and RTO cost more, so agree targets per application.
11
Describe a time you had to choose between speed of delivery and data safety.
Situation: a release deadline pushed us to skip enabling backups and soft delete on a new storage account. Task: deliver on time without risking customer files. Action: I explained to the lead that enabling soft delete, versioning and a backup policy took under an hour through our Bicep module, and added it to the same pull request. Result: we shipped on time, and a month later versioning saved a file a user overwrote.
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
Azure Resource Graph is a fast query service over resource metadata across all subscriptions you can access, using KQL. It is used for inventory, compliance checks and finding orphaned resources, such as unattached disks or public IPs, much faster than looping through APIs. The portal's All resources view and Azure Policy compliance use it. Results reflect configuration, not performance metrics.
14
How do you create a budget with alerts for a subscription?
In Cost Management, choose Budgets, set the scope to the subscription or a resource group, a monthly amount and alert conditions such as 50%, 80% and 100% of actual cost and 100% of forecast. Add email recipients and an action group that can notify Teams or run an automation. Budgets do not stop spending on their own, so pair them with automation or policy if needed.
15
How would you protect storage accounts against ransomware?
Combine prevention and recovery. Use private endpoints, disable shared keys and public access, and restrict RBAC with PIM. Enable soft delete, versioning, change feed and point-in-time restore. For critical data, use immutable storage policies or vaulted Azure Backup with immutability and multi-user authorization so attackers cannot delete backups. Turn on Defender for Storage to detect malware uploads and unusual access.
Cost Management analyses and controls Azure spending. Cost analysis shows cost by service, resource group, tag or meter with forecasts. Budgets send alerts at thresholds such as 80% and 100% of actual or forecast spend and can trigger automation. Exports send daily cost data to Storage for reporting in Power BI. It also shows reservation utilisation and supports FinOps practices like showback and chargeback to teams.
Sentinel is Microsoft's cloud-native SIEM and SOAR built on Log Analytics. It ingests logs through connectors from Entra ID, Defender, Azure activity, firewalls and third-party sources, runs analytics rules written in KQL to raise incidents, and uses playbooks built on Logic Apps to automate responses like disabling a user. Cost depends on data ingestion, so filter noisy logs and use basic or auxiliary log tiers.
18
Read a blob in Python using DefaultAzureCredential.
DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored:
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient
url = 'https://stshopprod.blob.core.windows.net'
client = BlobServiceClient(url, credential=DefaultAzureCredential())
blob = client.get_blob_client('invoices', '2026/inv-1001.pdf')
data = blob.download_blob().readall()
print(len(data))
19
How do you prioritise when several alerts fire at the same time?
Situation: during a release night, CPU, disk and payment error alerts fired together. Task: decide what to handle first. Action: I ranked by customer impact, so payment failures came first, checked Service Health for a platform issue, assigned disk and CPU checks to a teammate and kept a running update in the incident channel. Result: payments recovered quickly and we tuned the noisy CPU alerts afterwards.
20
A developer's service principal secret was committed to a public GitHub repo. What do you do?
Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.
21
Your VMs run 24x7, but their sizes and regions change every few months. Would you buy reservations or a savings plan?
Reservations give a big discount, up to about 72% versus pay-as-you-go, when you commit to a specific VM family, region and term of one or three years. Savings plans commit to a fixed hourly spend for one or three years and apply flexibly across VM sizes, regions, App Service and Functions Premium. Use reservations for very stable workloads and savings plans when your sizes or regions change.
22
Explain the built-in roles Owner, Contributor, Reader and User Access Administrator.
Owner has full access to resources and can assign roles to others. Contributor can create and manage all resources but cannot grant access or manage role assignments. Reader can only view resources. User Access Administrator can manage role assignments but not resources. Follow least privilege: most engineers need Contributor on their own resource groups and Reader elsewhere, with Owner held by very few people.
23
How do you give an external auditor read-only access to your Azure environment for two weeks?
Invite the auditor as a B2B guest user in Entra ID, add them to a group, and assign the Reader role, plus Security Reader if they review Defender findings, at the required scope through PIM with a two-week expiry. Require MFA through Conditional Access for guests. Avoid sharing accounts. After the audit, an access review or expiry removes access automatically, with all activity logged.
24
What compute options does Azure offer and when do you choose each?
Virtual Machines give full OS control for legacy or custom software. Virtual Machine Scale Sets add autoscaling of identical VMs. App Service hosts web apps and APIs as PaaS. Azure Functions runs event-driven code serverlessly. AKS runs Kubernetes for container microservices, and Container Apps runs containers without managing Kubernetes. Batch handles large parallel jobs. Choose based on control needed, scaling pattern and team skills.
25
What is Microsoft Azure and which service models does it offer?
Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.
26
How do Azure SLAs work and how do you calculate a composite SLA?
An SLA is Microsoft's uptime commitment per service, with service credits if it is missed. When services depend on each other in series, multiply their SLAs. An App Service at 99.95% calling Azure SQL at 99.99% gives about 0.9995 x 0.9999 = 99.94%. Adding redundancy, such as a second region behind Front Door, raises the combined figure because both paths must fail together.
27
What is the difference between CapEx and OpEx, and how does Azure change it?
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
28
What is Azure Cosmos DB and which APIs does it support?
Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.
29
How would you reduce the cost of many idle dev and test databases?
Move them to serverless General Purpose with auto-pause, or into an elastic pool if they are always on but lightly used. Use Azure Hybrid Benefit if you own SQL licences, use the Azure Dev/Test pricing offer for non-production subscriptions, delete databases nobody has connected to in months, and use smaller backup retention and LRS backup storage for non-production.
30
A deployment to production failed halfway. How do you design pipelines to handle this?
Make deployments idempotent so rerunning the same template converges to the right state. Use slot swaps or blue-green so the old version keeps serving until the new one passes health checks, and roll back by swapping back. Keep database migrations backward compatible, using expand and contract, so the old code still works. Add smoke tests and automatic rollback, and alert the team with logs.
Tips to crack the Mphasis Microsoft Azure interview
Learn BFSI basics such as banking transactions, insurance claims and mortgages, since many Mphasis clients are in this domain.
Revise testing concepts, SQL and one programming language well for technical interviews.
Read about Mphasis's Front2Back transformation approach, which the company uses to describe its service model.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Mphasis interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Mphasis Microsoft Azure interview?
Candidates usually go through 4 stages: Online assessment (aptitude + reasoning); Coding test; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Mphasis Microsoft Azure interview?
This practice set leans on Identity and Security (7), Monitoring, Cost and Governance (6), Azure Fundamentals (5), Azure Storage (5). Revise those first, then practise explaining one or two of your own projects end to end, because most Mphasis interviewers ask you to walk through real work.
Are these the exact questions asked at Mphasis?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like Mphasis's. They are not a leaked or verified list of past questions.
Where does Mphasis hire Microsoft Azure professionals in India?
Mphasis has large teams in Bengaluru, Pune, Chennai. Openings and locations change often, so check the Mphasis careers page and filter by city and experience.