NTT DATA Microsoft Azure Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About NTT DATA hiring for Microsoft Azure roles
NTT DATA is a global IT services company and part of the NTT Group of Japan. It provides consulting, application services, cloud, infrastructure, data and testing services for clients in many industries. Its India delivery centres hire for software engineers, test engineers, data engineers, data analysts and infrastructure professionals.
For Microsoft Azure roles, this NTT DATA practice set focuses most on Azure Storage (6), Identity and Security (6), Azure Compute (5), Azure Databases (3). It has 15 easy, 14 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Tokyo, Japan
Main India offices
Bengaluru, Pune, Noida, Hyderabad, Chennai
NTT DATA Microsoft Azure interview process
Online assessment (aptitude + technical)
Technical interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for NTT DATAStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Write a Cosmos DB NoSQL query to get a customer's orders above 5000 rupees.
Filter on the partition key so the query hits one partition and stays cheap:
SELECT c.id, c.orderDate, c.total
FROM c
WHERE c.customerId = @customerId
AND c.total > 5000
ORDER BY c.orderDate DESC
ORDER BY on orderDate needs a range index, which the default indexing policy includes. Check the RU charge in the response headers.
02
What is Azure App Service and what does an App Service plan define?
App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.
03
What is the difference between CapEx and OpEx, and how does Azure change it?
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.
05
Explain the storage redundancy options LRS, ZRS, GRS and GZRS.
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
06
What is Microsoft Azure and which service models does it offer?
Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
Relational options are Azure SQL Database, Azure SQL Managed Instance, SQL Server on VMs, and Azure Database for PostgreSQL and MySQL flexible servers. Azure Cosmos DB is the globally distributed NoSQL and vector database. Azure Cache for Redis and Azure Managed Redis provide in-memory caching. For analytics there are Synapse, Fabric and Azure Data Explorer. Choose by data model, compatibility and how much operations you want to manage.
Managed disks are block storage volumes for VMs that Azure manages as resources, with built-in redundancy. Types are Standard HDD for backups and dev, Standard SSD for light workloads, Premium SSD for production, Premium SSD v2 with independently tunable IOPS and throughput, and Ultra Disk for very high IOPS and low latency such as SAP HANA. Disks can be LRS or ZRS for some types.
10
Assign a role to a group at resource group scope with Azure CLI.
Look up the group object ID, then create the role assignment with the narrowest scope:
GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv)
az role assignment create \
--assignee-object-id $GROUP_ID \
--assignee-principal-type Group \
--role Contributor \
--scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev
Assigning to groups instead of users keeps access easy to audit.
11
How do you explain a technical storage decision to a non-technical stakeholder?
Situation: finance asked why we needed GZRS instead of cheaper LRS. Task: justify the cost clearly. Action: I compared the options in business terms: LRS survives a disk failure, GZRS survives losing a whole region, and I showed the cost of downtime per hour for our app versus the extra monthly charge. Result: they approved GZRS only for critical data and LRS for the rest.
Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.
13
What is the difference between Entra ID roles and Azure RBAC roles?
Entra ID roles, such as Global Administrator or User Administrator, control the directory: users, groups, app registrations and tenant settings. Azure RBAC roles, such as Owner, Contributor and Reader, control Azure resources at management group, subscription, resource group or resource scope. A Global Administrator has no resource access by default, though they can elevate themselves to User Access Administrator at root scope.
14
What services does an Azure Storage account provide?
A general-purpose v2 storage account offers Blob Storage for objects, Azure Files for SMB and NFS file shares, Queue Storage for simple messaging and Table Storage for key-value NoSQL data. Data Lake Storage Gen2 is Blob Storage with hierarchical namespace enabled for analytics. Each account has a globally unique name that forms endpoints like name.blob.core.windows.net, and settings such as redundancy and network rules apply account-wide.
Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.
Azure Bastion is a managed PaaS service that gives RDP and SSH access to VMs through the browser or native client over TLS, without giving the VMs public IPs. It is deployed into a dedicated subnet named AzureBastionSubnet in the VNet. This removes exposed ports 3389 and 22 from the internet, a common attack path. Pair it with just-in-time access from Defender for Cloud for tighter control.
17
What is the what-if operation in Bicep deployments?
What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.
Disable shared key access where possible and use Entra ID with RBAC roles like Storage Blob Data Reader. Use managed identities for apps. Disable public blob access, require TLS 1.2, restrict the firewall to selected VNets, or use private endpoints and disable public network access. Enable soft delete, versioning and Defender for Storage, and keep keys, if any, in Key Vault with rotation.
19
Tell me about a time you automated a manual process.
Situation: our team created test environments by hand, taking two days each. Task: make it self-service. Action: I wrote Bicep modules for the app, database and networking and a pipeline with parameters for environment name, plus an auto-delete tag cleaned up nightly by an Automation runbook. Result: environments took 20 minutes, and idle test cost dropped by about 30%.
20
How does encryption at rest and in transit work in Azure?
All Azure Storage, managed disks and Azure SQL data is encrypted at rest with AES-256 by default using Microsoft-managed keys. You can switch to customer-managed keys in Key Vault for control over rotation and revocation, and use double encryption or confidential computing for stricter needs. In transit, services use TLS 1.2 or higher, and you should enforce HTTPS only and minimum TLS version settings.
21
How do you give an external auditor read-only access to your Azure environment for two weeks?
Invite the auditor as a B2B guest user in Entra ID, add them to a group, and assign the Reader role, plus Security Reader if they review Defender findings, at the required scope through PIM with a two-week expiry. Require MFA through Conditional Access for guests. Avoid sharing accounts. After the audit, an access review or expiry removes access automatically, with all activity logged.
22
What are Virtual Machine Scale Sets and their orchestration modes?
VMSS manages a group of load-balanced VMs that scale in or out automatically on metrics or schedules. Flexible orchestration, now the default, lets you mix VM sizes, spread across zones and fault domains, and manage instances like normal VMs. Uniform mode uses identical instances from one model and is optimised for large stateless fleets. Use VMSS for stateless web tiers, batch workers and custom container hosts.
23
What is Bicep and how does it relate to ARM templates?
Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.
24
What is the difference between an availability set and an availability zone?
An availability set spreads VMs across fault domains (separate racks, power and switches) and update domains (rebooted at different times) inside one datacenter, giving a 99.95% SLA. Availability zones place VMs in physically separate datacenters within a region, giving 99.99%. Zones protect against a full datacenter outage; availability sets only protect against rack and maintenance failures. New designs prefer zones where the region supports them.
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
Spot VMs use spare Azure capacity at discounts that can reach about 90%, but Azure can evict them with 30 seconds notice when it needs capacity or the price passes your limit. Use them for interruptible work such as batch rendering, CI build agents, test environments and big data jobs with checkpointing. Never use them for stateful production databases or anything that cannot tolerate sudden loss.
27
What is the difference between a service endpoint and a private endpoint?
A service endpoint extends the VNet identity to a PaaS service so its firewall can allow your subnet, but the service still uses its public IP. A private endpoint puts a private IP from your subnet on a specific resource instance, so traffic never needs the public endpoint and works from peered networks and on-premises. Private endpoints are preferred for strict security but need private DNS setup.
28
Write a lifecycle management rule to tier and delete log blobs.
An SLA is Microsoft's uptime commitment per service, with service credits if it is missed. When services depend on each other in series, multiply their SLAs. An App Service at 99.95% calling Azure SQL at 99.99% gives about 0.9995 x 0.9999 = 99.94%. Adding redundancy, such as a second region behind Front Door, raises the combined figure because both paths must fail together.
30
What are RPO and RTO and how do they guide Azure designs?
RPO, recovery point objective, is the maximum acceptable data loss measured in time. RTO, recovery time objective, is how long recovery may take. A daily backup gives an RPO of up to 24 hours. Site Recovery gives an RPO of seconds to minutes and an RTO of minutes to hours. SQL failover groups give an RPO of seconds. Lower RPO and RTO cost more, so agree targets per application.
Tips to crack the NTT DATA Microsoft Azure interview
Revise SQL, testing and programming fundamentals for both the online assessment and technical interview.
Learn about NTT DATA's Japanese parent and its global integration of companies such as Dimension Data.
Be ready to discuss working with clients across time zones, as many teams support global accounts.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; NTT DATA interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the NTT DATA Microsoft Azure interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Technical interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the NTT DATA Microsoft Azure interview?
This practice set leans on Azure Storage (6), Identity and Security (6), Azure Compute (5), Azure Databases (3). Revise those first, then practise explaining one or two of your own projects end to end, because most NTT DATA interviewers ask you to walk through real work.
Are these the exact questions asked at NTT DATA?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like NTT DATA's. They are not a leaked or verified list of past questions.
Where does NTT DATA hire Microsoft Azure professionals in India?
NTT DATA has large teams in Bengaluru, Pune, Noida, Hyderabad, Chennai. Openings and locations change often, so check the NTT DATA careers page and filter by city and experience.