Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About TCS hiring for Microsoft Azure roles
Tata Consultancy Services is a Tata Group company and one of the largest IT services and consulting firms in the world. It delivers application development, testing, cloud, data and analytics services to clients in banking, retail, manufacturing and other industries. In India it hires freshers and experienced staff for software testing, data engineering, BI reporting and analytics roles across its delivery centres.
For Microsoft Azure roles, this TCS practice set focuses most on Identity and Security (7), Azure Databases (5), Azure Fundamentals (5), DevOps and Infrastructure as Code (5). It has 18 easy, 11 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Mumbai, India
Main India offices
Mumbai, Chennai, Pune, Bengaluru, Hyderabad
TCS Microsoft Azure interview process
TCS NQT online assessment (aptitude + coding)
Technical interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for TCSStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do backups and point-in-time restore work in Azure SQL Database?
Azure takes full backups weekly, differential backups every 12 to 24 hours and log backups about every 10 minutes automatically. You can restore to any point within the short-term retention period of 1 to 35 days, default 7, as a new database. Long-term retention keeps weekly, monthly or yearly full backups for up to 10 years. Backup storage can be LRS, ZRS or geo-redundant.
02
Explain the hierarchy of management groups, subscriptions, resource groups and resources.
A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.
03
What is Azure Monitor and what data does it collect?
Azure Monitor is the unified monitoring platform for Azure and hybrid resources. It collects metrics, which are numeric time series stored for 93 days, and logs, which are records stored in Log Analytics workspaces and queried with KQL. Sources include platform metrics, activity logs, resource logs through diagnostic settings, VM guest data through the Azure Monitor Agent and app telemetry from Application Insights.
04
What is Bicep and how does it relate to ARM templates?
Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.
05
Tell me about a time you learned a new Azure service quickly to deliver a task.
Situation: our team needed event-driven processing and nobody had used Azure Functions. Task: I had one week to build a proof of concept. Action: I completed the Microsoft Learn module, built a blob-triggered function in a sandbox subscription, added Application Insights and shared a short demo and runbook. Result: the POC was approved, went live in three weeks and replaced a polling VM, cutting cost noticeably.
06
What is the what-if operation in Bicep deployments?
What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.
07
What is a resource group and what rules apply to it?
A resource group is a logical container for resources that share a lifecycle, for example everything for one app environment. A resource belongs to exactly one group, groups cannot be nested, and deleting a group deletes everything inside it. The group has a location that stores metadata, but resources inside can live in other regions. Resources can be moved between groups for most resource types.
Spot VMs use spare Azure capacity at discounts that can reach about 90%, but Azure can evict them with 30 seconds notice when it needs capacity or the price passes your limit. Use them for interruptible work such as batch rendering, CI build agents, test environments and big data jobs with checkpointing. Never use them for stateful production databases or anything that cannot tolerate sudden loss.
09
What is Azure Policy and how is it different from RBAC?
RBAC controls who can do actions. Azure Policy controls what resources and settings are allowed, whoever deploys them. Policies use effects such as deny, audit, append, modify, deployIfNotExists and auditIfNotExists. For example, deny public IPs on VMs or deploy diagnostic settings automatically. Group policies into initiatives, assign them at management groups and view compliance on the dashboard.
10
Write an Azure Pipelines YAML that builds a .NET app and deploys it to App Service.
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
12
Explain the built-in roles Owner, Contributor, Reader and User Access Administrator.
Owner has full access to resources and can assign roles to others. Contributor can create and manage all resources but cannot grant access or manage role assignments. Reader can only view resources. User Access Administrator can manage role assignments but not resources. Follow least privilege: most engineers need Contributor on their own resource groups and Reader elsewhere, with Owner held by very few people.
13
Write a KQL query for the top 10 slowest requests in Application Insights over the last day.
Query the requests table, summarise duration and sort:
requests
| where timestamp > ago(1d)
| summarize count(), avgDuration = avg(duration),
p95 = percentile(duration, 95) by name
| top 10 by p95 desc
In a workspace-based resource, the table is AppRequests with TimeGenerated and DurationMs columns instead.
Azure Boards tracks work items, sprints and backlogs. Azure Repos hosts Git repositories with branch policies. Azure Pipelines runs CI/CD on Microsoft-hosted or self-hosted agents. Azure Test Plans manages manual and exploratory testing. Azure Artifacts hosts NuGet, npm, Maven and Python feeds. Many Indian service companies still run client projects on Azure DevOps, while product companies often use GitHub Actions.
15
Write a Cosmos DB NoSQL query to get a customer's orders above 5000 rupees.
Filter on the partition key so the query hits one partition and stays cheap:
SELECT c.id, c.orderDate, c.total
FROM c
WHERE c.customerId = @customerId
AND c.total > 5000
ORDER BY c.orderDate DESC
ORDER BY on orderDate needs a range index, which the default indexing policy includes. Check the RU charge in the response headers.
Slots are live copies of an app with their own hostname, available from the Standard tier. You deploy to a staging slot, warm it up and test, then swap it with production. The swap redirects traffic with near-zero downtime and can be reversed by swapping back. Slot-specific settings, such as a staging database connection string, stay with the slot instead of moving during the swap.
Serverless is a vCore option in General Purpose and Hyperscale that autoscales between a minimum and maximum vCore range and bills per second for compute used. In General Purpose it can auto-pause after an idle period and charge only for storage, then resume on the next connection with a short delay. It suits dev databases and apps with intermittent use, not steady heavy workloads.
18
What are resource locks and when would you use them?
Locks protect resources from accidental change. CanNotDelete allows reads and updates but blocks deletion; ReadOnly allows only reads, which can break operations like listing storage keys. Locks apply to a subscription, group or resource and are inherited. Teams put CanNotDelete on production resource groups, DNS zones and ExpressRoute circuits. Only Owner or User Access Administrator roles can remove locks by default.
Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.
20
What is the difference between an availability set and an availability zone?
An availability set spreads VMs across fault domains (separate racks, power and switches) and update domains (rebooted at different times) inside one datacenter, giving a 99.95% SLA. Availability zones place VMs in physically separate datacenters within a region, giving 99.99%. Zones protect against a full datacenter outage; availability sets only protect against rack and maintenance failures. New designs prefer zones where the region supports them.
21
How do you reference Key Vault secrets in App Service app settings?
Enable a managed identity on the app, grant it Key Vault Secrets User on the vault, then set the app setting value to a Key Vault reference: @Microsoft.KeyVault(SecretUri=https://kv-shop-prod.vault.azure.net/secrets/SqlPassword/). The app reads it as a normal environment variable. Omitting the version makes App Service pick up rotated secrets automatically within about a day, or on restart.
22
What deployment strategies can you use for Azure apps?
Rolling updates replace instances in batches, used by VMSS and Kubernetes. Blue-green runs two environments and switches traffic, as with App Service slots. Canary sends a small percentage of traffic to the new version first, using slot traffic routing, Front Door weights or Container Apps revisions. Feature flags in App Configuration let you deploy code dark and enable features gradually without redeploying.
23
How do you work with the security team when they reject your network design?
Situation: security rejected my design because the app used public endpoints for storage and SQL. Task: meet their standards without delaying launch. Action: I met them, listed their controls, and redesigned with private endpoints, Azure Firewall egress and WAF, then shared a diagram and cost impact. Result: they approved it in one review cycle, and the design became a reusable team template.
Relational options are Azure SQL Database, Azure SQL Managed Instance, SQL Server on VMs, and Azure Database for PostgreSQL and MySQL flexible servers. Azure Cosmos DB is the globally distributed NoSQL and vector database. Azure Cache for Redis and Azure Managed Redis provide in-memory caching. For analytics there are Synapse, Fabric and Azure Data Explorer. Choose by data model, compatibility and how much operations you want to manage.
25
How do you keep up with security changes in Azure?
Situation: Azure releases security changes every month, and missing one can expose our systems. Task: stay current without losing project time. Action: I follow Azure Updates and the Azure Security blog, read the monthly Defender for Cloud changes, review Service Health retirement notices and spend an hour weekly in a lab. Result: our team was ready for the mandatory MFA rollout for Azure sign-ins before it was enforced.
Security duties are split between Microsoft and the customer. Microsoft always owns physical datacenters, hosts and the network fabric. The customer always owns data, identities, accounts and devices. The middle layers move with the service model: in IaaS you patch the OS and configure firewalls; in PaaS Microsoft patches the OS and runtime; in SaaS you mainly manage users and data.
27
You run a SaaS app with 300 small tenant databases whose usage peaks at different times. How do you host them cost-effectively?
An elastic pool shares a set of resources, in eDTUs or vCores, among many Azure SQL databases on one logical server. It suits SaaS apps with a database per tenant, where individual usage peaks at different times. Instead of sizing each database for its peak, you size the pool for combined usage and set per-database min and max limits. Too many busy databases at once will contend for resources.
Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.
29
How does encryption at rest and in transit work in Azure?
All Azure Storage, managed disks and Azure SQL data is encrypted at rest with AES-256 by default using Microsoft-managed keys. You can switch to customer-managed keys in Key Vault for control over rotation and revocation, and use double encryption or confidential computing for stricter needs. In transit, services use TLS 1.2 or higher, and you should enforce HTTPS only and minimum TLS version settings.
Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.
Tips to crack the TCS Microsoft Azure interview
Practise TCS NQT style numerical, verbal and reasoning sections along with two basic coding problems under strict time limits.
Be ready to explain your final-year project, SQL basics and core concepts like OOP, DBMS and software testing life cycle.
Read about TCS service lines such as BFSI and its iON and Ignio platforms to answer why you want to join.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; TCS interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the TCS Microsoft Azure interview?
Candidates usually go through 4 stages: TCS NQT online assessment (aptitude + coding); Technical interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the TCS Microsoft Azure interview?
This practice set leans on Identity and Security (7), Azure Databases (5), Azure Fundamentals (5), DevOps and Infrastructure as Code (5). Revise those first, then practise explaining one or two of your own projects end to end, because most TCS interviewers ask you to walk through real work.
Are these the exact questions asked at TCS?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like TCS's. They are not a leaked or verified list of past questions.
Where does TCS hire Microsoft Azure professionals in India?
TCS has large teams in Mumbai, Chennai, Pune, Bengaluru, Hyderabad. Openings and locations change often, so check the TCS careers page and filter by city and experience.