Skip to content
Microsoft Azure
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Microsoft Azure Mock Interview: 20 Questions in 50 Minutes

Four rounds that copy a real interview. Answer aloud, then check the model answers.

Mock interview format

  1. Warm-up · 5 minutes — 4 questions
  2. Technical · 20 minutes — 7 questions
  3. Scenario · 15 minutes — 5 questions
  4. HR & behavioural · 10 minutes — 4 questions

Tip: record yourself and listen back. Most people talk too fast and skip the key idea.

Mock progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is an Azure Virtual Network (VNet)?

Warm-upAzure NetworkingEasy
Save to ▾
Show answer
A VNet is your private, isolated network in an Azure region, defined by one or more address spaces such as 10.10.0.0/16 and divided into subnets. Resources in a VNet communicate privately and Azure provides default routing between subnets and to the internet. VNets connect to each other with peering and to on-premises with VPN Gateway or ExpressRoute. Azure reserves five IP addresses in every subnet.
02

What is a managed identity and what types exist?

Warm-upIdentity and SecurityEasy
Save to ▾
Show answer
A managed identity is an Entra ID identity that Azure creates and rotates for a resource, so code can get tokens without storing secrets. A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource you can attach to many resources and that survives their deletion. User-assigned is better when several apps share access or when you pre-create role assignments.
03

What is Microsoft Entra ID?

Warm-upIdentity and SecurityEasy
Save to ▾
Show answer
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
04

What services does an Azure Storage account provide?

Warm-upAzure StorageEasy
Save to ▾
Show answer
A general-purpose v2 storage account offers Blob Storage for objects, Azure Files for SMB and NFS file shares, Queue Storage for simple messaging and Table Storage for key-value NoSQL data. Data Lake Storage Gen2 is Blob Storage with hierarchical namespace enabled for analytics. Each account has a globally unique name that forms endpoints like name.blob.core.windows.net, and settings such as redundancy and network rules apply account-wide.
05

What is the difference between Entra ID roles and Azure RBAC roles?

TechnicalIdentity and SecurityMedium
Save to ▾
Show answer
Entra ID roles, such as Global Administrator or User Administrator, control the directory: users, groups, app registrations and tenant settings. Azure RBAC roles, such as Owner, Contributor and Reader, control Azure resources at management group, subscription, resource group or resource scope. A Global Administrator has no resource access by default, though they can elevate themselves to User Access Administrator at root scope.
06

Create an Azure SQL Database with Entra-only authentication using Azure CLI.

TechnicalAzure DatabasesMedium
Save to ▾
Show answer
Create the logical server with an Entra admin group and no SQL logins, then the database: az sql server create -g rg-data -n sql-shop-prod -l centralindia \ --enable-ad-only-auth \ --external-admin-principal-type Group \ --external-admin-name grp-sql-admins \ --external-admin-sid <group-object-id> az sql db create -g rg-data -s sql-shop-prod -n shopdb \ --edition GeneralPurpose --family Gen5 --capacity 2 \ --zone-redundant true --backup-storage-redundancy Zone
07

What is the difference between an app registration and a service principal?

TechnicalIdentity and SecurityMedium
Save to ▾
Show answer
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
08

What is Conditional Access?

TechnicalIdentity and SecurityMedium
Save to ▾
Show answer
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
09

How do you let an App Service connect to Azure SQL using its managed identity?

TechnicalAzure DatabasesMedium
Save to ▾
Show answer
Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles: CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [app-shop-prod]; ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod]; Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.
10

What is the difference between an availability set and an availability zone?

TechnicalAzure ComputeMedium
Save to ▾
Show answer
An availability set spreads VMs across fault domains (separate racks, power and switches) and update domains (rebooted at different times) inside one datacenter, giving a 99.95% SLA. Availability zones place VMs in physically separate datacenters within a region, giving 99.99%. Zones protect against a full datacenter outage; availability sets only protect against rack and maintenance failures. New designs prefer zones where the region supports them.
11

Write a Resource Graph query to list unattached managed disks.

TechnicalMonitoring, Cost and GovernanceMedium
Save to ▾
Show answer
Unattached disks keep billing, so this is a common cost check: Resources | where type =~ 'microsoft.compute/disks' | where properties.diskState =~ 'Unattached' | project name, resourceGroup, subscriptionId, sku = sku.name, sizeGb = properties.diskSizeGB Run it with az graph query -q or in the Resource Graph Explorer.
12

How would you upgrade an AKS cluster in production with minimal downtime?

ScenarioAzure ComputeHard
Save to ▾
Show answer
Check the release notes and API deprecations, then upgrade a non-prod cluster first. Set Pod Disruption Budgets and multiple replicas so draining is safe. Upgrade the control plane, then node pools one at a time using max surge so new nodes join before old ones drain. Use planned maintenance windows and auto-upgrade channels for patches. For major risk, run a blue-green cluster and switch traffic.
13

Users say an API is failing but no alert fired. What do you change?

ScenarioMonitoring, Cost and GovernanceHard
Save to ▾
Show answer
Check whether alerts measured the right signal: CPU alerts miss application errors. Add alerts on user-facing SLIs, such as failed request rate, p95 latency and availability tests from multiple locations in Application Insights. Make sure the action group has correct recipients and that alert processing rules are not suppressing it. Review the incident timeline and add the missing signals to the on-call runbook.
14

A VM in a spoke cannot reach a VM in another spoke. What could be wrong?

ScenarioAzure NetworkingMedium
Save to ▾
Show answer
Peering is not transitive, so spoke to spoke traffic needs a route through the hub. Check that both spokes have UDRs pointing the other spoke's range to the hub firewall, that peerings allow forwarded traffic, and that firewall network rules allow the flow. Then check NSGs on both subnets and NICs and the guest OS firewall. Use Network Watcher next hop and IP flow verify to confirm.
15

Your VMs run 24x7, but their sizes and regions change every few months. Would you buy reservations or a savings plan?

ScenarioAzure FundamentalsMedium
Save to ▾
Show answer
Reservations give a big discount, up to about 72% versus pay-as-you-go, when you commit to a specific VM family, region and term of one or three years. Savings plans commit to a fixed hourly spend for one or three years and apply flexibly across VM sizes, regions, App Service and Functions Premium. Use reservations for very stable workloads and savings plans when your sizes or regions change.
16

A developer's service principal secret was committed to a public GitHub repo. What do you do?

ScenarioIdentity and SecurityMedium
Save to ▾
Show answer
Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.
17

How do you prioritise when several alerts fire at the same time?

HR & behaviouralMonitoring, Cost and GovernanceEasy
Save to ▾
Show answer
Situation: during a release night, CPU, disk and payment error alerts fired together. Task: decide what to handle first. Action: I ranked by customer impact, so payment failures came first, checked Service Health for a platform issue, assigned disk and CPU checks to a teammate and kept a running update in the incident channel. Result: payments recovered quickly and we tuned the noisy CPU alerts afterwards.
18

Describe a production incident you handled and what you learned.

HR & behaviouralAzure ComputeMedium
Save to ▾
Show answer
Situation: an App Service API began returning 502 errors during peak hours. Task: restore service and find the root cause. Action: I scaled out to stop impact, then found in Application Insights that outbound SQL connections were exhausting SNAT ports. I added connection pooling and VNet integration with a NAT gateway. Result: errors stopped, and I wrote a postmortem and added a SNAT alert.
19

How do you handle disagreement with a developer about database design?

HR & behaviouralAzure DatabasesEasy
Save to ▾
Show answer
Situation: a developer wanted to store all order data as JSON blobs in one table. Task: agree on a design that would scale. Action: I listened to his reason, faster development, then built a small benchmark showing filter and reporting queries on both designs and proposed relational tables with a JSON column for flexible attributes. Result: we adopted the hybrid, and reporting stayed fast.
20

How do you explain a technical storage decision to a non-technical stakeholder?

HR & behaviouralAzure StorageEasy
Save to ▾
Show answer
Situation: finance asked why we needed GZRS instead of cheaper LRS. Task: justify the cost clearly. Action: I compared the options in business terms: LRS survives a disk failure, GZRS survives losing a whole region, and I showed the cost of downtime per hour for our app versus the extra monthly charge. Result: they approved GZRS only for critical data and LRS for the rest.

Frequently asked questions

How do I use this mock interview?

Set a 50-minute timer, answer every question aloud (or ask a friend to read them), and open answers only after each round. Note every question where your answer missed the key idea.

How often should I take a mock?

Once a week while preparing and once two or three days before a real interview. The question order is fixed, so for fresh practice use the company and experience pages too.

More ways to practise

Company-wise Microsoft Azure questionsExperience-wise Microsoft Azure questionsRole-wise Microsoft Azure questionsCity-wise Microsoft Azure questionsMost asked Microsoft Azure questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsOnline assessment questionsTechnical round questionsManagerial round questionsMicrosoft Azure topic sheets