Skip to content

Microsoft Azure Online Assessment Questions & Answers

40 questions for the online assessment stage — 17 easy, 22 medium, 1 hard.

About the online assessment round

Most companies start with an online test: aptitude and reasoning, a few MCQs on core Microsoft Azure concepts, and one or two short hands-on tasks. It filters a large number of applicants, so speed and accuracy both count.

Tips for the online assessment round

  • Practise under a timer: about one minute per MCQ and 15-20 minutes per hands-on task.
  • Read every option before answering; tests often include two nearly correct choices.
  • Use a stable internet connection, keep your camera on and avoid switching tabs in proctored tests.
  • Attempt the questions you are sure about first, then return to the harder ones.
Solved — online assessmentStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

How do you configure autoscale for an App Service plan?

Save to ▾
Show answer
In the plan's Scale out settings, choose rules-based autoscale or automatic scaling. A typical rule set: scale out by 1 instance when average CPU exceeds 70% for 10 minutes, scale in by 1 when below 30% for 10 minutes, minimum 2 and maximum 10 instances. Always pair scale-out with a scale-in rule and a cool-down period so the plan does not flap between sizes.
02

Store and read a secret from Key Vault using Azure CLI.

Save to ▾
Show answer
Create an RBAC-enabled vault, grant yourself Key Vault Secrets Officer, then set and read the secret: az keyvault create -g rg-sec -n kv-shop-prod \ --location centralindia --enable-rbac-authorization true az keyvault secret set --vault-name kv-shop-prod \ --name SqlPassword --value 'S3cure#Pass' az keyvault secret show --vault-name kv-shop-prod \ --name SqlPassword --query value -o tsv
03

How do you create a budget with alerts for a subscription?

Save to ▾
Show answer
In Cost Management, choose Budgets, set the scope to the subscription or a resource group, a monthly amount and alert conditions such as 50%, 80% and 100% of actual cost and 100% of forecast. Add email recipients and an action group that can notify Teams or run an automation. Budgets do not stop spending on their own, so pair them with automation or policy if needed.
04

What are RPO and RTO and how do they guide Azure designs?

Save to ▾
Show answer
RPO, recovery point objective, is the maximum acceptable data loss measured in time. RTO, recovery time objective, is how long recovery may take. A daily backup gives an RPO of up to 24 hours. Site Recovery gives an RPO of seconds to minutes and an RTO of minutes to hours. SQL failover groups give an RPO of seconds. Lower RPO and RTO cost more, so agree targets per application.
05

What is a service connection in Azure Pipelines?

Save to ▾
Show answer
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
06

What is Azure Resource Manager (ARM)?

Save to ▾
Show answer
ARM is the deployment and management layer of Azure. Every request from the portal, CLI, PowerShell, SDKs or Bicep goes through the ARM API, which authenticates the caller, checks RBAC and Policy, and forwards the call to the resource provider. Because all tools hit the same API, you get consistent results, tagging, locks and activity logs no matter how the change was made.
07

What are triggers and bindings in Azure Functions?

Save to ▾
Show answer
A trigger is what starts a function, and each function has exactly one: HTTP, Timer, Blob, Queue, Service Bus, Event Grid, Event Hubs or Cosmos DB change feed. Bindings declaratively connect inputs and outputs, for example reading a blob and writing to a queue without writing SDK code. They reduce boilerplate, but for complex error handling or batching you may still use the SDK directly.
08

What is Bicep and how does it relate to ARM templates?

Save to ▾
Show answer
Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.
09

How do you reference Key Vault secrets in App Service app settings?

Save to ▾
Show answer
Enable a managed identity on the app, grant it Key Vault Secrets User on the vault, then set the app setting value to a Key Vault reference: @Microsoft.KeyVault(SecretUri=https://kv-shop-prod.vault.azure.net/secrets/SqlPassword/). The app reads it as a normal environment variable. Omitting the version makes App Service pick up rotated secrets automatically within about a day, or on restart.
10

What is Azure Kubernetes Service (AKS) and what does Azure manage for you?

Save to ▾
Show answer
AKS is managed Kubernetes. Azure runs the control plane, including the API server and etcd, and handles upgrades and its availability. You manage node pools, which are VM scale sets, plus workloads, networking choices and add-ons. AKS integrates with Entra ID for cluster login, Azure CNI for pod networking, ACR for images, Key Vault via CSI driver and Azure Monitor Container Insights for logs and metrics.
11

What are Request Units (RUs) in Cosmos DB?

Save to ▾
Show answer
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
12

Your manager asks you to estimate the monthly cost of a new Azure application. How do you do it?

Save to ▾
Show answer
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
13

Write a KQL query for the top 10 slowest requests in Application Insights over the last day.

Save to ▾
Show answer
Query the requests table, summarise duration and sort: requests | where timestamp > ago(1d) | summarize count(), avgDuration = avg(duration), p95 = percentile(duration, 95) by name | top 10 by p95 desc In a workspace-based resource, the table is AppRequests with TimeGenerated and DurationMs columns instead.
14

What are tags and how are they used in real projects?

Save to ▾
Show answer
Tags are name-value pairs such as env=prod, owner=payments, costcenter=CC101 applied to resources, groups and subscriptions. They help filter cost reports, automate shutdown scripts and track ownership. Tags are not inherited by default, so teams use Azure Policy with modify or append effects to inherit tags from the resource group or require them at creation. A resource can carry up to 50 tags.
15

Write a simple HTTP-triggered Azure Function in Python (v2 programming model).

Save to ▾
Show answer
The v2 model uses decorators in function_app.py, so no function.json is needed: import azure.functions as func app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION) @app.route(route='hello', methods=['GET']) def hello(req: func.HttpRequest) -> func.HttpResponse: name = req.params.get('name', 'world') return func.HttpResponse(f'Hello, {name}', status_code=200) Callers pass the function key in the code query parameter or x-functions-key header.
16

How do you build and push a container image to ACR without Docker installed?

Save to ▾
Show answer
Use ACR Tasks to build in the cloud from your source folder: az acr build --registry acrshopprod \ --image shop-api:$(git rev-parse --short HEAD) . ACR Tasks can also rebuild automatically on a Git commit or when the base image is updated, which helps patch OS vulnerabilities without manual work.
17

Write a KQL query to find VMs with average CPU above 80% in the last hour.

Save to ▾
Show answer
Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights: Perf | where TimeGenerated > ago(1h) | where ObjectName == 'Processor' and CounterName == '% Processor Time' | where InstanceName == '_Total' | summarize avgCpu = avg(CounterValue) by Computer | where avgCpu > 80 | order by avgCpu desc
18

A developer accidentally overwrote important files in Blob Storage. How do you recover and prevent it?

Save to ▾
Show answer
If versioning was on, promote the previous version; if soft delete was on, undelete within the retention period. Point-in-time restore can roll back a whole container if enabled. If none were enabled, recovery may only be from backups. Going forward, enable versioning, soft delete and Azure Backup for blobs, give developers read-only roles in production and route writes only through the application identity.
19

Write a Cosmos DB NoSQL query to get a customer's orders above 5000 rupees.

Save to ▾
Show answer
Filter on the partition key so the query hits one partition and stays cheap: SELECT c.id, c.orderDate, c.total FROM c WHERE c.customerId = @customerId AND c.total > 5000 ORDER BY c.orderDate DESC ORDER BY on orderDate needs a range index, which the default indexing policy includes. Check the RU charge in the response headers.
20

What is a Log Analytics workspace?

Save to ▾
Show answer
A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.
21

What is Conditional Access?

Save to ▾
Show answer
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
22

What is an Azure Virtual Network (VNet)?

Save to ▾
Show answer
A VNet is your private, isolated network in an Azure region, defined by one or more address spaces such as 10.10.0.0/16 and divided into subnets. Resources in a VNet communicate privately and Azure provides default routing between subnets and to the internet. VNets connect to each other with peering and to on-premises with VPN Gateway or ExpressRoute. Azure reserves five IP addresses in every subnet.
23

Explain the storage redundancy options LRS, ZRS, GRS and GZRS.

Save to ▾
Show answer
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
24

Explain Azure Backup and Azure Site Recovery.

Save to ▾
Show answer
Azure Backup protects data by taking scheduled backups of VMs, SQL and SAP HANA in VMs, Azure Files, blobs, disks and on-premises servers into Recovery Services or Backup vaults, with retention policies, soft delete and immutability. Azure Site Recovery replicates whole VMs continuously to another region or from on-premises to Azure for disaster recovery, with recovery plans for orchestrated failover. Backup is for restoring data; Site Recovery is for business continuity.
25

Explain the hierarchy of management groups, subscriptions, resource groups and resources.

Save to ▾
Show answer
A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.
26

What is the difference between an app registration and a service principal?

Save to ▾
Show answer
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
27

What is Infrastructure as Code and why use it on Azure?

Save to ▾
Show answer
Infrastructure as Code defines resources in versioned files, such as Bicep, ARM JSON or Terraform, instead of clicking in the portal. It makes environments repeatable, reviewable through pull requests and quick to rebuild after failure. Drift between dev, test and prod drops because all are deployed from the same templates with different parameters. It also documents the setup and enables automated policy checks before deployment.
28

What is Azure App Service and what does an App Service plan define?

Save to ▾
Show answer
App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.
29

Write a basic Terraform configuration for a resource group and VNet with remote state.

Save to ▾
Show answer
Configure the azurerm backend and provider, then resources: terraform { backend "azurerm" { resource_group_name = "rg-tfstate" storage_account_name = "sttfstateprod" container_name = "state" key = "network.tfstate" use_azuread_auth = true } } provider "azurerm" { features {} } resource "azurerm_resource_group" "net" { name = "rg-net-prod" location = "centralindia" } resource "azurerm_virtual_network" "hub" { name = "vnet-hub" location = azurerm_resource_group.net.location resource_group_name = azurerm_resource_group.net.name address_space = ["10.0.0.0/16"] }
30

Design a disaster recovery plan for a VM-based application in Central India.

Save to ▾
Show answer
Agree RPO and RTO with the business. Replicate VMs to South India with Azure Site Recovery, configure recovery plans that start the database first, then app and web tiers, and pre-create the network. Use Traffic Manager or Front Door for DNS failover. Back up data separately with Azure Backup in case of corruption. Run test failovers into an isolated VNet every quarter.
31

What is the difference between a VPN Gateway and ExpressRoute?

Save to ▾
Show answer
A VPN Gateway creates encrypted IPsec tunnels over the public internet, for site-to-site or point-to-site connections, and is quick and cheap to set up. ExpressRoute is a private dedicated connection through a connectivity provider with predictable latency and bandwidth up to 100 Gbps, but it does not encrypt by default. Many companies use ExpressRoute as primary and a VPN as backup.
32

What are the main services in Azure DevOps?

Save to ▾
Show answer
Azure Boards tracks work items, sprints and backlogs. Azure Repos hosts Git repositories with branch policies. Azure Pipelines runs CI/CD on Microsoft-hosted or self-hosted agents. Azure Test Plans manages manual and exploratory testing. Azure Artifacts hosts NuGet, npm, Maven and Python feeds. Many Indian service companies still run client projects on Azure DevOps, while product companies often use GitHub Actions.
33

What are Spot VMs and where should you use them?

Save to ▾
Show answer
Spot VMs use spare Azure capacity at discounts that can reach about 90%, but Azure can evict them with 30 seconds notice when it needs capacity or the price passes your limit. Use them for interruptible work such as batch rendering, CI build agents, test environments and big data jobs with checkpointing. Never use them for stateful production databases or anything that cannot tolerate sudden loss.
34

What is a NAT Gateway and why would you use it?

Save to ▾
Show answer
A NAT Gateway provides outbound internet connectivity for a subnet using one or more static public IPs. It gives a large pool of SNAT ports, avoiding the port exhaustion common with default outbound or Load Balancer outbound rules, and gives a fixed IP that partners can allowlist. Since default outbound access is being retired for new VNets, explicit outbound methods like NAT Gateway are recommended.
35

An application on a VM must access a storage account without any keys. How do you set it up?

Save to ▾
Show answer
Enable a system-assigned or user-assigned managed identity on the VM. Assign the identity the least role needed, such as Storage Blob Data Reader on the specific container. In code, use DefaultAzureCredential or ManagedIdentityCredential from the Azure SDK. Then disable shared key access on the account. The token is fetched from the local metadata endpoint and rotated automatically by Azure.
36

What is Azure Firewall and how is it different from an NSG?

Save to ▾
Show answer
Azure Firewall is a managed, stateful, centralised firewall with network and application rules, FQDN filtering, threat intelligence and, in the Premium SKU, TLS inspection and IDPS. NSGs are distributed basic filters on subnets and NICs. Typically NSGs control traffic within and between subnets, while Azure Firewall in a hub controls internet egress and cross-spoke traffic with central logging.
37

How do you secure access to a storage account?

Save to ▾
Show answer
Disable shared key access where possible and use Entra ID with RBAC roles like Storage Blob Data Reader. Use managed identities for apps. Disable public blob access, require TLS 1.2, restrict the firewall to selected VNets, or use private endpoints and disable public network access. Enable soft delete, versioning and Defender for Storage, and keep keys, if any, in Key Vault with rotation.
38

Name the Azure regions available in India.

Save to ▾
Show answer
Microsoft runs Central India (Pune), South India (Chennai) and West India (Mumbai) as public regions, plus Jio India West and Jio India Central for specific customers. Central India supports availability zones. Indian companies pick these regions for low latency and for data residency needs such as RBI guidelines on payment data, often pairing Central India with South India for disaster recovery.
39

What is Azure Cosmos DB and which APIs does it support?

Save to ▾
Show answer
Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.
40

Write an Azure PowerShell command to find all VMs without an env tag.

Save to ▾
Show answer
Filter Get-AzVM output on the Tags hashtable and export the result for review: Connect-AzAccount Get-AzVM | Where-Object { -not $_.Tags -or -not $_.Tags.ContainsKey('env') } | Select-Object Name, ResourceGroupName, Location | Export-Csv untagged-vms.csv -NoTypeInformation For large estates, Azure Resource Graph queries are faster across many subscriptions.

Frequently asked questions

What happens in the Microsoft Azure online assessment round?

Most companies start with an online test: aptitude and reasoning, a few MCQs on core Microsoft Azure concepts, and one or two short hands-on tasks. It filters a large number of applicants, so speed and accuracy both count.

How do I clear the online assessment round?

Practise under a timer: about one minute per MCQ and 15-20 minutes per hands-on task. Read every option before answering; tests often include two nearly correct choices. Use a stable internet connection, keep your camera on and avoid switching tabs in proctored tests.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.