Practical Microsoft Azure Interview Questions

Log in, select the subscription, create the group with tags, then list its resources in a table: az login az account set --subscription 'Prod-Sub' az group create --name rg-shop-prod --location centralindia --tags env=prod owner=shop az resource list --resource-group rg-shop-prod --output table The --query flag with JMESPath filters output, for example --query '[].name'.

Filter Get-AzVM output on the Tags hashtable and export the result for review: Connect-AzAccount Get-AzVM | Where-Object { -not $_.Tags -or -not $_.Tags.ContainsKey('env') } | Select-Object Name, ResourceGroupName, Location | Export-Csv untagged-vms.csv -NoTypeInformation For large estates, Azure Resource Graph queries are faster across many subscriptions.

Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion: az vm create \ --resource-group rg-app-dev \ --name vm-api-01 \ --image Ubuntu2204 \ --size Standard_D2s_v5 \ --vnet-name vnet-dev --subnet snet-app \ --public-ip-address '' \ --admin-username azureuser \ --generate-ssh-keys \ --zone 1

The v2 model uses decorators in function_app.py, so no function.json is needed: import azure.functions as func app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION) @app.route(route='hello', methods=['GET']) def hello(req: func.HttpRequest) -> func.HttpResponse: name = req.params.get('name', 'world') return func.HttpResponse(f'Hello, {name}', status_code=200) Callers pass the function key in the code query parameter or x-functions-key header.

Create the cluster with Azure CNI overlay and the system pool across zones, then add a user pool for apps: az aks create -g rg-aks-prod -n aks-prod \ --network-plugin azure --network-plugin-mode overlay \ --nodepool-name system --node-count 3 --zones 1 2 3 \ --enable-managed-identity --attach-acr acrshopprod \ --generate-ssh-keys az aks nodepool add -g rg-aks-prod --cluster-name aks-prod \ -n apps --mode User --node-count 3 --zones 1 2 3 \ --enable-cluster-autoscaler --min-count 3 --max-count 10

Log in with AzCopy and copy recursively; the user needs the Storage Blob Data Contributor role: azcopy login --tenant-id <tenant-guid> azcopy copy './reports' \ 'https://stshopprod.blob.core.windows.net/reports' \ --recursive --overwrite ifSourceNewer AzCopy runs transfers in parallel and can resume failed jobs with azcopy jobs resume.

The JSON policy moves blobs under logs/ to Cool after 30 days, Archive after 90 and deletes after 365: { "rules": [{ "name": "logs-tiering", "enabled": true, "type": "Lifecycle", "definition": { "filters": {"blobTypes": ["blockBlob"], "prefixMatch": ["logs/"]}, "actions": {"baseBlob": { "tierToCool": {"daysAfterModificationGreaterThan": 30}, "tierToArchive": {"daysAfterModificationGreaterThan": 90}, "delete": {"daysAfterModificationGreaterThan": 365}}} }}] }

DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored: from azure.identity import DefaultAzureCredential from azure.storage.blob import BlobServiceClient url = 'https://stshopprod.blob.core.windows.net' client = BlobServiceClient(url, credential=DefaultAzureCredential()) blob = client.get_blob_client('invoices', '2026/inv-1001.pdf') data = blob.download_blob().readall() print(len(data))

Log in with Entra ID, then create a short-lived read-only SAS signed with your identity: az storage blob generate-sas \ --account-name stshopprod --container-name invoices \ --name inv-1001.pdf --permissions r \ --expiry 2026-11-12T18:00Z --https-only \ --auth-mode login --as-user --full-uri The caller needs a role that allows generating user delegation keys.

Create the private endpoint in the app subnet for the blob sub-resource, link the private DNS zone privatelink.blob.core.windows.net to the VNet, and disable public network access on the account: az network private-endpoint create -g rg-net -n pe-st-blob \ --vnet-name vnet-hub --subnet snet-pe \ --private-connection-resource-id <storage-id> \ --group-id blob --connection-name st-blob Then test that the name resolves to a 10.x address.

Create the VNet, add subnets, then an NSG that allows HTTPS and attach it: az network vnet create -g rg-net -n vnet-app \ --address-prefixes 10.20.0.0/16 \ --subnet-name snet-web --subnet-prefixes 10.20.1.0/24 az network vnet subnet create -g rg-net --vnet-name vnet-app \ -n snet-db --address-prefixes 10.20.2.0/24 az network nsg create -g rg-net -n nsg-web az network nsg rule create -g rg-net --nsg-name nsg-web -n allow-https \ --priority 100 --direction Inbound --access Allow \ --protocol Tcp --destination-port-ranges 443 az network vnet subnet update -g rg-net --vnet-name vnet-app \ -n snet-web --network-security-group nsg-web

Peering must be created from each side. Allow forwarded traffic if a hub firewall routes it: az network vnet peering create -g rg-net -n hub-to-spoke1 \ --vnet-name vnet-hub --remote-vnet vnet-spoke1 \ --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit az network vnet peering create -g rg-net -n spoke1-to-hub \ --vnet-name vnet-spoke1 --remote-vnet vnet-hub \ --allow-vnet-access --allow-forwarded-traffic --use-remote-gateways

Add a default route with next hop Virtual appliance pointing to the firewall private IP, then attach it to the spoke subnet: az network route-table create -g rg-net -n rt-spoke1 az network route-table route create -g rg-net \ --route-table-name rt-spoke1 -n default-to-fw \ --address-prefix 0.0.0.0/0 \ --next-hop-type VirtualAppliance --next-hop-ip-address 10.0.1.4 az network vnet subnet update -g rg-net --vnet-name vnet-spoke1 \ -n snet-app --route-table rt-spoke1

Look up the group object ID, then create the role assignment with the narrowest scope: GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv) az role assignment create \ --assignee-object-id $GROUP_ID \ --assignee-principal-type Group \ --role Contributor \ --scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev Assigning to groups instead of users keeps access easy to audit.

Create an RBAC-enabled vault, grant yourself Key Vault Secrets Officer, then set and read the secret: az keyvault create -g rg-sec -n kv-shop-prod \ --location centralindia --enable-rbac-authorization true az keyvault secret set --vault-name kv-shop-prod \ --name SqlPassword --value 'S3cure#Pass' az keyvault secret show --vault-name kv-shop-prod \ --name SqlPassword --query value -o tsv

Define the rule with an allowed list and a deny effect, then assign it at a management group: resource pol 'Microsoft.Authorization/policyDefinitions@2023-04-01' = { name: 'allowed-india-regions' properties: { policyType: 'Custom' mode: 'Indexed' policyRule: { if: { field: 'location' notIn: ['centralindia', 'southindia', 'westindia'] } then: { effect: 'deny' } } } }

Export a similar built-in role as JSON, keep only needed Actions and DataActions, set AssignableScopes and create it: az role definition list --name 'Virtual Machine Contributor' > vm-op.json # edit: Name 'VM Operator', Actions: # Microsoft.Compute/virtualMachines/read # Microsoft.Compute/virtualMachines/start/action # Microsoft.Compute/virtualMachines/restart/action # Microsoft.Compute/virtualMachines/deallocate/action az role definition create --role-definition vm-op.json

Create the logical server with an Entra admin group and no SQL logins, then the database: az sql server create -g rg-data -n sql-shop-prod -l centralindia \ --enable-ad-only-auth \ --external-admin-principal-type Group \ --external-admin-name grp-sql-admins \ --external-admin-sid <group-object-id> az sql db create -g rg-data -s sql-shop-prod -n shopdb \ --edition GeneralPurpose --family Gen5 --capacity 2 \ --zone-redundant true --backup-storage-redundancy Zone

Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles: CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [app-shop-prod]; ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod]; Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.

Filter on the partition key so the query hits one partition and stays cheap: SELECT c.id, c.orderDate, c.total FROM c WHERE c.customerId = @customerId AND c.total > 5000 ORDER BY c.orderDate DESC ORDER BY on orderDate needs a range index, which the default indexing policy includes. Check the RU charge in the response headers.

Parameters keep the template reusable across environments: param location string = resourceGroup().location @minLength(3) @maxLength(24) param name string @allowed(['Standard_LRS', 'Standard_ZRS']) param sku string = 'Standard_ZRS' resource st 'Microsoft.Storage/storageAccounts@2023-05-01' = { name: name location: location sku: { name: sku } kind: 'StorageV2' properties: { minimumTlsVersion: 'TLS1_2' allowBlobPublicAccess: false supportsHttpsTrafficOnly: true } } output blobEndpoint string = st.properties.primaryEndpoints.blob

Run what-if first, then deploy with a parameters file: az deployment group what-if \ --resource-group rg-shop-dev \ --template-file main.bicep \ --parameters main.dev.bicepparam az deployment group create \ --resource-group rg-shop-dev \ --template-file main.bicep \ --parameters main.dev.bicepparam Use az deployment sub create for subscription-scope templates.

Build and publish an artifact, then deploy in a stage tied to an environment with approvals: trigger: branches: { include: [main] } pool: { vmImage: ubuntu-latest } stages: - stage: Build jobs: - job: build steps: - script: dotnet publish -c Release -o $(Build.ArtifactStagingDirectory) - publish: $(Build.ArtifactStagingDirectory) artifact: app - stage: Deploy jobs: - deployment: web environment: prod strategy: runOnce: deploy: steps: - task: AzureWebApp@1 inputs: azureSubscription: sc-shop-prod appName: app-shop-prod package: $(Pipeline.Workspace)/app

Grant id-token write permission and use a federated credential on the app registration, so no secret is stored: permissions: id-token: write contents: read jobs: deploy: runs-on: ubuntu-latest environment: prod steps: - uses: actions/checkout@v4 - uses: azure/login@v2 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - run: az group list -o table

Configure the azurerm backend and provider, then resources: terraform { backend "azurerm" { resource_group_name = "rg-tfstate" storage_account_name = "sttfstateprod" container_name = "state" key = "network.tfstate" use_azuread_auth = true } } provider "azurerm" { features {} } resource "azurerm_resource_group" "net" { name = "rg-net-prod" location = "centralindia" } resource "azurerm_virtual_network" "hub" { name = "vnet-hub" location = azurerm_resource_group.net.location resource_group_name = azurerm_resource_group.net.name address_space = ["10.0.0.0/16"] }

Use ACR Tasks to build in the cloud from your source folder: az acr build --registry acrshopprod \ --image shop-api:$(git rev-parse --short HEAD) . ACR Tasks can also rebuild automatically on a Git commit or when the base image is updated, which helps patch OS vulnerabilities without manual work.

Query the requests table, summarise duration and sort: requests | where timestamp > ago(1d) | summarize count(), avgDuration = avg(duration), p95 = percentile(duration, 95) by name | top 10 by p95 desc In a workspace-based resource, the table is AppRequests with TimeGenerated and DurationMs columns instead.

Use the AzureActivity table, filtering on successful delete operations: AzureActivity | where TimeGenerated > ago(7d) | where OperationNameValue endswith '/DELETE' | where ActivityStatusValue == 'Success' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, _ResourceId | order by TimeGenerated desc

Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights: Perf | where TimeGenerated > ago(1h) | where ObjectName == 'Processor' and CounterName == '% Processor Time' | where InstanceName == '_Total' | summarize avgCpu = avg(CounterValue) by Computer | where avgCpu > 80 | order by avgCpu desc

Unattached disks keep billing, so this is a common cost check: Resources | where type =~ 'microsoft.compute/disks' | where properties.diskState =~ 'Unattached' | project name, resourceGroup, subscriptionId, sku = sku.name, sizeGb = properties.diskSizeGB Run it with az graph query -q or in the Resource Graph Explorer.