DevOps and Infrastructure as Code Interview Questions for Microsoft Azure

Show answer

Infrastructure as Code defines resources in versioned files, such as Bicep, ARM JSON or Terraform, instead of clicking in the portal. It makes environments repeatable, reviewable through pull requests and quick to rebuild after failure. Drift between dev, test and prod drops because all are deployed from the same templates with different parameters. It also documents the setup and enables automated policy checks before deployment.

What is Bicep and how does it relate to ARM templates?

Show answer

Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.

What are the main services in Azure DevOps?

Show answer

Azure Boards tracks work items, sprints and backlogs. Azure Repos hosts Git repositories with branch policies. Azure Pipelines runs CI/CD on Microsoft-hosted or self-hosted agents. Azure Test Plans manages manual and exploratory testing. Azure Artifacts hosts NuGet, npm, Maven and Python feeds. Many Indian service companies still run client projects on Azure DevOps, while product companies often use GitHub Actions.

Deploy a Bicep file and preview changes with Azure CLI.

Show answer

Run what-if first, then deploy with a parameters file: az deployment group what-if \ --resource-group rg-shop-dev \ --template-file main.bicep \ --parameters main.dev.bicepparam az deployment group create \ --resource-group rg-shop-dev \ --template-file main.bicep \ --parameters main.dev.bicepparam Use az deployment sub create for subscription-scope templates.

How do you build and push a container image to ACR without Docker installed?

Show answer

Use ACR Tasks to build in the cloud from your source folder: az acr build --registry acrshopprod \ --image shop-api:$(git rev-parse --short HEAD) . ACR Tasks can also rebuild automatically on a Git commit or when the base image is updated, which helps patch OS vulnerabilities without manual work.

Tell me about a time you automated a manual process.

Show answer

Situation: our team created test environments by hand, taking two days each. Task: make it self-service. Action: I wrote Bicep modules for the app, database and networking and a pipeline with parameters for environment name, plus an auto-delete tag cleaned up nightly by an Automation runbook. Result: environments took 20 minutes, and idle test cost dropped by about 30%.

Your company is choosing between Bicep and Terraform for its Azure estate. What would you recommend?

Show answer

Bicep is Azure-only, needs no state file, supports new resource features immediately and has native what-if previews. Terraform works across many clouds and SaaS providers, has a huge module ecosystem, and keeps a state file that must be stored securely, for example in a Blob Storage backend with locking. Choose Bicep for Azure-only teams and Terraform for multi-cloud or existing Terraform skills.

What are ARM deployment modes and scopes?

Show answer

Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.

What is a service connection in Azure Pipelines?

Show answer

A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.

Explain stages, jobs, steps and environments in YAML pipelines.

Show answer

A pipeline has stages, such as Build, Test and DeployProd, that run in sequence or parallel. Each stage has jobs, which run on one agent, and each job has steps, which are tasks or scripts. Deployment jobs target environments, which can have approvals, checks, business hours and deployment history. Templates let teams reuse stages and jobs across many repositories.

What deployment strategies can you use for Azure apps?

Show answer

Rolling updates replace instances in batches, used by VMSS and Kubernetes. Blue-green runs two environments and switches traffic, as with App Service slots. Canary sends a small percentage of traffic to the new version first, using slot traffic routing, Front Door weights or Container Apps revisions. Feature flags in App Configuration let you deploy code dark and enable features gradually without redeploying.

What is the what-if operation in Bicep deployments?

Show answer

What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.

Write a Bicep file that creates a storage account with parameters.

Show answer

Parameters keep the template reusable across environments: param location string = resourceGroup().location @minLength(3) @maxLength(24) param name string @allowed(['Standard_LRS', 'Standard_ZRS']) param sku string = 'Standard_ZRS' resource st 'Microsoft.Storage/storageAccounts@2023-05-01' = { name: name location: location sku: { name: sku } kind: 'StorageV2' properties: { minimumTlsVersion: 'TLS1_2' allowBlobPublicAccess: false supportsHttpsTrafficOnly: true } } output blobEndpoint string = st.properties.primaryEndpoints.blob

Write a GitHub Actions job that logs in to Azure with OIDC.

Show answer

Grant id-token write permission and use a federated credential on the app registration, so no secret is stored: permissions: id-token: write contents: read jobs: deploy: runs-on: ubuntu-latest environment: prod steps: - uses: actions/checkout@v4 - uses: azure/login@v2 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - run: az group list -o table

Write a basic Terraform configuration for a resource group and VNet with remote state.

Show answer

Configure the azurerm backend and provider, then resources: terraform { backend "azurerm" { resource_group_name = "rg-tfstate" storage_account_name = "sttfstateprod" container_name = "state" key = "network.tfstate" use_azuread_auth = true } } provider "azurerm" { features {} } resource "azurerm_resource_group" "net" { name = "rg-net-prod" location = "centralindia" } resource "azurerm_virtual_network" "hub" { name = "vnet-hub" location = azurerm_resource_group.net.location resource_group_name = azurerm_resource_group.net.name address_space = ["10.0.0.0/16"] }

Your pipeline takes 40 minutes. How do you speed it up?

Show answer

Profile which stages are slow. Cache dependencies like NuGet or npm packages, run unit tests and linting in parallel jobs, and split slow integration tests to run only on main or nightly. Use self-hosted or Managed DevOps Pools agents with warm caches for big builds, build container images with layer caching, and deploy only changed services in a monorepo using path filters.

How do you handle a failed release that affected customers?

Show answer

Situation: a release broke login for some mobile users on a Friday evening. Task: restore service fast and prevent repeats. Action: I swapped the App Service slot back to the previous version within ten minutes, informed support, then reproduced the bug in staging and found a missing config value. Result: we added config validation and smoke tests on login to the pipeline, and wrote a blameless postmortem.

How do you mentor juniors on DevOps practices?

Show answer

Situation: three freshers joined my team without pipeline experience. Task: make them productive in a month. Action: I created a small sample repo with a Bicep template and YAML pipeline, paired with each one on their first pull request, set review checklists and let them own one non-production pipeline each. Result: within five weeks all three were shipping changes independently and one improved our caching.

How do you manage Terraform state securely on Azure?

Show answer

Store state in an Azure Storage backend with a dedicated container per environment. Blob leases provide state locking so two runs cannot write at once. Use Entra ID authentication instead of access keys, enable versioning and soft delete to recover from corruption, restrict access to the pipeline identity, and use private endpoints. Never commit state files, because they can contain secrets in plain text.

What is GitOps and how is it used with AKS?

Show answer

GitOps treats a Git repository as the single source of truth for cluster configuration. An agent in the cluster, such as Flux, which AKS offers as a managed extension, or Argo CD, pulls manifests from Git and reconciles the cluster to match. Changes happen only through pull requests, which gives audit history and easy rollback by reverting commits. It also removes the need to give pipelines cluster admin credentials.

Write an Azure Pipelines YAML that builds a .NET app and deploys it to App Service.

Show answer

Build and publish an artifact, then deploy in a stage tied to an environment with approvals: trigger: branches: { include: [main] } pool: { vmImage: ubuntu-latest } stages: - stage: Build jobs: - job: build steps: - script: dotnet publish -c Release -o $(Build.ArtifactStagingDirectory) - publish: $(Build.ArtifactStagingDirectory) artifact: app - stage: Deploy jobs: - deployment: web environment: prod strategy: runOnce: deploy: steps: - task: AzureWebApp@1 inputs: azureSubscription: sc-shop-prod appName: app-shop-prod package: $(Pipeline.Workspace)/app

Someone changed production resources manually in the portal. How do you detect and handle drift?

Show answer

Detect drift by running Bicep what-if or terraform plan on a schedule and failing the run on unexpected differences, and by alerting on activity log write events from users rather than pipeline identities. Decide whether the manual change was a valid hotfix; if so, add it to code, otherwise redeploy to restore. Then reduce write access in production to the pipeline identity plus PIM break-glass.

How do you manage secrets and configuration for many environments in pipelines?

Show answer

Keep non-secret settings in parameter files or Azure App Configuration per environment. Keep secrets in Key Vault per environment and let apps read them via managed identity or Key Vault references, so pipelines rarely handle them. When pipelines need secrets, link variable groups to Key Vault and use environment approvals. Never echo secrets in logs and prefer federated identities over stored credentials.

A deployment to production failed halfway. How do you design pipelines to handle this?

Show answer

Make deployments idempotent so rerunning the same template converges to the right state. Use slot swaps or blue-green so the old version keeps serving until the new one passes health checks, and roll back by swapping back. Keep database migrations backward compatible, using expand and contract, so the old code still works. Add smoke tests and automatic rollback, and alert the team with logs.

How would you structure IaC repositories for a platform team supporting 30 app teams?