Azure Storage Interview Questions for Microsoft Azure
25 Azure Storage questions with answers for microsoft azure roles — 8 easy, 13 medium, 4 hard.
About Azure Storage
Understand storage accounts and their services: Blob, Files, Queues, Tables and Data Lake Gen2. Cover redundancy from LRS to GZRS, access tiers, lifecycle policies, SAS tokens, managed disks, soft delete and immutability. Practical work includes AzCopy, Python SDK access with managed identities and private endpoints, plus cost and ransomware protection scenarios.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What services does an Azure Storage account provide?
A general-purpose v2 storage account offers Blob Storage for objects, Azure Files for SMB and NFS file shares, Queue Storage for simple messaging and Table Storage for key-value NoSQL data. Data Lake Storage Gen2 is Blob Storage with hierarchical namespace enabled for analytics. Each account has a globally unique name that forms endpoints like name.blob.core.windows.net, and settings such as redundancy and network rules apply account-wide.
02
Explain the storage redundancy options LRS, ZRS, GRS and GZRS.
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.
04
Describe a time you had to choose between speed of delivery and data safety.
Situation: a release deadline pushed us to skip enabling backups and soft delete on a new storage account. Task: deliver on time without risking customer files. Action: I explained to the lead that enabling soft delete, versioning and a backup policy took under an hour through our Bicep module, and added it to the same pull request. Result: we shipped on time, and a month later versioning saved a file a user overwrote.
A lifecycle policy is a rule set on a storage account that automatically moves or deletes blobs based on age, last access or last modified time. For example, move logs to Cool after 30 days, to Archive after 90 days and delete after 365 days. It runs once a day and removes the need for custom cleanup scripts, which saves real money on large log or backup containers.
06
Upload a folder to Blob Storage with AzCopy using Entra ID login.
Log in with AzCopy and copy recursively; the user needs the Storage Blob Data Contributor role:
azcopy login --tenant-id <tenant-guid>
azcopy copy './reports' \
'https://stshopprod.blob.core.windows.net/reports' \
--recursive --overwrite ifSourceNewer
AzCopy runs transfers in parallel and can resume failed jobs with azcopy jobs resume.
07
Tell me about a time you reduced cloud storage cost.
Situation: our analytics team kept every raw file in the Hot tier with GRS, costing about 3 lakh rupees a month. Task: reduce cost without breaking reports. Action: I analysed access logs, moved files older than 60 days to Cool and older than a year to Archive with lifecycle rules, and switched scratch containers to LRS. Result: storage cost fell by around 45% with no complaints from users.
08
How do you explain a technical storage decision to a non-technical stakeholder?
Situation: finance asked why we needed GZRS instead of cheaper LRS. Task: justify the cost clearly. Action: I compared the options in business terms: LRS survives a disk failure, GZRS survives losing a whole region, and I showed the cost of downtime per hour for our app versus the extra monthly charge. Result: they approved GZRS only for critical data and LRS for the rest.
09
What is a Shared Access Signature (SAS) and what types exist?
A SAS is a signed URL token granting limited access to storage for a set time and permissions, such as read-only for one blob for one hour. A user delegation SAS is signed with Entra ID credentials and is the most secure. A service SAS and an account SAS are signed with the account key. Always use HTTPS, short expiry and stored access policies so tokens can be revoked.
Disable shared key access where possible and use Entra ID with RBAC roles like Storage Blob Data Reader. Use managed identities for apps. Disable public blob access, require TLS 1.2, restrict the firewall to selected VNets, or use private endpoints and disable public network access. Enable soft delete, versioning and Defender for Storage, and keep keys, if any, in Key Vault with rotation.
Managed disks are block storage volumes for VMs that Azure manages as resources, with built-in redundancy. Types are Standard HDD for backups and dev, Standard SSD for light workloads, Premium SSD for production, Premium SSD v2 with independently tunable IOPS and throughput, and Ultra Disk for very high IOPS and low latency such as SAP HANA. Disks can be LRS or ZRS for some types.
12
What is Azure Files and when would you use Azure File Sync?
Azure Files provides fully managed SMB and NFS shares that VMs and on-premises machines can mount, useful for lift-and-shift of apps expecting a file server. Azure File Sync installs an agent on Windows Servers to sync shares to Azure Files and use cloud tiering, keeping hot files locally and old files in the cloud. It helps branch offices share data without large local storage.
13
What are soft delete, versioning and immutable storage for blobs?
Soft delete keeps deleted blobs or containers for a retention period so you can restore them. Versioning saves the previous version automatically each time a blob is overwritten. Immutable storage applies time-based retention or legal hold policies in WORM mode, so nobody, not even an admin, can delete or change data until it expires. Regulated firms use immutability for audit records and ransomware protection.
ADLS Gen2 is a storage account with hierarchical namespace enabled, adding real directories, atomic renames and POSIX-style ACLs on top of Blob Storage. It is the storage layer for analytics engines such as Azure Databricks, Synapse and Microsoft Fabric. Directory operations become fast, which matters for Spark jobs. You keep Blob pricing and tiers but must plan ACLs and RBAC together.
15
An order system needs reliable, ordered messaging between services. Would you pick Queue Storage or Service Bus, and why?
Queue Storage is cheap and simple, holds millions of messages up to 64 KB each, and suits basic background work. Service Bus is an enterprise broker with queues and topics, FIFO through sessions, duplicate detection, dead-lettering, transactions and messages up to 100 MB on Premium. Choose Service Bus for ordered or business-critical messaging like orders and payments, and Storage queues for simple, high-volume job queues.
16
Write a lifecycle management rule to tier and delete log blobs.
DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored:
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient
url = 'https://stshopprod.blob.core.windows.net'
client = BlobServiceClient(url, credential=DefaultAzureCredential())
blob = client.get_blob_client('invoices', '2026/inv-1001.pdf')
data = blob.download_blob().readall()
print(len(data))
18
Generate a user delegation SAS for one blob with Azure CLI.
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity:
az storage blob generate-sas \
--account-name stshopprod --container-name invoices \
--name inv-1001.pdf --permissions r \
--expiry 2026-11-12T18:00Z --https-only \
--auth-mode login --as-user --full-uri
The caller needs a role that allows generating user delegation keys.
19
A developer accidentally overwrote important files in Blob Storage. How do you recover and prevent it?
If versioning was on, promote the previous version; if soft delete was on, undelete within the retention period. Point-in-time restore can roll back a whole container if enabled. If none were enabled, recovery may only be from backups. Going forward, enable versioning, soft delete and Azure Backup for blobs, give developers read-only roles in production and route writes only through the application identity.
20
Your storage costs are growing fast because of old logs. What do you do?
Use Storage insights and Cost Analysis to find which containers and tiers drive cost. Enable last access tracking and apply lifecycle rules that move logs to Cool, then Cold or Archive, and delete after the retention period required by policy. Check for unnecessary GRS replication on non-critical data and leftover snapshots. Compress logs before upload and stop verbose logging at the source.
21
An application on a VM must access a storage account without any keys. How do you set it up?
Enable a system-assigned or user-assigned managed identity on the VM. Assign the identity the least role needed, such as Storage Blob Data Reader on the specific container. In code, use DefaultAzureCredential or ManagedIdentityCredential from the Azure SDK. Then disable shared key access on the account. The token is fetched from the local metadata endpoint and rotated automatically by Azure.
22
How do you create a private endpoint for a storage account?
Create the private endpoint in the app subnet for the blob sub-resource, link the private DNS zone privatelink.blob.core.windows.net to the VNet, and disable public network access on the account:
az network private-endpoint create -g rg-net -n pe-st-blob \
--vnet-name vnet-hub --subnet snet-pe \
--private-connection-resource-id <storage-id> \
--group-id blob --connection-name st-blob
Then test that the name resolves to a 10.x address.
23
How would you protect storage accounts against ransomware?
Combine prevention and recovery. Use private endpoints, disable shared keys and public access, and restrict RBAC with PIM. Enable soft delete, versioning, change feed and point-in-time restore. For critical data, use immutable storage policies or vaulted Azure Backup with immutability and multi-user authorization so attackers cannot delete backups. Turn on Defender for Storage to detect malware uploads and unusual access.
24
How do you migrate 200 TB of on-premises data to Azure when the internet link is slow?
Calculate transfer time first: 200 TB over a 1 Gbps link at 70% efficiency takes almost a month. Use Azure Data Box devices shipped to your site, copy data locally and send them back for upload into the storage account. Then run AzCopy or Azure File Sync to sync the changes made after shipping. For ongoing large flows, consider ExpressRoute.
25
Design storage for an app storing user documents that must stay in India for 7 years.
Use a storage account in Central India with ZRS, or GZRS paired with South India which keeps data inside India. Apply time-based immutability for seven years on the archive container and lifecycle rules to move older files to Cool and Archive tiers. Encrypt with customer-managed keys in Key Vault if compliance asks, use private endpoints, and log access to Log Analytics for audits.
Frequently asked questions
How important is Azure Storage in Microsoft Azure interviews?
Understand storage accounts and their services: Blob, Files, Queues, Tables and Data Lake Gen2. Cover redundancy from LRS to GZRS, access tiers, lifecycle policies, SAS tokens, managed disks, soft delete and immutability. Practical work includes AzCopy, Python SDK access with managed identities and private endpoints, plus cost and ransomware protection scenarios.
How should I use the Azure Storage sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.