Microsoft Azure Rapid-Fire Questions &amp; Answers

Show answer

A managed identity is an Entra ID identity that Azure creates and rotates for a resource, so code can get tokens without storing secrets. A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource you can attach to many resources and that survives their deletion. User-assigned is better when several apps share access or when you pre-create role assignments.

Explain Azure Backup and Azure Site Recovery.

Monitoring, Cost and GovernanceMedium

Show answer

Azure Backup protects data by taking scheduled backups of VMs, SQL and SAP HANA in VMs, Azure Files, blobs, disks and on-premises servers into Recovery Services or Backup vaults, with retention policies, soft delete and immutability. Azure Site Recovery replicates whole VMs continuously to another region or from on-premises to Azure for disaster recovery, with recovery plans for orchestrated failover. Backup is for restoring data; Site Recovery is for business continuity.

What is VNet peering and is it transitive?

Azure NetworkingMedium

Show answer

Peering connects two VNets over the Microsoft backbone with low latency, either in the same region or globally. Traffic stays private and is billed per GB. Peering is not transitive: if A peers with B and B peers with C, A cannot reach C. To route through a hub, use a network virtual appliance or Azure Firewall with user-defined routes, or use Azure Virtual WAN.

What are the main services in Azure DevOps?

DevOps and Infrastructure as CodeEasy

Show answer

Azure Boards tracks work items, sprints and backlogs. Azure Repos hosts Git repositories with branch policies. Azure Pipelines runs CI/CD on Microsoft-hosted or self-hosted agents. Azure Test Plans manages manual and exploratory testing. Azure Artifacts hosts NuGet, npm, Maven and Python feeds. Many Indian service companies still run client projects on Azure DevOps, while product companies often use GitHub Actions.

What is the difference between the activity log and resource logs?

Monitoring, Cost and GovernanceMedium

Show answer

The activity log records control-plane operations at subscription level, such as who created, updated or deleted a resource, and service health events. It is kept for 90 days unless exported. Resource logs record data-plane activity inside a resource, such as Key Vault secret reads or SQL audit events, and must be enabled with diagnostic settings to send them to Log Analytics, Storage or Event Hubs.

Explain the storage redundancy options LRS, ZRS, GRS and GZRS.

Show answer

LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.

What is Azure App Service and what does an App Service plan define?

Show answer

App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.

Name the Azure regions available in India.

Show answer

Microsoft runs Central India (Pune), South India (Chennai) and West India (Mumbai) as public regions, plus Jio India West and Jio India Central for specific customers. Central India supports availability zones. Indian companies pick these regions for low latency and for data residency needs such as RBI guidelines on payment data, often pairing Central India with South India for disaster recovery.

What is a Log Analytics workspace?

Show answer

A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.

What is Bicep and how does it relate to ARM templates?

DevOps and Infrastructure as CodeEasy

Show answer

Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.

What are Azure Advisor recommendations?

Show answer

Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.

What database services does Azure offer?

Azure DatabasesEasy

Show answer

Relational options are Azure SQL Database, Azure SQL Managed Instance, SQL Server on VMs, and Azure Database for PostgreSQL and MySQL flexible servers. Azure Cosmos DB is the globally distributed NoSQL and vector database. Azure Cache for Redis and Azure Managed Redis provide in-memory caching. For analytics there are Synapse, Fabric and Azure Data Explorer. Choose by data model, compatibility and how much operations you want to manage.

What is the what-if operation in Bicep deployments?

DevOps and Infrastructure as CodeMedium

Show answer

What-if previews the changes a deployment will make before applying it, showing resources to create, modify, delete or ignore and property-level differences. Run it in pull request pipelines so reviewers see the real impact of a template change. It has some noise for properties set by the platform, but it catches dangerous changes like deleting a subnet or replacing a database.

What is Microsoft Azure and which service models does it offer?

Show answer

Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.

What is Azure Firewall and how is it different from an NSG?

Azure NetworkingMedium

Show answer

Azure Firewall is a managed, stateful, centralised firewall with network and application rules, FQDN filtering, threat intelligence and, in the Premium SKU, TLS inspection and IDPS. NSGs are distributed basic filters on subnets and NICs. Typically NSGs control traffic within and between subnets, while Azure Firewall in a hub controls internet egress and cross-spoke traffic with central logging.

What is Azure Resource Manager (ARM)?

Show answer

ARM is the deployment and management layer of Azure. Every request from the portal, CLI, PowerShell, SDKs or Bicep goes through the ARM API, which authenticates the caller, checks RBAC and Policy, and forwards the call to the resource provider. Because all tools hit the same API, you get consistent results, tagging, locks and activity logs no matter how the change was made.

What are resource locks and when would you use them?

Show answer

Locks protect resources from accidental change. CanNotDelete allows reads and updates but blocks deletion; ReadOnly allows only reads, which can break operations like listing storage keys. Locks apply to a subscription, group or resource and are inherited. Teams put CanNotDelete on production resource groups, DNS zones and ExpressRoute circuits. Only Owner or User Access Administrator roles can remove locks by default.

What is a resource group and what rules apply to it?

Show answer

A resource group is a logical container for resources that share a lifecycle, for example everything for one app environment. A resource belongs to exactly one group, groups cannot be nested, and deleting a group deletes everything inside it. The group has a location that stores metadata, but resources inside can live in other regions. Resources can be moved between groups for most resource types.

What is Microsoft Sentinel?

Identity and SecurityMedium

Show answer

Sentinel is Microsoft's cloud-native SIEM and SOAR built on Log Analytics. It ingests logs through connectors from Entra ID, Defender, Azure activity, firewalls and third-party sources, runs analytics rules written in KQL to raise incidents, and uses playbooks built on Logic Apps to automate responses like disabling a user. Cost depends on data ingestion, so filter noisy logs and use basic or auxiliary log tiers.

What compute options does Azure offer and when do you choose each?

Show answer

Virtual Machines give full OS control for legacy or custom software. Virtual Machine Scale Sets add autoscaling of identical VMs. App Service hosts web apps and APIs as PaaS. Azure Functions runs event-driven code serverlessly. AKS runs Kubernetes for container microservices, and Container Apps runs containers without managing Kubernetes. Batch handles large parallel jobs. Choose based on control needed, scaling pattern and team skills.

What is an Azure Virtual Network (VNet)?

Azure NetworkingEasy

Show answer

A VNet is your private, isolated network in an Azure region, defined by one or more address spaces such as 10.10.0.0/16 and divided into subnets. Resources in a VNet communicate privately and Azure provides default routing between subnets and to the internet. VNets connect to each other with peering and to on-premises with VPN Gateway or ExpressRoute. Azure reserves five IP addresses in every subnet.

What is Azure Policy and how is it different from RBAC?

Show answer

RBAC controls who can do actions. Azure Policy controls what resources and settings are allowed, whoever deploys them. Policies use effects such as deny, audit, append, modify, deployIfNotExists and auditIfNotExists. For example, deny public IPs on VMs or deploy diagnostic settings automatically. Group policies into initiatives, assign them at management groups and view compliance on the dashboard.

What is the difference between an app registration and a service principal?

Identity and SecurityMedium

Show answer

An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.

What are RPO and RTO and how do they guide Azure designs?

Monitoring, Cost and GovernanceMedium

Show answer

RPO, recovery point objective, is the maximum acceptable data loss measured in time. RTO, recovery time objective, is how long recovery may take. A daily backup gives an RPO of up to 24 hours. Site Recovery gives an RPO of seconds to minutes and an RTO of minutes to hours. SQL failover groups give an RPO of seconds. Lower RPO and RTO cost more, so agree targets per application.

Explain Azure Functions hosting plans.

Azure ComputeMedium

Show answer

Flex Consumption is the recommended serverless plan: it scales to zero, bills per execution and memory, supports VNet integration and always-ready instances. The older Consumption plan scales to zero with a default 5-minute timeout. Premium keeps pre-warmed instances to avoid cold starts and supports long runs. Dedicated runs on an App Service plan. Container Apps hosting runs functions as containers. Choose by cold start tolerance, networking and run duration.

What is Azure Key Vault and what can it store?

Show answer

Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.

What are regions, region pairs and availability zones?

Show answer

A region is a set of datacenters in one geography, such as Central India in Pune. Availability zones are physically separate datacenter groups inside a region with independent power, cooling and network; supported regions have three. Many regions are paired with another region in the same geography for platform updates and geo-replication. Use zones for datacenter failure and a second region for regional disasters.

What is Azure Kubernetes Service (AKS) and what does Azure manage for you?

Azure ComputeMedium

Show answer

AKS is managed Kubernetes. Azure runs the control plane, including the API server and etcd, and handles upgrades and its availability. You manage node pools, which are VM scale sets, plus workloads, networking choices and add-ons. AKS integrates with Entra ID for cluster login, Azure CNI for pod networking, ACR for images, Key Vault via CSI driver and Azure Monitor Container Insights for logs and metrics.

What is Azure Data Lake Storage Gen2?

Azure StorageMedium

Show answer

ADLS Gen2 is a storage account with hierarchical namespace enabled, adding real directories, atomic renames and POSIX-style ACLs on top of Blob Storage. It is the storage layer for analytics engines such as Azure Databricks, Synapse and Microsoft Fabric. Directory operations become fast, which matters for Spark jobs. You keep Blob pricing and tiers but must plan ACLs and RBAC together.

What are the Blob Storage access tiers?

Show answer

Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.

What is the shared responsibility model in Azure?

Show answer

Security duties are split between Microsoft and the customer. Microsoft always owns physical datacenters, hosts and the network fabric. The customer always owns data, identities, accounts and devices. The middle layers move with the service model: in IaaS you patch the OS and configure firewalls; in PaaS Microsoft patches the OS and runtime; in SaaS you mainly manage users and data.

What is the difference between a VPN Gateway and ExpressRoute?

Azure NetworkingMedium

Show answer

A VPN Gateway creates encrypted IPsec tunnels over the public internet, for site-to-site or point-to-site connections, and is quick and cheap to set up. ExpressRoute is a private dedicated connection through a connectivity provider with predictable latency and bandwidth up to 100 Gbps, but it does not encrypt by default. Many companies use ExpressRoute as primary and a VPN as backup.

What is Azure Service Health?

Show answer

Service Health shows the health of Azure services in your regions: service issues happening now, planned maintenance, health advisories and security advisories, plus retirement notices. Resource Health shows if a specific resource, such as a VM, is available and why not. Set activity log alerts on Service Health so the team gets notified for incidents affecting their subscriptions and regions, instead of finding out from users.

What are deployment slots in App Service?

Azure ComputeMedium

Show answer

Slots are live copies of an app with their own hostname, available from the Standard tier. You deploy to a staging slot, warm it up and test, then swap it with production. The swap redirects traffic with near-zero downtime and can be reversed by swapping back. Slot-specific settings, such as a staging database connection string, stay with the slot instead of moving during the swap.

What is Azure Cosmos DB and which APIs does it support?

Azure DatabasesEasy

Show answer

Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.

Why would you use Azure Cache for Redis?

Azure DatabasesEasy

Show answer

Redis is an in-memory key-value store used for caching frequent database reads, storing user sessions, rate limiting, leaderboards and pub/sub. Caching a product catalogue can cut database load and bring latency from tens of milliseconds to around one. Use the cache-aside pattern with sensible TTLs. Microsoft now steers new deployments to Azure Managed Redis, which is based on Redis Enterprise.

What is the difference between CapEx and OpEx, and how does Azure change it?

Show answer

CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.

Explain the built-in roles Owner, Contributor, Reader and User Access Administrator.

Show answer

Owner has full access to resources and can assign roles to others. Contributor can create and manage all resources but cannot grant access or manage role assignments. Reader can only view resources. User Access Administrator can manage role assignments but not resources. Follow least privilege: most engineers need Contributor on their own resource groups and Reader elsewhere, with Owner held by very few people.

What is Azure Bastion?

Show answer

Azure Bastion is a managed PaaS service that gives RDP and SSH access to VMs through the browser or native client over TLS, without giving the VMs public IPs. It is deployed into a dedicated subnet named AzureBastionSubnet in the VNet. This removes exposed ports 3389 and 22 from the internet, a common attack path. Pair it with just-in-time access from Defender for Cloud for tighter control.

What is the difference between Entra ID roles and Azure RBAC roles?

Identity and SecurityMedium

Show answer

Entra ID roles, such as Global Administrator or User Administrator, control the directory: users, groups, app registrations and tenant settings. Azure RBAC roles, such as Owner, Contributor and Reader, control Azure resources at management group, subscription, resource group or resource scope. A Global Administrator has no resource access by default, though they can elevate themselves to User Access Administrator at root scope.

Explain the hierarchy of management groups, subscriptions, resource groups and resources.

Show answer

A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.

What is a Network Security Group (NSG)?

Azure NetworkingEasy

Show answer

An NSG is a stateful packet filter with allow and deny rules on source, destination, port and protocol, processed by priority from 100 to 4096, lower number first. It attaches to a subnet, a NIC or both, and both must allow the traffic. Default rules allow VNet-to-VNet and outbound internet traffic and deny other inbound traffic. Service tags and application security groups simplify rules.

What is Azure Monitor and what data does it collect?

Show answer

Azure Monitor is the unified monitoring platform for Azure and hybrid resources. It collects metrics, which are numeric time series stored for 93 days, and logs, which are records stored in Log Analytics workspaces and queried with KQL. Sources include platform metrics, activity logs, resource logs through diagnostic settings, VM guest data through the Azure Monitor Agent and app telemetry from Application Insights.

What is Azure Cost Management?

Show answer

Cost Management analyses and controls Azure spending. Cost analysis shows cost by service, resource group, tag or meter with forecasts. Budgets send alerts at thresholds such as 80% and 100% of actual or forecast spend and can trigger automation. Exports send daily cost data to Storage for reporting in Power BI. It also shows reservation utilisation and supports FinOps practices like showback and chargeback to teams.

What is Infrastructure as Code and why use it on Azure?

DevOps and Infrastructure as CodeEasy

Show answer

Infrastructure as Code defines resources in versioned files, such as Bicep, ARM JSON or Terraform, instead of clicking in the portal. It makes environments repeatable, reviewable through pull requests and quick to rebuild after failure. Drift between dev, test and prod drops because all are deployed from the same templates with different parameters. It also documents the setup and enables automated policy checks before deployment.

What services does an Azure Storage account provide?

Show answer

A general-purpose v2 storage account offers Blob Storage for objects, Azure Files for SMB and NFS file shares, Queue Storage for simple messaging and Table Storage for key-value NoSQL data. Data Lake Storage Gen2 is Blob Storage with hierarchical namespace enabled for analytics. Each account has a globally unique name that forms endpoints like name.blob.core.windows.net, and settings such as redundancy and network rules apply account-wide.

What are triggers and bindings in Azure Functions?

Show answer

A trigger is what starts a function, and each function has exactly one: HTTP, Timer, Blob, Queue, Service Bus, Event Grid, Event Hubs or Cosmos DB change feed. Bindings declaratively connect inputs and outputs, for example reading a blob and writing to a queue without writing SDK code. They reduce boilerplate, but for complex error handling or batching you may still use the SDK directly.

What is Microsoft Entra ID?

Show answer

Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.

What is a lifecycle management policy?

Show answer

A lifecycle policy is a rule set on a storage account that automatically moves or deletes blobs based on age, last access or last modified time. For example, move logs to Cool after 30 days, to Archive after 90 days and delete after 365 days. It runs once a day and removes the need for custom cleanup scripts, which saves real money on large log or backup containers.

What are Spot VMs and where should you use them?