USA
Canada
UK
Europe
Australia
Singapore
Japan
IndiaQ1. How do you design a highly available application on Azure?
Short answer: Use Availability Zones, load balancing, autoscale, and geo-redundant managed data services.
Strong answer: Spread compute across Availability Zones behind Azure Load Balancer/Application Gateway, use VM Scale Sets or AKS with autoscaling, and choose zone- or geo-redundant managed data (Azure SQL, Cosmos DB). Add Front Door/Traffic Manager for multi-region, and design for failure of any single zone. Define your RTO/RPO first.
Likely follow-up: How would you extend this to multi-region active-active?
What the interviewer is checking: Cloud reliability design.
Common mistake: Single-region, single-zone deployments called highly available.
Q2. Explain Azure AD (Entra ID) roles, RBAC and managed identities.
Short answer: Entra ID handles identity; RBAC grants scoped permissions; managed identities remove secrets.
Strong answer: Microsoft Entra ID (formerly Azure AD) is the identity provider. Azure RBAC assigns roles (Owner/Contributor/Reader/custom) scoped to management group, subscription, resource group or resource — least privilege. Managed identities give Azure resources an identity to call other services without storing credentials.
Likely follow-up: Why prefer a managed identity over a service principal secret?
What the interviewer is checking: Identity and security model.
Common mistake: Storing credentials in code instead of using managed identities.
Q3. When would you use App Service vs AKS vs Azure Functions?
Short answer: App Service for managed web apps, AKS for container orchestration, Functions for event-driven serverless.
Strong answer: App Service is a managed PaaS for web apps/APIs with easy scaling. AKS gives full Kubernetes for complex, portable, microservice workloads needing orchestration control. Functions are event-driven serverless for short, scalable tasks with consumption billing. Choose by control, workload shape and operational overhead.
Likely follow-up: What are the cold-start trade-offs of Functions?
What the interviewer is checking: Compute-selection judgment.
Common mistake: Using AKS for a simple web app that App Service would run cheaper.
Q4. Compare Azure SQL Database and Cosmos DB.
Short answer: Azure SQL is managed relational; Cosmos DB is globally-distributed multi-model NoSQL.
Strong answer: Azure SQL Database is a managed relational engine for structured, transactional data with SQL. Cosmos DB is a globally distributed, low-latency NoSQL service (multiple APIs) with tunable consistency and horizontal partitioning — great for global scale and flexible schemas. Choose by data shape, consistency needs and scale.
Likely follow-up: What are Cosmos DB’s consistency levels and their trade-offs?
What the interviewer is checking: Data-service selection.
Common mistake: Picking Cosmos DB for relational, join-heavy workloads.
Q5. How do you secure secrets and configuration in Azure?
Short answer: Azure Key Vault for secrets/keys/certs, accessed via managed identity; App Configuration for settings.
Strong answer: Store secrets, keys and certificates in Azure Key Vault and access them with a managed identity — never in code or plain config. Use Azure App Configuration for feature flags and settings, and enable Key Vault references in App Service/Functions. Scope access with RBAC and rotate secrets.
Likely follow-up: How does a Key Vault reference in App Service avoid storing the secret?
What the interviewer is checking: Secret-management practice.
Common mistake: Putting connection strings in appsettings committed to source.
Q6. What is Infrastructure as Code on Azure (Bicep/ARM/Terraform)?
Short answer: Declarative templates to provision Azure resources repeatably and reviewably.
Strong answer: Bicep (and underlying ARM) and Terraform declare Azure infrastructure as version-controlled code, enabling repeatable, reviewable deployments and drift detection. Bicep is Azure-native and concise; Terraform is multi-cloud. Use modules, parameterize environments, and deploy through CI/CD.
Likely follow-up: Bicep vs Terraform — when would you pick each?
What the interviewer is checking: IaC awareness on Azure.
Common mistake: Clicking resources in the portal with no IaC.
Q7. How do you monitor and troubleshoot Azure workloads?
Short answer: Azure Monitor, Application Insights, Log Analytics and alerts give metrics, logs and traces.
Strong answer: Azure Monitor collects metrics and logs; Application Insights adds APM (requests, dependencies, traces, exceptions); Log Analytics queries logs with KQL; and alerts/action groups notify on conditions. Together they turn "it is slow" into a root cause. Instrument apps and set actionable alerts tied to SLOs.
Likely follow-up: What language do you use to query Log Analytics?
What the interviewer is checking: Operability on Azure.
Common mistake: No instrumentation, debugging blind in production.