Skip to main content

Top 50 Azure Interview Questions for Cloud Engineers

· 13 min read
Goel Academy
Goel Academy
DevOps & Cloud Learning Hub

Interviews for cloud engineering roles have shifted from "what is a virtual machine" to "design a multi-region disaster recovery architecture with sub-15-second RTO." This post covers 50 questions across three difficulty levels with concise answers and key CLI commands. Whether you are preparing for your first cloud role or aiming for a senior architect position, these questions reflect what real hiring managers actually ask.

Beginner (Questions 1-15)​

Q1. What is Azure Resource Manager (ARM)? ARM is the deployment and management layer for Azure. Every API call — portal, CLI, SDK, Terraform — goes through ARM. It provides consistent resource management, RBAC, tagging, and template-based deployments.

Q2. What are Azure Regions and Availability Zones? A region is a set of data centers within a latency-defined perimeter. An Availability Zone is a physically separate data center within a region with independent power, cooling, and networking. Azure has 60+ regions, and most major regions have 3 AZs.

Q3. What is the difference between a Subscription, Resource Group, and Resource? A Subscription is a billing boundary and access control boundary. A Resource Group is a logical container that holds related resources. A Resource is an individual service instance (VM, database, storage account). Hierarchy: Management Group > Subscription > Resource Group > Resource.

Q4. How does Azure Entra ID differ from on-premises Active Directory? Azure Entra ID (formerly Azure AD) is an identity-as-a-service platform using REST APIs and OAuth/OIDC protocols. On-premises AD uses LDAP and Kerberos. Entra ID does not use OUs, GPOs, or forests. It provides SSO for SaaS apps, Conditional Access, and MFA natively.

Q5. What are the four Azure Storage services? Blob Storage (unstructured objects), File Storage (SMB/NFS file shares), Queue Storage (messaging), and Table Storage (NoSQL key-value). Each is accessible via REST API and SDKs.

# Create a storage account with all four services
az storage account create \
  --name stgoelacademy \
  --resource-group rg-storage \
  --sku Standard_ZRS \
  --kind StorageV2 \
  --access-tier Hot

Q6. What are Blob access tiers and when do you use each? Hot (frequent access, highest storage cost, lowest access cost), Cool (infrequent access, 30-day minimum), Cold (rare access, 90-day minimum), and Archive (offline, 180-day minimum, hours to rehydrate). Use lifecycle policies to auto-tier.

Q7. What is a Virtual Network (VNet)? A VNet is an isolated network in Azure. Resources within a VNet communicate privately. VNets are scoped to a single region. You connect VNets using peering (same/cross-region) or VPN/ExpressRoute (to on-premises).

Q8. What is a Network Security Group (NSG)? An NSG contains security rules that allow or deny inbound/outbound network traffic. Rules are evaluated by priority (100-4096, lower = higher priority). NSGs can be associated with subnets or individual NICs.

Q9. What is Azure App Service? A fully managed PaaS for hosting web apps, REST APIs, and mobile backends. It supports .NET, Java, Node.js, Python, PHP, and custom containers. Features include auto-scaling, deployment slots, custom domains, and SSL.

Q10. What are Managed Disks in Azure? Managed Disks abstract the storage account management for VM disks. Azure handles replication and availability. Types: Standard HDD, Standard SSD, Premium SSD, Premium SSD v2, and Ultra Disk.

Q11. What is Azure Key Vault? A cloud service for securely storing and accessing secrets (API keys, passwords), cryptographic keys, and certificates. Access is controlled via RBAC or Key Vault access policies.

# Store and retrieve a secret
az keyvault secret set --vault-name kv-prod --name "DbPassword" --value "S3cur3P@ss!"
az keyvault secret show --vault-name kv-prod --name "DbPassword" --query "value" -o tsv

Q12. What is the Azure CLI vs Azure PowerShell? Both are command-line tools for managing Azure resources. Azure CLI (az) is cross-platform and Bash-friendly. Azure PowerShell (Az module) is object-oriented and integrates with the PowerShell ecosystem. Both call the same ARM APIs.

Q13. What is an Azure Load Balancer? A Layer 4 (TCP/UDP) load balancer that distributes traffic across VMs. Two SKUs: Basic (free, limited) and Standard (zone-redundant, SLA-backed). For HTTP/HTTPS routing (Layer 7), use Application Gateway instead.

Q14. What is a Scale Set (VMSS)? A group of identical VMs that can auto-scale based on metrics (CPU, memory, custom). VMSS supports rolling updates, automatic OS patching, and integration with Azure Load Balancer.

Q15. What is Azure DNS? A hosting service for DNS domains. It supports public DNS zones (internet-facing) and private DNS zones (VNet-internal resolution). Does not provide domain registration — register elsewhere, point nameservers to Azure DNS.

Intermediate (Questions 16-35)​

Q16. How does Azure Kubernetes Service (AKS) work? AKS provides a managed Kubernetes control plane (free). You pay only for worker nodes. AKS handles API server management, etcd backups, version upgrades, and certificate rotation. You manage node pools, networking, and workloads.

# Create a production AKS cluster
az aks create \
  --name aks-prod \
  --resource-group rg-aks \
  --node-count 3 \
  --node-vm-size Standard_D4s_v5 \
  --enable-managed-identity \
  --network-plugin azure \
  --generate-ssh-keys

Q17. What are Azure Functions triggers and bindings? Triggers start a function (HTTP request, timer, queue message, blob upload). Bindings connect the function to other resources without boilerplate code. Input bindings read data, output bindings write data.

Q18. What is the difference between Azure DevOps and GitHub Actions? Azure DevOps is a full ALM suite (Repos, Boards, Pipelines, Artifacts, Test Plans). GitHub Actions is a CI/CD automation platform within GitHub. Both can deploy to Azure. Use Azure DevOps for enterprise ALM; GitHub Actions for open-source or GitHub-centric teams.

Q19. How do you configure a CI/CD pipeline in Azure DevOps? Define a YAML pipeline with trigger, pool, stages, jobs, and steps. Use Service Connections for Azure authentication. Key stages: Build (compile, test, package), Deploy (to App Service, AKS, or VMs using deployment tasks).

Q20. What is Azure Monitor? A comprehensive monitoring platform that collects metrics (numeric time-series), logs (structured text), and traces (distributed requests). Components: Metrics Explorer, Log Analytics (KQL queries), Alerts, Dashboards, Workbooks, and Application Insights.

Q21. What is a Log Analytics Workspace? The central repository for Azure Monitor Logs. Resources send diagnostic logs and metrics here via Diagnostic Settings. Query data using Kusto Query Language (KQL).

# Query for VM CPU > 90% in the last hour
az monitor log-analytics query \
  --workspace <workspace-id> \
  --analytics-query "Perf | where ObjectName == 'Processor' and CounterName == '% Processor Time' and CounterValue > 90 | where TimeGenerated > ago(1h) | project Computer, CounterValue, TimeGenerated"

Q22. What is Application Insights? An APM service within Azure Monitor for live web applications. It tracks request rates, response times, failure rates, dependency calls, exceptions, page views, and custom events. Supports .NET, Java, Node.js, Python, and JavaScript.

Q23. What is Azure Cosmos DB? A globally distributed, multi-model NoSQL database. Supports five APIs: NoSQL (document), MongoDB, Cassandra, Gremlin (graph), and Table. Provides single-digit millisecond latency and five consistency levels (Strong, Bounded Staleness, Session, Consistent Prefix, Eventual).

Q24. What are Azure SQL deployment options? Single Database (isolated, per-database scaling), Elastic Pool (shared resources for multiple databases), and SQL Managed Instance (full SQL Server instance with near 100% compatibility). Each offers different trade-offs of compatibility, cost, and management overhead.

Q25. What is Azure Policy? A governance service that enforces organizational standards. Policies evaluate resource properties during creation and updates. Effects: Audit, Deny, DeployIfNotExists, Modify, Append. Assign policies at management group, subscription, or resource group scope.

Q26. How does RBAC work in Azure? Azure RBAC uses role assignments: a security principal (user/group/service principal) + a role definition (set of permissions) + a scope (management group/subscription/resource group/resource). Built-in roles: Owner, Contributor, Reader, plus 100+ service-specific roles.

Q27. What is Azure Front Door? A global Layer 7 load balancer with CDN, SSL offloading, WAF, and URL-based routing. Routes users to the closest healthy backend. Supports A/B testing with weighted routing, session affinity, and automatic failover.

Q28. What are Deployment Slots in App Service? Separate instances of your app (staging, QA, canary) that can be swapped with production with zero downtime. Each slot has its own URL, configuration, and scale settings. Swap operations re-route traffic instantly without cold starts.

Q29. What is Azure Container Registry (ACR)? A managed Docker registry for storing and managing container images. Tiers: Basic, Standard, Premium (geo-replication, private endpoints). Integrates with AKS, App Service, and Azure DevOps for automated build and deployment.

Q30. What is Microsoft Defender for Cloud? A Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP). It provides Secure Score, security recommendations, threat detection, vulnerability assessment, and compliance dashboards for Azure, AWS, GCP, and on-premises.

Q31. What is Azure Bastion? A PaaS service for secure RDP/SSH access to VMs directly from the Azure portal over SSL. Eliminates the need for public IPs on VMs or VPN connections. Deployed to a dedicated subnet (AzureBastionSubnet) in the VNet.

Q32. What is the difference between Service Endpoint and Private Endpoint? A Service Endpoint extends the VNet identity to an Azure service over the Azure backbone (traffic stays on Microsoft network, but the service still has a public IP). A Private Endpoint assigns a private IP from your VNet to the service, making it truly private.

Q33. What is Azure Service Bus? An enterprise messaging service supporting queues (point-to-point) and topics (publish-subscribe). Features: FIFO ordering, duplicate detection, dead-lettering, sessions, and transactions. Use it for decoupling microservices.

Q34. How do you manage secrets in Azure DevOps pipelines? Use Variable Groups linked to Azure Key Vault. Secrets are fetched at pipeline runtime and masked in logs. Alternatively, use pipeline-level secret variables (marked as secret, never displayed in logs).

Q35. What is Azure Traffic Manager? A DNS-based traffic routing service. Routing methods: Priority (failover), Weighted (A/B testing), Performance (lowest latency), Geographic (compliance), MultiValue (multiple healthy endpoints), Subnet (client IP-based). Operates at the DNS layer, not data path.

Advanced (Questions 36-50)​

Q36. Design a multi-region active-active architecture on Azure. Deploy to two regions. Use Azure Front Door for global routing with equal weights. Each region has its own AKS cluster or App Service with independent databases. Use Cosmos DB with multi-region writes for global data consistency. Implement health probes that fail over automatically. Store session state in Redis or Cosmos DB, never on the local server.

Q37. How do you achieve RPO < 1 minute and RTO < 15 minutes? Use Azure Site Recovery for VMs (continuous replication). For databases, use Azure SQL auto-failover groups (synchronous replication, automatic failover). For AKS, maintain a standby cluster with GitOps. Use Azure Front Door for instant traffic rerouting. Test with regular DR drills.

Q38. What is the Azure Well-Architected Framework? Five pillars: Reliability (resiliency, disaster recovery), Security (identity, data protection), Cost Optimization (right-sizing, reserved instances), Operational Excellence (monitoring, automation), and Performance Efficiency (scaling, caching). Use the Well-Architected Review tool to assess your workloads.

Q39. How do you implement Zero Trust networking in Azure? Remove default trust: deny all inbound by default with NSGs. Use Private Endpoints for all PaaS services. Implement micro-segmentation with Application Security Groups. Require Conditional Access for all identity authentication. Enable Just-In-Time VM access. Encrypt all traffic in transit with TLS 1.2+.

# Enable JIT VM access
az security jit-policy create \
  --resource-group rg-prod \
  --location eastus \
  --name "default" \
  --virtual-machines '[{"id":"/subscriptions/<sub>/resourceGroups/rg-prod/providers/Microsoft.Compute/virtualMachines/vm-prod-01","ports":[{"number":22,"protocol":"TCP","allowedSourceAddressPrefix":"*","maxRequestAccessDuration":"PT3H"}]}]'

Q40. How do you design a landing zone for a regulated industry (healthcare, finance)? Start with the Enterprise-Scale reference architecture. Add: HIPAA/PCI-DSS compliance policy initiatives, encryption at rest and in transit enforced via Policy, Private Endpoints for all data services, network isolation with hub-spoke + Azure Firewall, centralized logging in Sentinel, DDoS Protection Standard, customer-managed keys for Key Vault and Storage.

Q41. What is the difference between Azure Policy and RBAC? RBAC controls WHO can do WHAT (user permissions on resources). Policy controls WHAT resources can BE (resource configurations regardless of who deploys them). A Contributor can create a VM, but Policy can deny VMs in unapproved regions or without required tags.

Q42. How do you manage Terraform state for multiple teams? Use separate state files per team/environment stored in Azure Storage with state locking (blob leases). Structure: one state per subscription or per application. Use Terraform workspaces for environment separation. Implement strict RBAC on the storage account.

Q43. How do Azure Availability Zones differ from Availability Sets? Availability Zones are physically separate data centers within a region (protection from data center failure). Availability Sets are logical groupings within a single data center using fault domains and update domains (protection from hardware failure and maintenance). Zones provide stronger isolation.

Q44. How would you migrate a 10TB on-premises SQL Server to Azure? Assess with Azure Migrate and Database Migration Assistant. For minimal downtime: use Azure Database Migration Service in online mode (continuous replication). For the cutover: stop writes to source, wait for final sync, switch connection strings. Alternatives: backup/restore to Azure Blob + restore to Azure SQL MI for larger databases.

Q45. How do you optimize Azure costs for a large organization? Implement Azure Reservations (1-year or 3-year) for predictable workloads (40-72% savings). Use Spot VMs for interruptible batch jobs (up to 90% savings). Right-size VMs using Azure Advisor recommendations. Set budget alerts per subscription. Use auto-scaling to match demand. Shut down dev/test environments outside business hours. Tag all resources for cost attribution.

# Find underutilized VMs
az advisor recommendation list \
  --filter "Category eq 'Cost'" \
  --query "[?shortDescription.solution=='Right-size or shutdown underutilized virtual machines'].{VM:resourceMetadata.resourceId, Savings:extendedProperties.savingsAmount}"

Q46. What is Azure Service Mesh (Istio on AKS)? An add-on that provides mTLS encryption, traffic management (canary releases, circuit breaking), and observability (distributed tracing) between microservices without code changes. AKS natively supports the Istio-based service mesh add-on.

Q47. How do you implement GitOps on AKS? Use the Flux v2 extension for AKS. Flux monitors a Git repository and reconciles the cluster state with the declared manifests. Changes are made via pull requests, not kubectl. Combine with Azure Policy for Kubernetes to enforce pod security standards.

Q48. What is Azure Chaos Studio? A managed chaos engineering service. Define experiments that inject faults (VM shutdown, network latency, DNS failure, AKS pod kill) into your environment. Run experiments against staging first, then production. Validate that your resilience mechanisms work as designed.

Q49. How do you secure an AKS cluster end-to-end? Use private clusters (private API server endpoint). Enable Microsoft Entra ID integration for authentication. Use Azure RBAC for Kubernetes authorization. Scan images with Defender for Containers. Enforce Pod Security Standards with Azure Policy. Use network policies (Calico/Azure CNI) for pod-to-pod traffic control. Enable Key Vault Secrets Provider for secret injection.

Q50. Design a cost-optimized data pipeline on Azure. Ingest with Event Hubs (streaming) or ADF (batch). Process with Azure Databricks (Spot instances for worker nodes) or Synapse Serverless (pay-per-query). Store raw in ADLS Gen2 (Cool tier for historical data). Serve aggregations from Azure SQL or Cosmos DB. Orchestrate with ADF pipelines on triggers, not schedules. Monitor with Log Analytics and set cost alerts.

These 50 questions cover the breadth of what Azure cloud engineering interviews look like today. Use them as a study checklist — if you can explain each answer confidently and demonstrate the CLI commands from memory, you are well-prepared for any level of Azure role.