Azure Interview Questions and Answers for 2026

Answer: A resource group is a logical container for resources that share one lifecycle: deployed together, deleted together, governed together. Every resource lives in exactly one group, and every group lives in exactly one subscription, which is the billing, quota, and payment boundary above it. The consequence interviewers want named: deleting the group deletes everything inside it, which is why environments get isolated per group. That containment logic opens many beginner Azure interview questions.

Answer: The Entra ID tenant trusts subscriptions; subscriptions roll up into management groups; resource groups live inside subscriptions; resources live inside groups. Role assignments and Azure Policy assignments inherit down that chain, so a policy pinned at a management group reaches every subscription beneath it. Confusing the tenant with the subscription is the classic beginner mistake, which is why Azure interview questions return to this ladder constantly.

Answer: A region is a geographic deployment with its own datacenters, capacity, and pricing. An availability zone is a physically separate cluster of datacenters inside one region, with independent power, cooling, and networking, three of them per enabled region. Zonal resources pin to one zone; zone-redundant resources spread across all three. The consequence worth stating: a zone outage removes pinned VMs but leaves zone-redundant storage and load balancers serving.

Answer: A legacy grouping that spreads VMs across fault domains, which are separate power and network racks, and up to 20 update domains, so planned host maintenance and rack failures never hit everything at once. It protects only within a single datacenter; availability zones are the stronger, newer answer. Interviewers still ask it because plenty of real fleets predate zone support, and knowing when each applies is a reliable confidence check in Azure interview questions.

Answer: Stop from inside the guest, or the portal’s stop without deallocation, halts the OS but keeps the VM allocated to a host, so compute keeps billing. Deallocate releases the hardware and stops compute charges, while disks, NICs, and static IPs keep billing. Two gotchas to volunteer: a deallocated VM with a dynamic public IP loses it, and the next start lands on different hardware. Billing half-awareness is exactly what this entry in Azure interview questions tests.

Answer: A scale set manages a group of VMs as one unit: one configuration model, N instances, autoscale rules, rolling upgrades, and placement across zones or fault domains. Hand-built VMs drift apart; scale set instances stay aligned to the model, and capacity becomes a number you change instead of twenty portal clicks. Expect follow-up Azure interview questions on orchestration modes and autoscale behavior, because this single answer opens both.

Answer: Blob Storage is object storage reached over HTTPS REST, for unstructured data like images, backups, and data-lake files. Azure Files exposes managed SMB and NFS shares that many clients mount at once, the lift-and-shift file server answer. Managed disks are block devices attached to individual VMs, for OS volumes and random-I/O workloads. Pick by access pattern: many-client file semantics means Files, app objects mean blob, single-VM block device means disk.

Answer: Hot for frequently read data, Cool for roughly monthly access, Cold for quarterly, and Archive for compliance copies that may sit untouched for 180 days or more. Archive is offline: reading it requires rehydration, which takes hours at standard priority. The invoice detail worth naming early: each cooler tier carries an early-deletion minimum, 30 days for Cool, 90 for Cold, 180 for Archive. Tier economics appear in Azure interview questions from beginner to senior level.

Answer: A VNet is your private, region-scoped IP network in Azure, an address space you carve into subnets where resources receive private IPs. Subnets are the boundary where NSGs and route tables attach, and they segment workloads, tiers, and environments inside one VNet. Azure reserves five addresses per subnet, worth mentioning when someone’s /29 keeps failing. Peering connects VNets privately. This is the geometry half of every networking block in Azure interview questions.

Answer: A stateful layer 3 and 4 packet filter attached to a subnet, a NIC, or both. Rules carry priorities from 100 to 4096, allow or deny actions, and match on source and destination IP, port, and protocol, with service tags like Internet and VirtualNetwork standing in for address lists. Being stateful means replies to allowed flows return without extra rules. Azure interview questions probe the default rules next: inbound from the internet is denied unless you open it.

Answer: Private IPs come from the subnet’s CIDR range and route only inside the VNet and peered networks. Public IPs attach to NICs, load balancers, or gateways for internet-facing traffic, and Standard public IPs are static by default, while the legacy Basic SKU allowed dynamic assignment that changed on deallocation. The detail that earns credit: outbound internet from a private-only VM needs a load balancer, NAT gateway, or public IP somewhere in the path.

Answer: The cloud identity and access service, renamed from Azure AD. It holds users, groups, app registrations, and enterprise applications, enforces conditional access, and issues the tokens every Azure, Microsoft 365, and integrated SaaS workload presents. It is not a drop-in domain controller, though Entra Connect synchronizes with on-premises Active Directory for hybrid setups. Naming the rename correctly signals current knowledge, a small but real edge in Azure interview questions.

Answer: The authorization system for Azure resources: a role is a set of permitted actions, and a role assignment binds a role to an identity at a scope. The three to name cold are Reader, view only; Contributor, manage everything except access; Owner, manage including access. Add User Access Administrator as the role that grants access without full control. Azure interview questions use Contributor-versus-Owner to check you know access management is its own privilege.

Answer: Azure RBAC governs Azure resources: subscriptions, resource groups, VMs, storage. Entra ID directory roles, Global Administrator, Application Administrator, User Administrator, govern the tenant’s directory objects through Microsoft Graph. A Global Administrator has zero subscription access by default and must run an explicit elevation to gain it. Mixing these two planes is the single most common identity failure in Azure interview questions, so separating them cleanly is the whole point of the answer.

Answer: A service principal whose credentials Azure creates and rotates for you, so applications authenticate to Key Vault, Storage, or SQL without any secret in config. System-assigned identities share the lifecycle of one resource; user-assigned identities are standalone objects that several resources can share. The workload fetches a token locally from the instance metadata endpoint. Saying no credential ever touches the application is the sentence this entry in Azure interview questions listens for.

Answer: Centralized storage for secrets, keys, and certificates, with access through Entra identities, auditing on every read, soft delete, and optional purge protection. It replaces connection strings and API keys in config files with identity-based access, which is why every secret-management question in Azure interview questions routes here eventually. One depth point to add: newer vaults should use Azure RBAC permission model rather than legacy access policies, so access becomes visible and scopeable like every other Azure resource.

Answer: The management layer every control-plane call passes through, whether it started in the portal, CLI, PowerShell, Terraform, or Bicep. ARM enforces RBAC, policies, locks, and tags identically regardless of origin, which is why governance behaves the same across tooling. It also makes deployments declarative and idempotent: submitting the same template twice converges instead of duplicating. Framing ARM as the single consistent control plane is the answer shape Azure interview questions reward here.

Answer: The domain-specific language for Azure infrastructure as code: it transpiles to ARM templates, so it uses the same engine with far less ceremony. Modules compose reusable units, symbolic names replace the explicit dependsOn chains of JSON, and there is no state file because ARM compares the template against live resource state. az deployment group what-if previews changes safely. Candidates who mention what-if unprompted usually do well on the rest of the infrastructure-as-code Azure interview questions.

Answer: Key-value metadata attached to resources, resource groups, and subscriptions: owner, environment, cost center, application. They drive cost allocation, automation, and access filtering, but they only work when enforced, which is where Azure Policy comes in with deny or append effects on missing tags. Tags alone never take security effect, they are bookkeeping. The governance angle, enforcement over hope, is the part Azure interview questions on tags actually grade.

Answer: The observability platform: platform metrics are near-real-time numeric time series per resource; logs land in Log Analytics workspaces queried with KQL; Application Insights adds request-level telemetry for apps. On top sit alerts, dashboards, and workbooks. One useful split to state: metrics answer how much, right now, logs answer what exactly happened. Azure interview questions for any ops-adjacent role assume you know which store to reach for first.

Answer: Five services: Boards for work tracking, Repos for Git hosting, Pipelines for CI and CD, Artifacts for package feeds, and Test Plans for test management. Pipelines run on Microsoft-hosted agents or your own self-hosted pool, and YAML pipelines live beside the code. Even shops standardized on GitHub Actions still run Boards or Artifacts, so fluency in both ecosystems is common ground in Azure interview questions.

Answer: Actions is GitHub-native CI/CD: workflows live in .github/workflows, run on GitHub-hosted or self-hosted runners, and compose from a large marketplace. Azure DevOps is the broader suite with boards, artifacts, and test management alongside its pipelines. Both deploy to Azure, and Actions can authenticate via OpenID Connect federation so no client secret is stored. Expect Azure interview questions to ask which you would pick and why; the honest answer is workload shape, not religion.

Answer: App Service is PaaS: Microsoft patches the OS and runtime, scaling and load balancing are built in, deployment slots give staged releases, and you only bring code. Pick it for web apps and APIs; pick VMs when you need OS-level access, custom software, or unusual networking. The operational framing matters: every App Service choice deletes patching, hardening, and image work from your backlog. That trade is the real subject of Azure interview questions on this comparison.

Answer: A parallel instance of an App Service app with its own hostname, settings, and often its own database-safe configuration. You deploy to staging, warm it, then swap, which flips routing with near-zero downtime, and swapping back is the instant rollback. Settings marked deployment slot setting stay with the slot so staging never points at production secrets. Slot mechanics come up in Azure interview questions as the PaaS answer to blue-green deployments.

Answer: Azure Load Balancer works at layer 4: it spreads TCP and UDP flows with no payload awareness, ideal for anything non-HTTP and for raw performance. Application Gateway works at layer 7: TLS termination, host- and path-based routing, cookie affinity, and an optional WAF. Front Door extends the L7 idea globally. Name the layer split and the WAF option and most follow-up Azure interview questions on traffic management collapse into details.

Answer: The az CLI is the cross-platform tool with JMESPath output filtering; Azure PowerShell’s Az module returns .NET objects into the pipeline, which suits Windows-focused shops. Cloud Shell is the authenticated browser shell with both preinstalled, so it needs no local setup. Teams standardize on one and keep the other for the odd module, and that pragmatism, naming when you would switch tools, is what Azure interview questions on tooling are fishing for.

Answer: The service namespace that owns a family of resource types: Microsoft.Compute for VMs, Microsoft.Network for VNets, Microsoft.Storage for storage accounts. Each subscription must have a provider registered before its types deploy, and most register automatically on first use. When a template fails with an unregistered or unknown type error, az provider register is the fix. Knowing where resource types actually live is a small differentiator in Azure interview questions.

Answer: CanNotDelete blocks deletion while still allowing updates, and ReadOnly blocks both, with locks inheriting down from the scope where you apply them, usually a critical resource group. They bind everyone, including Owners, which is the point: production stays safe from a fat-fingered delete at 2 a.m. The gotcha worth mentioning: ReadOnly has blunt edges, blocking routine operations like listing storage keys. Locks show up in Azure interview questions whenever someone says we once deleted production.

Answer: The guardrail engine: definitions and initiatives, which are bundles of definitions, get assigned at management group, subscription, or resource group scope and evaluate resources for compliance. Effects range from Audit and Deny to Append, Modify, and DeployIfNotExists, and remediation tasks fix existing resources where the effect allows it. The crisp contrast to volunteer: RBAC decides who can act, policy decides what may exist. That one-liner settles most Azure interview questions about the pair.

Answer: Virtual machines are IaaS: you own the OS, patching, and hardening from the guest up. App Service, Functions, and Azure SQL Database are PaaS: the platform runs and patches the OS and runtime, and you ship code or schema. Storage sits closest to serverless PaaS. Shared responsibility is the underlying concept, and drawing that line confidently is what beginner Azure interview questions on service models are actually testing.

Answer: B is burstable, D is general purpose, E is memory optimized, F is compute optimized, L is storage optimized, N carries GPUs, M is extreme memory. Later generations such as v5 and v6 deliver better price-performance than older ones, and suffixes matter: s marks premium storage support, d marks local disk. Choosing by workload profile instead of habit is the judgment this entry in Azure interview questions wants to hear.

Answer: Standard HDD for dev and backups, Standard SSD for light production, Premium SSD for mainstream workloads, Premium SSD v2 where IOPS and throughput are sized independently of capacity, and Ultra Disk for sub-millisecond latency with live-adjustable performance. Disks are first-class ARM resources with their own RBAC and billing, separate from the VM. Mentioning Premium v2 as the modern default for dense databases is a current-knowledge signal Azure interview questions reward.

Answer: It authenticates you to Entra ID through a browser or device flow, caches the resulting tokens under ~/.azure, and lists every subscription your account can reach. az account set picks the active one, and every later command resolves against that context. The classic support ticket it explains: resource not found errors that turn out to be the wrong active subscription. Stating that failure mode shows real usage, which is the point of Azure interview questions on tooling.

Answer: A signed URI that grants delegated, scoped access to storage without sharing account keys: it can expire, limit permissions, pin IPs, and restrict protocol to HTTPS. Three levels exist, service, account, and user delegation, with the last one signed by an Entra identity rather than a key, which keeps revocation possible. Long-lived tokens are the classic leak, so prefer short expiry. SAS discipline is a recurring security theme in Azure interview questions.

Answer: A snapshot is a point-in-time, incremental copy of one disk, held in storage you manage, perfect for a quick pre-change safety net but manual in retention. Azure Backup is a program: a Recovery Services vault holds scheduled, policy-driven restores, application-consistent via VSS where agents allow, with retention ranges and optional cross-region restore. Snapshots are an operator move, Backup is an operating model. Distinguishing the two is a small but common gate in Azure interview questions.

Answer: Cost analysis with actual and amortized views, budgets that alert at thresholds, forecasts, and scheduled exports of usage detail to storage for warehouse analysis. Scopes align to the hierarchy, so you can slice by subscription, resource group, or tag, and reservations and savings plans appear amortized so they do not distort one month. The unglamorous truth worth saying: tag hygiene decides whether any of it answers questions. Cost fluency increasingly opens Azure interview questions for senior roles.

Answer: A non-human identity created from an app registration, used by applications and automation to sign in with a certificate, client secret, or federated credential instead of an interactive login. It owns nothing personal, holds only assigned roles, and can be scoped and audited precisely, which is why shared user accounts for pipelines are an anti-pattern. Prefer managed identities for workloads running inside Azure. This distinction sets up half the identity Azure interview questions that follow it.

Answer: A PaaS jump host deployed inside a VNet that serves browser-based SSH and RDP to VMs over TLS 443, so VMs need no public IPs and no open management ports. Sessions audit cleanly, credentials stay with the operator, and removing inbound 22 and 3389 from the internet deletes an entire attack class. Azure interview questions use Bastion to test whether you reach for managed access paths instead of DIY VPNs, which is the modern expectation.

Answer: Managed identity wins whenever the workload runs on an Azure resource that supports it: VMs, App Service, Functions, AKS. There is no secret to store, rotate, or leak. A service principal is the answer when the identity must exist outside Azure’s resource model: on-premises jobs, other clouds, third-party SaaS, or a GitHub Actions runner, and for those prefer federated credentials over client secrets. Interviewers use this pairing as a gateway into deeper Azure interview questions on credential hygiene.

Answer: Both are service principals in Entra ID. The system-assigned one is created with its resource, lives in a 1:1 relationship, and is deleted when the resource is deleted, so role assignments tied to it vanish too. A user-assigned identity is an independent resource you create once and bind to many resources, which centralizes role assignments and survives individual resource deletion. The operational caveat: deleting a shared user-assigned identity breaks every workload using it at once, a favorite surprise in Azure interview questions.

Answer: It sends an HTTP request to the Instance Metadata Service at 169.254.169.254, a non-routable link-local endpoint, passing its client ID and a resource identifier such as https://vault.azure.net. The metadata service talks to Entra ID and returns a signed access token, which the SDK caches until near expiry. Because the endpoint is link-local, only code running on that VM or pod can ask. Naming IMDS unprompted is the detail that separates strong answers on this entry in Azure interview questions.

Answer: Azure RBAC is an allow-only model: a request succeeds if some role assignment at a reachable scope grants the action and nothing blocks it. There is no explicit deny inside role definitions; deny assignments exist but are created by the platform itself, for example managed applications. AWS IAM adds deny-first logic where an explicit deny beats every allow. Candidates arriving from AWS get this exactly backwards, which is why the contrast is now a staple of Azure interview questions.

Answer: Control plane actions manage the resource object itself: create, delete, resize, listed in role definitions as actions. Data plane actions touch content inside the resource: read a blob, read a secret, publish a service bus message, listed as dataActions. The classic trap: Reader can see a storage account’s properties but cannot read a blob, because blob reads need Storage Blob Data Reader. This gap between seeing and reading is one of the most practical distinctions in Azure interview questions.

Answer: Legacy access policies attach permissions directly to the vault with coarse scopes and no visibility in the standard RBAC tooling, and the same policy silently applies to all secrets, keys, and certificates. The RBAC permission model makes vault data a scope like anything else: assign Key Vault Secrets User to one identity on one vault, audit it with az role assignment list, and manage it with the same process as every other grant. Microsoft recommends RBAC for new vaults, and saying so with the reasons marks current practice in Azure interview questions.

Answer: Policies evaluate signals at sign-in time: user and group, application, device compliance state, location and named networks, and sign-in risk from identity protection, then grant, block, or demand MFA or a compliant device. Its blind spot worth naming: workload identities like service principals historically sat outside it, with workload identity policies a newer premium addition. So pipelines enforcing MFA-on-everything break service principals. Knowing where Conditional Access ends is a recurring probe in Azure interview questions.

Answer: Inbound to a VM, the subnet NSG is evaluated first and the NIC NSG second; for outbound the order flips, NIC first, then subnet. Both must allow, because a deny at either layer kills the flow. Rules are processed by ascending priority, lowest number wins, and evaluation stops at the first match. Default rules sit at priority 65000 and always allow VNet and load balancer health traffic, so your own rules in the 100 to 4096 band decide everything else. This asymmetry is among the most repeated technical checks in Azure interview questions.

Answer: A service endpoint keeps the PaaS service on its public address but routes subnet traffic to it over the backbone and tags it with your subnet identity, so the service’s firewall can allow that subnet. A private endpoint provisions a real NIC with a private IP inside your subnet and requires a privatelink DNS zone so the service’s name resolves there. Service endpoints are cheaper and faster to adopt but expose the service publicly; private endpoints are the zero-public-exposure answer. That trade lands in Azure interview questions for any role touching secure PaaS.

Answer: Azure installs system routes for the VNet’s own prefixes, for peering, and for the internet next hop, and user-defined routes override or add to them by longest prefix match, with UDRs beating system routes only at equal or more specific prefixes. Next hop types include virtual appliance, VNet gateway, VNet, Internet, and None, where None blackholes traffic. Verify reality, not intent, with az network nic show-effective-route-table. Route truth versus route intent is a running theme in Azure interview questions on connectivity.

Answer: Peering is a pairwise connection: A peered to B and B peered to C does not move A-to-C traffic, by design, to keep routing explicit and auditable. The standard pattern is a hub VNet holding Azure Firewall or an NVA, with each spoke peered to the hub and a UDR pointing inter-spoke and internet prefixes at the hub appliance, which must also be allowed to forward. Gateway transit lets spokes use the hub’s VPN or ExpressRoute gateway. Spoke-to-spoke failures from missing forwarding are a staple of scenario Azure interview questions.

Answer: NSGs filter at layers 3 and 4 between your own resources and Azure-known destinations; they cannot inspect FQDNs, apply IDPS, or give one clean egress story for spoke subnets. Azure Firewall adds application rules by FQDN, threat intelligence filtering, TLS inspection options, DNAT, and hub deployment so every spoke’s outbound path terminates somewhere observable. NSG for microsegmentation, firewall for egress and inspection, is the layered answer Azure interview questions expect here.

Answer: Probes, HTTP requests or TCP connects against a port and path you choose, decide which backend instances stay in rotation. A failing probe removes the instance from the backend pool immediately, so traffic reroutes to survivors, and it returns when probes pass again. The classic trap: the probe checks a different path than the application actually serves, so healthy instances get pulled. Align probe path with a real health endpoint, because probe-path mismatch is one of the highest-frequency answers in Azure interview questions on load balancing.

Answer: When VMs behind a public load balancer make outbound connections, the platform rewrites them through a finite pool of SNAT ports per backend instance; exhaust it and new outbound connections hang or reset while inbound keeps working. Fixes in order of preference: a NAT gateway with dedicated outbound IPs and far larger port pools, an Azure Firewall as egress, or instance-level public IPs. The symptom pattern, outbound fails under burst while inbound is fine, is what Azure interview questions use to identify engineers who have debugged real fleets.

Answer: The tier is a per-blob property, and moving Cool to Archive is instant and cheap while Archive to Hot requires rehydration, hours at standard priority, minutes at high. Each cooler tier carries an early-deletion window, 30 days for Cool, 90 for Cold, 180 for Archive, charged pro-rata if a blob leaves sooner. Reads from Cool and Cold add per-gigabyte retrieval charges. The cost model, not the naming, is what Azure interview questions on tiers are actually grading.

Answer: The account’s management policy is JSON: rules with filters, prefix or blob index tags, and actions triggered by days since modification or last access, access tracking must be enabled for that, tiering blobs cooler, deleting them, or deleting old snapshots. Rules run roughly daily, not instantly, so day counts are approximate. The operational caveat interviewers love: delete rules do not consult anyone, so a mis-scoped prefix can legally wipe production data. Lifecycle surprises from mis-scoped filters are now a fixture of scenario Azure interview questions.

Answer: LRS keeps three copies inside one datacenter; ZRS spreads three copies across availability zones in the region; GRS adds an asynchronous copy to the paired region, which you reach only after a failover unless you pick RA-GRS for read access; GZRS combines zone redundancy with the cross-region copy. Asynchronous means a real replication lag window, so failover can lose recent writes. Choosing redundancy by failure-mode math instead of habit is what Azure interview questions on durability probe.

Answer: Service SAS scopes one blob or container, account SAS spans the account, and user delegation SAS is signed with an Entra credential instead of the account key. That last part is the security story: account keys are all-or-nothing, impossible to revoke without rotating everything, while user delegation SAS inherits RBAC, respects its own short expiry, and dies when the signing identity’s permissions are revoked. Prefer it for any delegated access. SAS mechanics appear in Azure interview questions wherever secrets handling comes up.

Answer: Immutable blob storage enforces WORM: time-based retention locks blobs for a declared period, or a legal hold pins them indefinitely, and even administrators cannot delete or overwrite inside the window. Soft delete keeps deleted blobs and containers recoverable for a retention window, guarding against ransomware and fat-fingered deletes, and it exists for shares too. Together they turn the storage account into evidence-grade storage. Knowing which control answers which threat is a quiet differentiator in Azure interview questions on data protection.

Answer: Uniform sets manage identical instances as a single resource with autoscale rules and one model. Flexible sets treat instances as ordinary VMs sharing a template: you can mix sizes, spread explicitly across zones and fault domains up to 1000 instances, and attach existing VMs, but you bring your own autoscaling through Azure Monitor metrics or VM applications instead of the older rules. New designs default to flexible; older tooling assumes uniform. The orchestration split now appears in most Azure interview questions on compute scaling.

Answer: The autoscale engine in Azure Monitor evaluates metric rules, CPU, custom Log Analytics or App Insights metrics, on a schedule, compares against thresholds, then updates the scale set’s capacity property, and the platform boots or removes instances. Stabilization windows delay scale-in, and scale-in policies choose which instance leaves, default spreading across zones and fault domains. Per-instance protection pins instances you never want removed. Flapping from too-eager thresholds is the classic war story behind Azure interview questions on scaling.

Answer: Automatic pushes the new model to every instance as the platform schedules it; Manual applies changes only when you call az vmss update-instances per instance; Rolling updates instances in bounded batches with maxSurge and maxUnavailable controls and health checks between batches. Model changes, image, size, extensions, do nothing to running instances until an upgrade pass applies them, which is the surprise behind half-full upgrades. Upgrade mechanics come up in Azure interview questions whenever rolling deploys on raw compute are discussed.

Answer: Spot capacity is spare Azure compute sold at deep discount with the caveat that the platform can evict it whenever capacity is needed back, with at most 30 seconds of eviction notice and a policy of Deallocate or Delete. Price caps are optional; the real discipline is workload choice, stateless workers, batch rendering, CI fleets, plus checkpointing and handling the eviction signal. Never put the database there. Spot-versus-prioritized capacity judgment is a recurring economics check in Azure interview questions.

Answer: Kubenet gives pods an overlay CIDR routed by the plugin, conserving VNet IPs but adding a route hop and no direct pod-to-VNet reach. Azure CNI assigns every pod a real VNet IP, giving flat networking and direct connectivity at the cost of aggressive subnet consumption, the classic pods Pending, subnet exhausted incident. Overlay keeps pod IPs in a private range while nodes take VNet IPs, the current default sweet spot. Choosing by IP budget is exactly what Azure interview questions on AKS networking grade.

Answer: The managed control plane upgrades first with blue-green protection, then node pools drain and reimage one node at a time using surge nodes, maxSurge, so capacity stays flat. Pods must tolerate cordon and drain, which means PodDisruptionBudgets and multiple replicas are prerequisites, and workloads reschedule onto new nodes running the new kubelet. One supported minor version of drift exists, so skipping versions means walking through intermediates. Upgrade planning questions dominate senior Azure interview questions for platform roles.

Answer: System pools run CoreDNS, metrics-server, and the tunnel components; user pools run your workloads. The separation is enforced with a taint, CriticalAddonsOnly, on system nodes so business pods cannot land there, keeping control-plane add-ons alive during your deployments and scale storms. System pools must stay small but never zero, at least one node per availability zone when zones are on. Explaining the taint mechanism is the depth signal Azure interview questions look for on this topic.

Answer: The cluster autoscaler adds or removes nodes when pods are unschedulable or nodes underused; the Horizontal Pod Autoscaler changes replica counts from metrics like CPU or custom exporters; KEDA scales from event sources, queue depth, Kafka lag, and can scale to zero. They compose vertically and horizontally but must not fight: HPA thresholds well above node-add latency, and cluster autoscaler left to node-count decisions. Naming all three layers with their owners is standard fare in Azure interview questions for platform engineers.

Answer: The cluster gets an OIDC issuer URL; a Kubernetes service account is annotated with the client ID of a user-assigned managed identity; a federated credential on that identity trusts the issuer plus the service account’s namespace and name. Pods annotated with the service account get Entra tokens through the projected token file, and the SDK exchanges them. aad-pod-identity, the old mechanism, is retired. Explaining the federation, not just the name, is what Azure interview questions on this topic actually test.

Answer: The platform warms the target slot by applying the production configuration and pinging the app, then flips the hostnames between slots with no file copy, making swap the fast rollback too. Settings marked as slot sticky, typically connection strings and some app settings, travel with the slot instead of the app, which is how staging keeps pointing at test resources. Warmup failures surface as cold-start 503s after swap. Slot mechanics anchor the deployment section of most Azure interview questions on PaaS.

Answer: For outbound, VNet integration routes the app’s egress into your VNet so it can reach private endpoints and internal services while the app itself stays public. For inbound, private endpoints give the app a private IP inside your subnet, and access restrictions layer IP or service-tag allowlists on the public endpoint. The common mistake is flipping both on without checking the plan tier, since features gate on SKU. Inbound versus outbound clarity is precisely what Azure interview questions on App Service networking probe.

Answer: Azure itself is the state: when you submit a template, ARM reads the live resources, compares declared properties against actual ones, and calls the providers to converge the difference. Rerunning a template is safe because unchanged properties are no-ops, and drift created in the portal is real state ARM will honor until your template overrides it. Preview with az deployment group what-if before applying. This compare-against-Azure model, versus Terraform’s state file, is one of the most common contrast questions in Azure interview questions.

Answer: Incremental, the default, creates or updates resources in the template and leaves everything else standing. Complete deletes resources in the resource group that are not in the template, which makes the group exactly match the template but punishes anything deployed outside it. Most teams should live in incremental and manage removals deliberately. The Complete deletion footgun is precisely why this pairing appears in Azure interview questions on infrastructure as code safety.

Answer: A module is a Bicep file consumed from another file with parameters and outputs, transpiled into a nested deployment at compile time. Scopes let one root template deploy the network module into a connectivity subscription, identity into another, while modules emit outputs that later modules consume as parameters, replacing copy-paste wiring. Version modules like code and publish as template specs or private registries. Module-versus-copy-paste judgment is a recurring seniority signal in Azure interview questions on IaC.

Answer: Audit records non-compliance without blocking; Deny rejects the request outright; Append and Modify add or correct properties like tags or HTTPS-only on creation; DeployIfNotExists provisions the missing companion, a diagnostic setting, a private endpoint, and Modify plus DINE need a managed identity with rights to act. Existing resources need remediation tasks, which DINE assignments queue but do not always complete alone. Effect selection, not policy writing, is what Azure interview questions on governance usually grade.

Answer: They form a hierarchy above subscriptions, up to six levels of depth, where policy and RBAC assignments inherit to everything below, enabling tenant-wide guardrails like allowed regions or deny-public-IP. Subscriptions can move between groups to change inheritance instantly. Two operational caveats: inheritance is additive, so child scopes can only add permissions, not subtract inherited denies, and root group assignments affect everything, so test first. Hierarchy design questions open the governance block of most Azure interview questions.

Answer: Stages group jobs, jobs run on an agent as a set of steps, and each step is a script or a task from the catalog. Triggers start it on branch or PR, variables and variable groups inject configuration, service connections hold authenticated targets like an Azure subscription or registry, and environments add deployment history plus approval gates. The interview-worthy point: stages define what can run in parallel and what gates what. Pipeline anatomy questions are dependable entries in Azure interview questions for DevOps roles.

Answer: Agent pools become runner labels, service connections become cloud login steps or OIDC federation, variable groups become environment or organization secrets, environments with approvals map almost one to one, and classic release gates become deployment protection rules. Artifacts and Boards have no exact Actions counterpart, which is why some enterprises run both. Fluent mapping, knowing what does not translate, is exactly what cross-platform Azure interview questions on CI/CD are fishing for.

Answer: Microsoft-hosted runners live on shared infrastructure with internet access only, so any pipeline touching private VNets, on-prem systems through ExpressRoute, or IP-allowlisted services needs self-hosted agents placed in, or routed into, the right network. You own the OS, agent updates, caching, and hardening, and pools scale with your own automation. The design question interviewers add: one pooled agent set per environment keeps blast radius sane. Agent placement is a dependable scenario seed in Azure interview questions.

Answer: Metrics are lightweight numeric time series stored near the resource, queryable in seconds, ideal for alerting thresholds and dashboards. Logs live in Log Analytics workspaces as full records queried with KQL, slower to ingest, vastly richer, the place where why questions get answered. The daily-driver split: alert on metrics, investigate in logs, and export platform diagnostics into the workspace because metrics retention is short. Choosing the right store fast is the reflex Azure interview questions on observability reward.

Answer: Reservations pin capacity family and region for one or three years at the deepest discount, right for stable baselines like always-on databases. Savings plans commit to a hourly spend across sizes and regions, trading a smaller discount for flexibility, right for evolving fleets. Spot accepts eviction for the biggest cut, right for interruptible work. Apply them to the baseline, keep burst on demand, and review utilization monthly. Commitment-mix judgment increasingly closes senior Azure interview questions on cost.

Answer: My order: identity, permission, network. First, which identity is the pod actually presenting: check the service account annotation and federated credential for workload identity, or the pod identity binding on legacy setups. Second, does that exact identity hold a Key Vault role, Key Vault Secrets User for RBAC vaults, on this vault, at a scope that includes it, and has anyone changed the vault’s permission model between access policies and RBAC, which orphans old grants. Third, network: vault firewall rules, private endpoint DNS. The 403 in the response body usually names the reason. Identity first, because it explains most of these. This is among the most common scenario Azure interview questions today.

Answer: Ordered: does the health probe port have an explicit allow anywhere, because default NSG rules do permit Azure load balancer traffic, and someone may have inserted a low-priority deny that precedes it. Next, which layer blocked it: run az network watcher test-ip-flow from the LB to an instance IP on the probe port, and check effective security rules on the NIC versus the subnet, remembering inbound evaluates subnet first, NIC second. Then confirm the app actually answers on the probe path. A deny before your allow at either layer is the usual culprit, and NSG-blocking-a-scale-set scenarios appear in Azure interview questions with exactly this shape.

Answer: Two identities, and the SDK fetched the wrong one. DefaultAzureCredential tries the first available credential, so if the code does not pin a client ID, VM B’s system-assigned identity, which nobody granted access, answers instead of the intended user-assigned one. Verify with az vm identity show on both machines, compare role assignments with az role assignment list --assignee, then fix by passing the explicit client ID of the correct identity in the credential constructor. Adding the missing role assignment to B is the other valid fix. This managed-identity confusion is one of the most reliable scenario Azure interview questions for spotting real-world experience.

Answer: Lifecycle management policy first, because it deletes without consulting anyone: read the account’s policy with az storage account management-policy show and match the rule filters, prefix and blob index tags, against the missing objects and their last-modified dates. Second, rule scope creep: a rule written for logs/ but filtered too broadly catches everything under the account. Third, soft delete: if enabled, restore from the deleted-blobs view and you have both recovery and proof. Finally, check activity log and blob inventory for the delete events. The lifecycle surprise is now a standard entry in Azure interview questions on storage operations.

Answer: Read the error precisely: subscription vCPU quota for a VM family, total regional vCPUs, or a family-specific limit, each has a different fix. Check usage against limit with az vm list-usage --location to see which number is saturated. Then choose: request a quota increase, which is often an automated portal flow, reuse an existing family with headroom, deallocate stopped VMs that still hold quota, or deploy into another region with capacity. Deallocation matters because stopped VMs keep consuming regional vCPU quota. Quota-aware deployment is exactly the maturity check scenario Azure interview questions run on cloud cost and capacity sense.

Answer: Boot diagnostics first: the screenshot and serial log under az vm boot-diagnostics get-boot-log usually show the panic or GRUB failure. If the guest is unrecoverable, the repair pattern is disk surgery: stop the VM, swap the OS disk to a repair VM, or use the run-command repair extension, chroot in, roll back the kernel or fix fstab, then swap back. Snapshot the disk before touching it so a botched fix is free. Serial console access, not RDP retries, is the modern first move, and boot-repair narratives like this are staples of scenario Azure interview questions.

Answer: Model changes do not touch running instances until an upgrade policy applies them. With Manual mode, nothing happens until you explicitly call az vmss update-instances per instance ID; with Rolling, a failed health gate or a drained batch that never finished leaves the set half-migrated; with Automatic, the platform schedules it, slowly. Check instance versions with az vmss list-instances, compare latestModel flags, then re-run the upgrade pass and watch batch health. Explaining that a change of model and an application of the model are separate steps is the whole answer, and it is a classic trap in Azure interview questions on scale sets.

Answer: Start with the node, not the cluster: kubectl describe node for conditions, then the kubelet and container runtime logs via VMSS run-command, because NotReady on fresh nodes is usually provisioning, not scheduling. Check CNI address exhaustion if the cluster runs flat Azure CNI, since new nodes grab a batch of pod IPs from the subnet and an exhausted range leaves kubelet unable to configure the sandbox. Verify NSGs allow required control-plane and tunnel ports from the node subnet. Then check the outbound path, SNAT or NAT gateway, for DNS failures. Fresh-node NotReady scenarios are standard platform entries in Azure interview questions.

Answer: Subnet IP exhaustion: flat Azure CNI hands every pod a real VNet address, so a node pool of 30 nodes at default maxPods can demand thousands of addresses from a subnet sized for dozens. Confirm with az network vnet subnet show, compare the IP allocation count against the CIDR, and cross-check cluster events for address-space failures. Fixes in order: shrink maxPods per node, add a secondary pod subnet, or move to Azure CNI Overlay, which frees the VNet of per-pod addressing. The IP budget conversation is the real content of this entry in Azure interview questions.

Answer: Probe configuration first, because the gateway marks backends unhealthy and 502s everything: compare the probe’s host, path, and port against what the pods actually serve, a /healthz returning 404 makes every target unhealthy. Second, backend pool membership, especially with AGIC, whether the ingress actually registered the pod IPs. Third, NSGs on the AKS subnet must permit the gateway subnet to reach node ports, and check whether an allow rule for AzureLoadBalancer or gateway service tag survives recent edits. Probe-path mismatch alone explains most of these. Gateway-to-backend triage is a recurring architecture check in scenario Azure interview questions.

Answer: Peering is pairwise, so A-to-B traffic must transit the hub appliance, which means three things must line up: each spoke’s UDR must point the other spoke’s prefixes, or a default route, at the hub firewall; the firewall must allow and forward the flow, not just have it routed through; and asymmetric return routing must be ruled out, because a spoke replying via its own default route instead of the firewall breaks stateful inspection. Verify with effective route tables on both sides and firewall logs for the flow. Non-transitive peering surprises like this one appear constantly in Azure interview questions on hub-and-spoke.

Answer: DNS, not networking: the privatelink.blob.core.windows.net private DNS zone exists but is not linked to the client’s VNet, or a conditional forwarder to it is missing, so names resolve publicly. Check the zone’s virtual network links with az network private-dns link vnet list, then test resolution from a client with nslookup and expect the private IP. Second look: the storage account’s public network access may also need disabling so the private path is enforced. Private-DNS gaps are the most repeated networking trap in Azure interview questions about Private Link.

Answer: Read effective routes on a NIC, not the table’s intent: az network nic show-effective-route-table shows whether 0.0.0.0/0 now points at a virtual appliance that is down, unreachable, or lacks a forwarding rule, or at next hop None, which silently blackholes. The usual culprits: an NVA without IP forwarding enabled, a firewall rule dropping the flow, or a 0.0.0.0/0 route attached to a subnet that was never meant to egress through the hub. Fix the route or fix the appliance, then re-verify effective routes. Route-table regressions are dependable scenario material in Azure interview questions.

Answer: Time and tokens. SAS tokens with short expiry fail mid-run when the job outlives its grant, and clock skew between the client and Azure, more than five minutes, breaks signature validation intermittently. Check the exact error: signature-not-valid points at skew or a regenerated key, while expired points at lifetime. If the SAS was built on an account key that rotated in a key-rotation pipeline, runs fail after rotation until the tooling regenerates tokens. Fix with user delegation SAS or managed identity so revocation is possible. Intermittent-403 forensics like this separate rehearsed candidates in Azure interview questions.

Answer: GRS replicates asynchronously to the paired region, so recent writes within the replication lag window, typically minutes but unbounded under stress, may be lost on failover, and failover itself converts the account to locally redundant in the new primary until you fail back. Read the last sync time property on the account to state the exposure precisely instead of guessing. Zone-redundant setups inside the region ride out zone loss with zero data loss, which is the design conversation to have while the incident is fresh. Replication honesty, naming lag, is what scenario Azure interview questions on DR are grading.

Answer: Cost Management analysis scoped to the day, grouped by resource and meter, names the offender before any theory. The usual suspects: a diagnostic setting sending verbose logs to Log Analytics, where ingestion, not retention, is the meter; bandwidth and egress after a peering or CDN change; an autoscale loop flapping instances up and down; or a storage lifecycle change moving data with retrieval and early-deletion charges. Check the activity log for who changed diagnostics, routing, or scale settings that day. Meter-first thinking is precisely the discipline scenario Azure interview questions on cost are after.

Answer: Read the denial, which names the policy assignment and definition Azure Policy blocked the request with, then decide rather than override. Legitimate paths: fix the deployment to comply, request an exemption with an expiry and a reason, or ask governance whether the policy intent really covers this resource. Never bypass by moving scope, because that is the audit finding later. Check assignment scope and exclusion lists, since a new management-group-level assignment frequently explains a previously working pipeline suddenly failing. Policy-denial triage appears in Azure interview questions wherever governance meets delivery speed.

Answer: DINE evaluates and can create missing companions, but remediation of existing resources needs an explicit remediation task, either triggered from the portal or CLI with az policy remediation create, and the assignment’s managed identity must hold enough permission, typically Contributor, on the target scope. Check compliance reasons first with az policy state list, then verify the identity’s role assignments, then run remediation and watch the task status. New resources get fixed automatically, old ones wait for you. The remediation gap is the detail Azure interview questions use to check real policy experience.

Answer: The swap promoted an insufficiently warmed slot: warmup did not initialize caches, JIT, or connections, so the first production requests paid the cost as errors. Verify slot-specific settings too, a connection string not marked sticky can flip environments unexpectedly. Fixes: enable warmup on the staging slot so the platform exercises the app before flipping, add application initialization with a real endpoint, mark every environment-bound setting as slot sticky, and gate the swap on staging smoke tests. Swap mechanics gone wrong are a dependable PaaS entry in scenario Azure interview questions.

Answer: Either the resource moved behind a private endpoint, or the network that used to carry the pipeline changed. Microsoft-hosted agents run on shared internet-facing infrastructure, so they can never reach a private endpoint; the fix is a self-hosted agent inside, or peered with, the VNet, registered to the pool. Verify resolution from an agent: if the database name resolves to a public IP, DNS is answering publicly, so the agent is simply outside. Check NSGs and firewall rules on the path too. Hosted-versus-self-hosted placement is one of the most practical forks in Azure interview questions on pipelines.

Answer: A Conditional Access policy was broadened to require MFA or compliant devices and caught workload identities, which cannot perform interactive MFA, so sign-in dies. Confirm in the sign-in logs which policy blocked the principal. The correct fix is not an exclusion bolted onto the policy: give the automation a non-interactive path, ideally managed identity, or workload identity federation from the pipeline to Azure, or scope the CA policy to user sign-ins only. Whatever remains interactive stays protected. Workload-identity versus CA scope is the modern framing of this entry in Azure interview questions.

Answer: Confirm the packet path first: the subnet’s UDR should send 0.0.0.0/0 to the firewall, and effective routes on a NIC prove it. Then read the firewall application rule matched by the deny: update endpoints are FQDN lists, and a missing wildcard or a new vendor endpoint, for example a moved repo domain, explains a sudden stoppage after years of quiet. Check DNAT or SNAT expectations too, since firewall SNAT hides source IPs from allowlists. Add the FQDN to the application rule collection, verify from the VM, and document the list’s owner. Egress forensics of exactly this shape recurs across scenario Azure interview questions.

Answer: BGP: the on-premises edge is advertising a default route, and BGP-learned routes override system routes in Azure, so all VNet egress now points down the tunnel where the on-prem firewall happily drops it. Verify with az network nic show-effective-route-table, where the BGP-sourced default appears, then fix at the source, stop the advertisement, or embrace it deliberately with UDRs and firewall egress in the hub. Effective routes beat guessed intent every time. BGP default-route hijacks are a classic connectivity story in Azure interview questions for networking-heavy roles.

Answer: Storage firewall rules run before authentication succeeds, so correct keys still meet 403 from a denied network. Check the account’s network rule set, default action deny with an allowlist of VNets and IPs: the pipeline’s source, hosted agents on shared ranges, is simply not on it. Options in order of preference: place compute inside the allowed VNet, use a private endpoint, or enable the trusted-services exception if the caller is another Azure service. Avoid allowlisting giant cloud ranges permanently; that erodes the control. Network-versus-identity 403s are a reliable discriminator in scenario Azure interview questions.

Answer: ARM deploys resources in parallel unless dependencies say otherwise, so a resource consuming another’s output, a NIC referencing a VNet, a role assignment referencing an identity, needs an explicit dependency or a symbolic-name reference, which Bicep converts automatically. Read the error’s resource type, add the reference, and remember role assignments on a fresh identity need its principal ID, which only exists after creation, a classic race. Re-run with what-if to confirm the graph. Explaining the parallel-until-declared model is what this entry in Azure interview questions is really testing.

Answer: Zonal resources pinned to the lost zone, VMs without zones, a zonal IP, a single-zone node pool, fail completely and need redeployment, while zone-redundant resources survive: ZRS storage, zone-redundant Standard load balancer and public IPs, VMSS with zone spread, AKS across three zones. The subtlety worth narrating: zonal downtime differs from regional outage, and the design rule is that every tier has capacity in every zone, because surviving the blast requires spare capacity elsewhere. Post-incident, convert zonal pins to zone-spread. Zone-failure reasoning is a fixture of senior scenario Azure interview questions.