Interview and certification prep
These Azure interview questions and exercises close the course. You’ve built, broken and fixed more than most candidates ever will; this lesson turns that into answers an interviewer remembers and into a plan for the AZ-104, AZ-700 and AZ-305 exams.
Interviewers for Azure roles check three things: can you explain how something works, can you choose between options and say why, and can you troubleshoot calmly in order. Every lesson’s interview section practised those; here you put them together.
You’ll map the course to the exam skills, do a timed hands-on drill like the performance tasks in admin exams, review a broken design the way senior interviews do, and finish with 30 rapid-fire questions.
| Time | You need | Cost | By the end you can |
|---|---|---|---|
| About 2 hours, then 4 to 6 weeks of revision | A free account, the CLI, and the notes from your labs | Nothing: everything in the drill is free or deleted at the end | Answer Azure interview questions with structure, map your skills to AZ-104, AZ-700 and AZ-305, and work fast under time pressure |
What it is, in one line
Azure interviews and exams test whether you can explain, decide and troubleshoot, so prepare with real stories, not memorised definitions.
In Simple Words
The driving test
A driving test has a written part and a road part. People who only memorise the rule book often fail the road part, because the examiner watches what you do when a cyclist appears suddenly.
Azure interviews are the same. Definitions are the rule book. The questions that decide the job are the road part: “the site is down, what do you check first?”, “why this design and not that one?”.
You’ve already driven the road dozens of times in this course. This lesson is about telling the examiner what you saw.
Engineer's View
The three exams this course prepares you for
- AZ-104, Azure Administrator Associate (skills measured as of 17 April 2026): identities and governance 20 to 25 percent, storage 15 to 20, compute 20 to 25, virtual networking 15 to 20, monitor and maintain 10 to 15. Newer topics include encryption at host, Backup vaults and Container Apps.
- AZ-700, Azure Network Engineer Associate (skills measured as of 27 July 2026): core networking 25 to 30 percent, connectivity services 20 to 25, application delivery 15 to 20, private access 10 to 15, network security 15 to 20.
- AZ-305, Azure Solutions Architect Expert (skills measured as of 17 April 2026): identity, governance and monitoring 25 to 30 percent, data storage 20 to 25, business continuity 15 to 20, infrastructure 30 to 35.
- Passing score: 700 out of 1,000 for all three.
- Renewal: associate and expert certifications expire yearly and are renewed by an online assessment on Microsoft Learn, at no cost.
- Always check the official study guide before you book: skills lists change a few times a year.
How it works, step by step
A six-week plan that works for people with a job:
- Week 1: read the AZ-104 study guide and mark each skill as done in this course, partly done, or new.
- Weeks 2 and 3: redo the labs for weak areas from your notes, without reading the lesson, and time yourself.
- Week 4: learn the few new topics this course didn’t cover in depth, such as Container Apps, from Microsoft Learn modules.
- Week 5: take Microsoft’s practice assessment, review every wrong answer, and redo those labs.
- Week 6: book the exam, do the drill in this lesson twice, and rest the day before.
For interviews, prepare five stories from your labs in the STAR shape: situation, task, action, result. A good one is the final project scenario you found hardest.
| AZ-104 area | Lessons in this course |
|---|---|
| Identities and governance | 5 to 10, 54, 66 |
| Storage | 21 to 26, 64, 65 |
| Compute | 15 to 20, 41 to 43, 58, 60, 72 |
| Virtual networking | 11 to 14, 27, 45 to 53, 61 to 63 |
| Monitor and maintain | 29 to 36, 39, 59, 69, 70, 73 |
A timed 8-task admin drill
This drill copies the style of hands-on exam tasks: short instructions, a clock, and no step-by-step help. Start a 40-minute timer, try each task from memory, and open a solution only when you’re stuck.
1The tasks
| # | Task |
|---|---|
| 1 | Create rg-saat-l75 in Central India with tags env=test and owner=your name. |
| 2 | Create vnet-l75 (10.75.0.0/16) with a private subnet snet-app (10.75.1.0/24). |
| 3 | Create nsg-l75 that allows TCP 443 from VirtualNetwork, and attach it to snet-app. |
| 4 | Create a storage account with public network access disabled and minimum TLS 1.2. |
| 5 | Give yourself Storage Blob Data Reader on that account only. |
| 6 | Create an action group with your email and an activity log alert for NSG deletes in the group. |
| 7 | Allow only Central India in rg-saat-l75 with the built-in Allowed locations policy. |
| 8 | Protect the storage account from deletion with a lock. |
Show the solutions
$sfx = Get-Random -Minimum 10000 -Maximum 99999
az group create --name rg-saat-l75 --location centralindia --tags env=test owner=yourname course=saatvedha-azure -o none
az network vnet create --resource-group rg-saat-l75 --name vnet-l75 --address-prefixes 10.75.0.0/16 --subnet-name snet-app --subnet-prefixes 10.75.1.0/24 -o none
az network vnet subnet update --resource-group rg-saat-l75 --vnet-name vnet-l75 --name snet-app --default-outbound-access false -o none
az network nsg create --resource-group rg-saat-l75 --name nsg-l75 -o none
az network nsg rule create --resource-group rg-saat-l75 --nsg-name nsg-l75 --name allow-https-vnet --priority 100 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes VirtualNetwork --destination-port-ranges 443 -o none
az network vnet subnet update --resource-group rg-saat-l75 --vnet-name vnet-l75 --name snet-app --network-security-group nsg-l75 -o none
az storage account create --resource-group rg-saat-l75 --name stl75$sfx --sku Standard_LRS --min-tls-version TLS1_2 --public-network-access Disabled --allow-blob-public-access false -o none
$stId = az storage account show --resource-group rg-saat-l75 --name stl75$sfx --query id -o tsv
$me = az ad signed-in-user show --query id -o tsv
az role assignment create --assignee-object-id $me --assignee-principal-type User --role "Storage Blob Data Reader" --scope $stId -o none
az monitor action-group create --resource-group rg-saat-l75 --name ag-l75 --short-name agl75 --action email me you@example.com -o none
$rgId = az group show --name rg-saat-l75 --query id -o tsv
$agId = az monitor action-group show --resource-group rg-saat-l75 --name ag-l75 --query id -o tsv
az monitor activity-log alert create --resource-group rg-saat-l75 --name alert-nsg-delete --scope $rgId --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/delete --action-group $agId -o none
'{"listOfAllowedLocations":{"value":["centralindia"]}}' | Set-Content C:\azure-lab\l75-loc.json
az policy assignment create --name allowed-loc-l75 --policy e56962a6-4747-49cd-b67b-bf8b01975c4c --scope $rgId --params '@C:\azure-lab\l75-loc.json' -o none
az lock create --name lock-st --lock-type CanNotDelete --resource-group rg-saat-l75 --resource-name stl75$sfx --resource-type Microsoft.Storage/storageAccounts -o none2Check your work
Run these checks and compare:
az group show --name rg-saat-l75 --query tags
az network vnet subnet show --resource-group rg-saat-l75 --vnet-name vnet-l75 --name snet-app --query "{nsg:networkSecurityGroup.id, defaultOutbound:defaultOutboundAccess}" -o json
az storage account list --resource-group rg-saat-l75 --query "[].{name:name, public:publicNetworkAccess, tls:minimumTlsVersion}" -o table
az lock list --resource-group rg-saat-l75 --query "[].{name:name, level:level}" -o tableYou should see something like this:
{
"course": "saatvedha-azure",
"env": "test",
"owner": "yourname"
}
{
"nsg": "/subscriptions/.../networkSecurityGroups/nsg-l75",
"defaultOutbound": false
}
Name Public Tls
---------- -------- ------
stl7512345 Disabled TLS1_2
Name Level
------- -------------
lock-st CanNotDeleteFinished in 40 minutes? You’re at exam speed. If not, repeat the drill in a week; the second run is always faster.
✅ Checkpoint: You completed eight admin tasks against the clock and verified each one from the CLI.
Break It, Then Fix It
1Break it: clean-up refused
Try to delete the drill group:
az group delete --name rg-saat-l75 --yesYou’ll get an error like this:
(ScopeLocked) The scope '/subscriptions/.../resourceGroups/rg-saat-l75' cannot perform delete operation because following scope(s) are locked: '/subscriptions/.../resourceGroups/rg-saat-l75/providers/Microsoft.Storage/storageAccounts/stl7512345'. Please remove the lock and try again.Your own lock from task 8 did its job. Interviewers like this one: a lock protects against everyone, including Owners, and the error names exactly which lock to look at.
Fix it: remove the lock, then delete the group and the policy assignment:
az lock delete --name lock-st --resource-group rg-saat-l75 --resource-name stl75$sfx --resource-type Microsoft.Storage/storageAccounts
az policy assignment delete --name allowed-loc-l75 --scope $rgId
az group delete --name rg-saat-l75 --yes2Break it: a design an interviewer hands you
Senior interviews often show a design with mistakes and ask what you’d change. Read this one, list every problem you can find, then open the answer.
The design to review
“Our shop runs on one Standard_B2s VM in a public subnet with a public IP. RDP is open to the internet so the vendor can log in. The app reads the storage account key from a config file on the VM.
Nightly reports run on the same VM. The database VNet uses 10.0.0.0/16, and we plan to peer it with the office VNet, also 10.0.0.0/16. Backups: we take a snapshot when we remember.”
Show the problems and fixes
| Problem | Why it matters | Fix |
|---|---|---|
| Single VM | No redundancy; any reboot is an outage | Two VMs across zones behind a load balancer (Lessons 18, 51) |
| RDP open to the internet | Attacked within minutes | Bastion or JIT, no public IP (Lessons 27, 28) |
| Storage key in a config file | Leaks give full account access | Managed identity with a data role, or Key Vault (Lessons 10, 55) |
| Reports on a B-series VM | Credits run out; slow by mid-week | Separate non-burstable size or scheduled job (Lesson 72) |
| Overlapping 10.0.0.0/16 ranges | Peering will fail | Plan non-overlapping ranges (Lessons 45, 46) |
| Snapshots “when we remember” | No reliable restore point | Azure Backup policy, tested restores (Lessons 35, 69) |
3Break it: the troubleshooting question
Practise answering out loud: “Users say the website on Azure is down. Walk me through what you do.” Give your answer in order, then compare.
Show a strong answer
- Scope it: which URL, which users, since when (in UTC), all or some requests.
- Check Service Health for the region and Resource Health for the front door, load balancer or gateway and VMs.
- Ask what changed: Activity log for the resource groups involved (Lesson 59).
- Follow the path: DNS, public IP, load balancer or gateway health and probes, NSGs, routes, then the VMs and the app (Lessons 51, 61, 62, 71).
- Fix, confirm the way users do, and write down the cause and prevention.
✅ Checkpoint: You cleared your own lock, reviewed a flawed design like a senior engineer, and gave a structured troubleshooting answer.
30 rapid-fire Azure interview questions
Cover the answers and test yourself. Each one is answered in more depth somewhere in this course.
| Question | Short answer |
|---|---|
| What is the difference between a resource group and a subscription? | A subscription is a billing and quota boundary; resource groups organise resources inside it for lifecycle and access. |
| Name the four Azure RBAC scopes. | Management group, subscription, resource group, resource. |
| What is the difference between RBAC and Azure Policy? | RBAC controls who can act; Policy controls what may exist and how it is configured. |
| System-assigned vs user-assigned managed identity? | System-assigned lives and dies with one resource; user-assigned is a separate resource shared by many. |
| What do NSGs filter? | Inbound and outbound traffic by source, destination, port and protocol, on subnets and NICs. |
| What is an application security group? | A label for NICs so NSG rules can target groups of VMs instead of IPs. |
| Why use NAT Gateway? | Predictable outbound IPs and plenty of SNAT ports for private subnets. |
| Availability set vs availability zone? | Sets spread VMs across fault and update domains in one datacentre; zones spread them across separate datacentres. |
| What does deallocating a VM stop? | Compute charges; disks and Standard public IPs still bill. |
| LRS, ZRS, GRS? | Three copies in one datacentre, across zones, or also copied to a paired region. |
| Hot, Cool, Cold, Archive? | Access tiers with falling storage price and rising access cost; Archive needs rehydration. |
| User delegation SAS vs account SAS? | User delegation SAS is signed with an Entra ID key and can be revoked; account SAS uses the account key. |
| Service endpoint vs private endpoint? | A service endpoint lets a subnet reach the public endpoint privately; a private endpoint gives the service a private IP in your VNet. |
| Why do private endpoints need DNS? | Clients must resolve the normal service name to the private IP through a privatelink zone. |
| Is VNet peering transitive? | No. Spokes need routing through a hub appliance or direct peering. |
| What does a user-defined route do? | Overrides Azure’s default path for a prefix, for example sending traffic to a firewall. |
| VPN Gateway vs ExpressRoute? | VPN is encrypted over the internet; ExpressRoute is a private provider link with BGP and an SLA. |
| Load Balancer vs Application Gateway? | Layer 4 for any TCP or UDP; Layer 7 for HTTP with path routing and WAF. |
| What causes a 502 on Application Gateway? | No healthy backend, or a request that times out or fails. |
| What does Azure Bastion give you? | RDP and SSH through the portal or native client without public IPs on VMs. |
| What is just-in-time VM access? | Defender for Cloud opens management ports only on request, for a limited time and source. |
| What does Azure Monitor Agent need? | The extension, an identity, a DCR association and a network path. |
| What is a data collection rule? | The definition of what to collect and where to send it, associated with machines. |
| What is the Activity log for? | Control-plane operations: who did what, when, kept 90 days. |
| Azure Backup vs Azure Site Recovery? | Backup restores data from points in time; Site Recovery replicates VMs for failover to another region. |
| What is soft delete in Key Vault? | Deleted vaults and objects are kept for 7 to 90 days and can be recovered. |
| Why use Bicep? | Readable infrastructure as code that compiles to ARM, with modules, what-if and type checks. |
| What does what-if show? | The changes a deployment would make before you run it. |
| What is a 429? | Throttling: slow down and retry after the time the service gives. |
| How do you start any troubleshooting? | Scope the problem, check whether Azure is healthy, then find what changed. |
This happened at work
The candidate who told stories
Two candidates applied for the same cloud operations role at a bank. Both had AZ-104.
The first answered every question with a definition. When asked about a time something broke, he said he hadn’t worked on production yet.
The second said, “I haven’t run production either, but I built a small shop on Azure and broke it ten ways on purpose.” She explained one fault: the website was up, but the servers couldn’t reach Key Vault or the internet. She described how the failing checks had one thing in common, how she found a missing outbound rule, and how a redeploy from Bicep fixed it.
The interviewer later said that answer got her the job: it showed a method, not memory. Your final project gives you ten stories like that. Use them.
Common mistakes and troubleshooting
| Mistake | What the interviewer hears | What to do instead |
|---|---|---|
| Answering with definitions only | No real experience | Add one story from your labs. |
| “I’d give it Owner” | Security risk | Name the smallest role at the right scope. |
| Jumping to a fix | No method | Start with scope, health, what changed. |
| Guessing when unsure | Overconfidence | Say how you’d find out, with the tool you’d use. |
| Ignoring cost | Expensive designs | Mention the price driver and a cheaper option. |
| Memorising old exam topics | Outdated knowledge | Read the current study guide before booking. |
Interview questions
Click a question to open it. Each one is written the way an interviewer would ask it. Under it you will see why they ask it and one way you could answer, in your own words.
Fresher level
1. Tell me about an Azure project you’ve done.
Why they ask this: They want a story.
How you might answer: Describe the final project: what you built from Bicep, one fault you fixed, how you found it, and what you’d improve.
2. Which Azure services have you used?
Why they ask this: Breadth check.
How you might answer: Group them: compute (VMs, scale sets), network (VNets, NSGs, peering, LB, App Gateway, Firewall, VPN), storage, identity (Entra ID, RBAC, managed identities), operations (Monitor, Backup, Policy, Bicep).
3. Why do you want to work in cloud operations?
Why they ask this: Motivation.
How you might answer: Talk about solving real problems, enjoying troubleshooting, and the scale and automation the cloud allows, with an example.
2–5 years experience
4. How do you handle a change that might cause downtime?
Why they ask this: Change management.
How you might answer: What-if or test first, a rollback plan, a maintenance window agreed with users, monitoring during the change, and a short note afterwards.
5. How do you keep Azure costs under control?
Why they ask this: FinOps basics.
How you might answer: Budgets and alerts, right-sizing, deallocating idle VMs, deleting leftovers, reservations for steady load, and tags for showback.
6. How do you secure a new subscription?
Why they ask this: Security baseline.
How you might answer: Entra ID with MFA and Conditional Access, least-privilege RBAC with PIM, policies for locations and tags, Defender for Cloud, no public management ports, diagnostic logs centralised.
Senior level
7. Design a highly available web app on Azure for one region.
Why they ask this: Architecture.
How you might answer: Zone-redundant gateway or Front Door, VMs or app services across zones, zone-redundant data services, private endpoints, Key Vault, monitoring and backup, and a tested failover plan.
8. How would you extend that design to two regions?
Why they ask this: DR depth.
How you might answer: Global entry with Front Door or Traffic Manager, data replication (geo-replication, ASR), infrastructure as code for the second region, and regular failover drills with defined RTO and RPO.
9. How do you lead an incident review?
Why they ask this: Leadership.
How you might answer: Blameless timeline in UTC, root cause and contributing factors, what detection missed, actions with owners and dates, and follow-up to make sure they happen.
Quick quiz
Q1. Passing score for AZ-104?
- 600
- 700
- 800
- 900
Show answer
B — 700 out of 1,000.
Q2. Which exam focuses on networking?
- AZ-104
- AZ-700
- AZ-305
- AZ-900
Show answer
B — AZ-700 is the network engineer exam.
Q3. A lock blocks your group delete. Error code?
- AuthorizationFailed
- ScopeLocked
- Conflict
- BadRequest
Show answer
B — Locks return ScopeLocked.
Q4. Best first step in a troubleshooting interview answer?
- Restart the VM
- Scope the problem
- Open a ticket
- Change the size
Show answer
B — Scope before action.
Q5. How are associate certifications renewed?
- Retake the exam
- Yearly online assessment on Microsoft Learn
- Never expire
- Pay a fee
Show answer
B — A yearly online assessment, at no cost.
Quick recap
Congratulations: you’ve finished Azure Cloud Administration, from your first resource group to troubleshooting a whole environment.
- Interviews test explaining, deciding and troubleshooting.
- Use your lab stories; the final project gives you ten.
- Map the course to the current exam study guides.
- Practise timed hands-on drills until 40 minutes feels easy.
- Keep learning: skills lists and services change every year.
What’s next
Go back to the course overview to revisit any lesson, redo the labs you found hardest, and book your exam when the drill feels easy. Good luck, and enjoy the work.
Further reading: Azure interview questions
Want to go deeper into Azure interview questions? See Microsoft’s study guides for AZ-104, AZ-700 and AZ-305. You can also see the full plan for this course on the Azure Cloud Administration course page.