In this article
Regions, zones and resilience
Cloud questions on any provider share the groundwork in the DevOps and cloud guide. Every entry cites the Microsoft Learn page it relies on, read in October 2026.
What is an Azure availability zone?
An availability zone is a logical grouping of one or more physically separate datacenters within a region (Microsoft Learn, availability zones). Each zone has independent power, cooling and networking, so if one zone has an outage the remaining zones support the regional services. A region that supports availability zones has at least three; Microsoft's region table lists four for East US 2, as of October 2026 (Microsoft Learn, availability zones). Not every Azure region supports availability zones (Microsoft Learn, regions and zones).
Why it is asked: it checks that you know a zone can hold several datacenters, not just one. Read the full explanation: Microsoft Learn, availability zones.
What is the difference between a region, an availability zone and a multi-region deployment?
A region is a geographic deployment boundary; the same term is used on Azure and Amazon Web Services (AWS) (Microsoft Learn, regions and zones). Zones sit inside one region and protect against the loss of a datacenter group. A multi-region deployment runs the application in more than one region, so it also survives a whole-region failure. Virtual Machine Scale Sets are a third layer, covering a rack-level or other localized hardware failure.
Why it is asked: it separates the three scopes of failure that a design must name. Read the full explanation: Microsoft Learn, regions and zones.
What is the difference between LRS, ZRS, GRS and GZRS?
Locally redundant storage (LRS) replicates data within a single physical datacenter in the primary region. Zone-redundant storage (ZRS) copies data synchronously across three or more availability zones in the primary region. Geo-redundant storage (GRS) keeps the LRS copies in the primary region and adds replication to a secondary region; geo-zone-redundant storage (GZRS) does the same starting from ZRS.
For high availability Microsoft recommends ZRS in the primary region plus replication to a secondary region (Microsoft Learn, storage redundancy). Data in the secondary region is not directly accessible unless a failover occurs, except in the read-access variants of GRS and GZRS, which allow reads from the secondary. LRS therefore does not protect against a datacenter-wide event, and only a second region, after failover, covers the loss of a whole region.
Text description of the diagram
- Locally redundant storage keeps data in one datacenter.
- Zone-redundant storage copies data across availability zones.
- Only a second region, after failover, covers the loss of a whole region.
Why it is asked: it tests whether you know which failure each redundancy option covers. Read the full explanation: Microsoft Learn, storage redundancy.
How do you design an Azure application for high availability?
Match the protection to the failure you must survive. Spread instances across availability zones for a datacenter-level failure, use zone-redundant storage, and add a second region if the business must survive a regional outage. Azure offers redundancy at every level of failure, including scale sets, zones and multi-region deployments (Microsoft Learn, regions and zones). Some services use several zones automatically while others need configuration, so check each service.
Why it is asked: it shows whether you design from failure scopes, not from product names. Read the full explanation: Microsoft Learn, using zones and regions.
How do you calculate the composite SLA of an application?
Multiply the service-level agreements (SLAs) of dependencies that are all required in series, assuming independent failures. With illustrative figures of 99.95% and 99.9%, the composite is 99.85%, which allows about 788.14 minutes of downtime a year against 262.8 and 525.6 for the parts.1 Two independent copies of the 99.9% part, either of which can serve, give 99.9999% on the same assumption.1 Read each real figure from the vendor's SLA page.
Why it is asked: it tests whether you know that every serial dependency lowers availability. Read the full explanation: Microsoft Learn, reliability metrics and targets.
Does latency between availability zones matter?
Yes, for sensitive workloads. Zones are joined by a high-bandwidth, low-latency network link (Microsoft Learn, Well-Architected Framework), which is sufficient for synchronous replication in most workloads. If a workload is sensitive to cross-zone latency, measure it and consider placing tightly coupled components close together, accepting that a single zone outage can take those components down.
Why it is asked: it checks that you weigh resilience against performance. Read the full explanation: Microsoft Learn, using zones and regions.
How do you route traffic across regions: Azure Front Door or Traffic Manager?
Azure Front Door is a global entry point for web (Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS)) traffic that routes requests to a healthy backend and can fail over between regions. Azure Traffic Manager is a Domain Name System (DNS) based global load balancer: it directs clients to an endpoint by how it answers name lookups (Microsoft Learn, load-balancing options). Choose Front Door for web applications that need application-layer routing; consider Traffic Manager for non-HTTP endpoints, and remember that DNS caching on clients can delay a failover.
Why it is asked: it tests whether you can pick the routing layer of a multi-region design, not just say "use two regions". Read the full explanation: Microsoft Learn, load-balancing options.
Identity and governance
What is Azure role-based access control (RBAC)?
Azure role-based access control (RBAC) grants access through role assignments (Microsoft Learn, Azure RBAC overview). A role assignment is a link that ties a person, group or application to a role at a scope such as a subscription, resource group or single resource. Access granted at a wider scope flows down to what it contains. A strong answer names least privilege: give the narrowest role at the narrowest scope that does the job.
Why it is asked: it tests whether you grant the narrowest access that works. Read the full explanation: Microsoft Learn, Azure RBAC overview.
What are Azure Resource Manager and a resource group?
Azure Resource Manager (ARM) is the management layer through which the portal, command line and templates create and change resources (Microsoft Learn, Azure Resource Manager overview). A resource group is a container that holds related resources so you can deploy, secure and delete them together. Resources in one group usually share a lifecycle, which is why you put a whole application's parts in one.
Why it is asked: it tests whether you understand how Azure organises what you deploy. Read the full explanation: Microsoft Learn, Azure Resource Manager overview.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →Compute and networking
How do you choose between a virtual machine, App Service, Functions and AKS?
Choose by how much you want to manage (Microsoft Learn, choose an Azure compute service). A virtual machine (VM) gives full control of the operating system and the most to maintain. App Service runs web apps without managing servers. Functions runs short event-driven code. Azure Kubernetes Service (AKS) suits many containers that need orchestration. Name the trade-off between control and operational effort; the more control a VM gives, the more administration it needs, and Linux commands covers those basics.
Why it is asked: it shows judgement, not memorised product lists. Read the full explanation: Microsoft Learn, choose an Azure compute service.
What is a virtual network and a network security group?
A virtual network is your private network in Azure, in which resources talk to each other (Microsoft Learn, virtual network overview). A network security group (NSG) is a set of allow and deny rules that filter traffic to and from the resources in a subnet or network interface, so a network is usually divided into subnets (Microsoft Learn, network security groups). A good answer adds that you open only the ports a service needs.
Why it is asked: it tests whether you can draw a network boundary and say what crosses it. Read the full explanation: Microsoft Learn, network security groups.
What is Azure Kubernetes Service and when would you use it?
Azure Kubernetes Service (AKS) is Azure's managed Kubernetes: the platform runs the control plane while you run the workloads on node pools (Microsoft Learn, AKS core concepts). Use it when you have many containerised services that need scheduling, scaling and rolling updates; skip it for one small app, where App Service is simpler. Know the Kubernetes basics first.
Why it is asked: it checks that you separate the managed service from Kubernetes itself. Read the full explanation: Kubernetes interview questions and answers.
Azure DevOps
What is Azure DevOps, and what is a pipeline?
Azure DevOps is Microsoft's set of services for planning work, hosting code, building, testing and releasing software. A pipeline is the automated sequence that builds and tests a change and can deploy it, split into stages and jobs that run on agents (Microsoft Learn, Azure Pipelines key concepts). The ideas match other build servers; compare them in what Jenkins is.
Why it is asked: it checks whether you can describe how a delivery pipeline is built and run. Read the full explanation: Microsoft Learn, Azure Pipelines key concepts.
Why define a pipeline as code instead of in a web editor?
A pipeline defined as a text file stored with the application (Microsoft Learn, Azure Pipelines key concepts) is versioned, reviewed and rolled back like any code, and a new branch carries its own build definition. A pipeline clicked together in a web editor lives outside the repository, so changes leave no review trail. Say that secrets belong in a secret store or variable group, never in the file.
Why it is asked: it tests whether you treat delivery as engineering. Read the full explanation: Microsoft Learn, Azure Pipelines key concepts.
What is the difference between Microsoft-hosted and self-hosted agents?
An agent is the machine that runs the jobs of a pipeline. Microsoft-hosted agents are maintained by Microsoft and each job gets a fresh virtual machine, so there is nothing to patch. Self-hosted agents are machines you install and maintain yourself, which lets a job reach private networks or use custom software, at the cost of looking after them (Microsoft Learn, Azure Pipelines agents). Name the trade-off between convenience and control.
Why it is asked: it tests whether you can match the build machine to the job. Read the full explanation: Microsoft Learn, Azure Pipelines agents.
What are stages, jobs and steps, and how do environments add approvals?
A pipeline is split into stages, such as build, test and deploy; a stage holds jobs; a job holds steps (Microsoft Learn, key concepts). An environment is a named deployment target, and approvals and checks can be attached to it so that a deployment waits for a person or a condition before it runs (Microsoft Learn, environments). Put the approval on the production environment, not on every stage.
Why it is asked: it tests whether you can add a safe gate to a release. Read the full explanation: Microsoft Learn, environments.
How do service connections and Key Vault-linked variable groups handle secrets?
A service connection is a stored, named connection that lets a pipeline reach an external service such as an Azure subscription (Microsoft Learn, service connections). A variable group is a shared set of values for pipelines, and it can be linked to Azure Key Vault so that secrets are fetched at run time instead of being written into the pipeline file (Microsoft Learn, variable groups). Give each connection only the access its pipeline needs.
Why it is asked: it tests whether you keep credentials out of source code. Read the full explanation: Microsoft Learn, variable groups.
Data
What is Azure Data Factory and what does a pipeline do there?
Azure Data Factory is a managed service for moving and transforming data on a schedule or trigger (Microsoft Learn, Data Factory introduction). Its pipeline is a group of activities, such as copy, transform or run a notebook, that together do one job (Microsoft Learn, pipelines and activities). An integration runtime is the compute that executes those activities and reaches data in different networks (Microsoft Learn, integration runtime). Keep the answer to what each piece does.
Why it is asked: it tests whether you can describe orchestration piece by piece. Read the full explanation: Microsoft Learn, Data Factory introduction.
How would you load only new data each day instead of everything?
Load incrementally: store a watermark, such as the latest modified timestamp or key already loaded, read only rows newer than it, load them, then advance the watermark after success. A full reload is simpler but costs more time and money as data grows. Mention making the load safe to rerun, so a retry cannot create duplicates.
Why it is asked: it tests whether you can avoid reloading everything and still stay safe to rerun. Read the full explanation: Microsoft Learn, incremental loading in Data Factory.
What is the hierarchical namespace in Azure Data Lake Storage Gen2?
Azure Data Lake Storage Gen2 is storage built on Azure Blob Storage for analytics. Its hierarchical namespace organises objects into directories and subdirectories, as a file system does, instead of a flat list of names (Microsoft Learn, Data Lake Storage Gen2 introduction). That makes directory operations such as rename and delete work on the directory itself, and allows access control on directories and files. Say why analytics jobs benefit.
Why it is asked: it tests whether you know why a data lake is more than plain object storage. Read the full explanation: Microsoft Learn, Data Lake Storage Gen2 introduction.
A nightly copy activity failed halfway. What do you do?
Handle it in three layers. First, set a retry on the activity for transient faults (Microsoft Learn, pipelines and activities). Second, make the load idempotent, which means a rerun gives the same result as one clean run: for example overwrite the target partition or upsert on a key, so a retry cannot duplicate rows. Third, raise an alert on a failed run so a person hears about it (Microsoft Learn, Azure Monitor for Data Factory). Then explain how you would find the cause.
Why it is asked: it is the scenario question that separates people who have run pipelines in production. Read the full explanation: Microsoft Learn, Azure Monitor for Data Factory.
Machine learning and AI
What do interviewers mean by Azure MLOps?
Machine learning operations (MLOps) means applying delivery discipline to models: versioned data and code, reproducible training, a registered model, automated deployment, and monitoring for drift after release. On Azure, Azure Machine Learning is the platform to learn (Microsoft Learn, MLOps with Azure Machine Learning), and a good answer describes the loop end to end rather than listing features.
Why it is asked: it separates people who trained one model from people who can run models in production. Read the full explanation: Microsoft Learn, MLOps with Azure Machine Learning.
What should you know about Azure OpenAI Service?
Azure OpenAI is documented as part of Microsoft's Foundry platform for AI models (Microsoft Learn, Azure OpenAI quota). Know three ideas. A deployment is a named instance of a model that your application calls. Quota is assigned to your subscription on a per-region, per-model basis in units of tokens per minute (TPM), so plan capacity (Microsoft Learn, Azure OpenAI quota). Content filtering screens prompts and responses (Microsoft Learn, content filtering). Add the design points interviewers value: keep keys in a secret store, limit access by role, and handle throttling with retries.
Why it is asked: it checks practical readiness for generative artificial intelligence (AI) work, not buzzwords. Read the full explanation: Microsoft Learn, Azure OpenAI quota.
Follow-up questions
What are the common Azure data engineer interview questions?
Expect orchestration (pipelines, triggers), incremental loading, storage redundancy and access control, plus scenario questions on failures and reruns. The data entries above and the DevOps and cloud guide cover the shared groundwork.
How do Azure interview questions change with years of experience?
Early questions ask for definitions; later ones ask you to choose between options and defend the trade-off, such as zone-redundant storage against a second region. As an illustration of how to prepare, a junior answer explains what a copy activity and an incremental load are; a mid-level answer designs a rerun-safe load with retries and alerts; a senior answer chooses between redundancy options, routing layers and cost. This is advice on how to prepare, not a published rubric. Beyond cloud-specific pages, browse the full learning library.
What are Azure DevOps interview questions and answers?
They centre on pipelines, stages, agents, keeping the pipeline in the repository, and managing secrets. See the Azure DevOps entries above, and compare with the build-server ideas in what Jenkins is.
What are Azure MLOps and Azure AI interview questions?
They ask you to describe the model lifecycle end to end and to reason about deployments, quotas, filtering and monitoring. Prepare one worked story of taking a model from training to a monitored release.
What are Azure cloud solution architect interview questions?
They ask you to design for a stated failure or load and defend the choice: zones against a second region, Front Door against Traffic Manager, a virtual machine against a managed service. Start from the entries on regions, zones and compute above and name the trade-off each time.
- A zone is one or more separate datacenters inside a region; zones do not protect against a whole-region failure.
- LRS stays in one datacenter, ZRS spans zones, and GRS or GZRS add a second region that covers regional loss after failover.
- Serial dependencies multiply their SLAs, so the composite is always lower than any single part.
- Choose compute by how much you want to manage, and name the trade-off.
- For Azure DevOps, data and machine learning, describe the end-to-end flow, not a feature list.
Sources
- What are Azure availability zones? (Microsoft Learn) — Microsoft Learn (Azure Reliability), accessed 2026-10-26, 26 Oct 2026
- Data redundancy - Azure Storage (Microsoft Learn) — Microsoft Learn (Azure Storage), accessed 2026-10-26, 26 Oct 2026
- Regions and zones on Azure and AWS (Microsoft Learn) — Microsoft Learn (Azure Architecture Center), accessed 2026-10-26, 26 Oct 2026
- Using availability zones and regions (Microsoft Learn) — Microsoft Learn (Azure Well-Architected Framework), accessed 2026-10-26, 26 Oct 2026
- Reliability metrics and targets (Microsoft Learn) — Microsoft Learn (Azure Well-Architected Framework), accessed 2026-10-26, 26 Oct 2026
- What is Azure role-based access control (Microsoft Learn) — Microsoft Learn (Azure RBAC), accessed 2026-10-26, 26 Oct 2026
- What is Azure Resource Manager (Microsoft Learn) — Microsoft Learn (Azure Resource Manager), accessed 2026-10-26, 26 Oct 2026
- Choose an Azure compute service (Microsoft Learn) — Microsoft Learn (Azure Architecture Center), accessed 2026-10-26, 26 Oct 2026
- Azure Virtual Network overview (Microsoft Learn) — Microsoft Learn (Azure Virtual Network), accessed 2026-10-26, 26 Oct 2026
- Network security groups overview (Microsoft Learn) — Microsoft Learn (Azure Virtual Network), accessed 2026-10-26, 26 Oct 2026
- Core concepts for Azure Kubernetes Service (Microsoft Learn) — Microsoft Learn (Azure Kubernetes Service), accessed 2026-10-26, 26 Oct 2026
- Azure Pipelines key concepts (Microsoft Learn) — Microsoft Learn (Azure DevOps), accessed 2026-10-26, 26 Oct 2026
- Azure Pipelines agents (Microsoft Learn) — Microsoft Learn (Azure DevOps), accessed 2026-10-26, 26 Oct 2026
- Environments in Azure Pipelines (Microsoft Learn) — Microsoft Learn (Azure DevOps), accessed 2026-10-26, 26 Oct 2026
- Service connections (Microsoft Learn) — Microsoft Learn (Azure DevOps), accessed 2026-10-26, 26 Oct 2026
- Variable groups (Microsoft Learn) — Microsoft Learn (Azure DevOps), accessed 2026-10-26, 26 Oct 2026
- What is Azure Data Factory (Microsoft Learn) — Microsoft Learn (Azure Data Factory), accessed 2026-10-26, 26 Oct 2026
- Integration runtime in Azure Data Factory (Microsoft Learn) — Microsoft Learn (Azure Data Factory), accessed 2026-10-26, 26 Oct 2026
- Incremental loading overview in Azure Data Factory (Microsoft Learn) — Microsoft Learn (Azure Data Factory), accessed 2026-10-26, 26 Oct 2026
- Pipelines and activities in Azure Data Factory (Microsoft Learn) — Microsoft Learn (Azure Data Factory), accessed 2026-10-26, 26 Oct 2026
- Monitor Azure Data Factory with Azure Monitor (Microsoft Learn) — Microsoft Learn (Azure Data Factory), accessed 2026-10-26, 26 Oct 2026
- Introduction to Azure Data Lake Storage Gen2 (Microsoft Learn) — Microsoft Learn (Azure Storage), accessed 2026-10-26, 26 Oct 2026
- Load-balancing options (Microsoft Learn) — Microsoft Learn (Azure Architecture Center), accessed 2026-10-26, 26 Oct 2026
- Machine learning operations model management and deployment (Microsoft Learn) — Microsoft Learn (Azure Machine Learning), accessed 2026-10-26, 26 Oct 2026
- Manage Azure OpenAI quota (Microsoft Learn) — Microsoft Learn (Azure AI Foundry), accessed 2026-10-26, 26 Oct 2026
- Content filtering in Azure OpenAI (Microsoft Learn) — Microsoft Learn (Azure AI Foundry), accessed 2026-10-26, 26 Oct 2026
