Azure Fundamentals Interview Questions 2026: AZ-900 & Core Services

Candidates report that Azure Fundamentals interviews cover both AZ-900 exam concepts and practical understanding of core services. Confirm the current exam objectives and service names (Microsoft has renamed several services recently, e.g., Azure AD to Microsoft Entra ID) on the official Microsoft Learn portal before your interview.

The AZ-900 exam and Azure Fundamentals interviews test cloud concepts, core Azure services, pricing, support, and governance. This guide covers all major domains.

---

Cloud Concepts

Q1. What are the three cloud deployment models, and how does Azure support each?

Public Cloud Infrastructure owned and operated by a cloud provider, shared across multiple customers.

Azure Public Cloud: Azure regions globally (60+ regions)
- Resources accessed via internet
- Pay-as-you-go or reserved pricing
- Azure handles hardware, patching, physical security
- Customer manages: apps, data, IAM, OS (for IaaS)

Private Cloud Infrastructure dedicated to a single organization, operated on-premises or by a third party.

Azure Private Cloud options:
- Azure Stack Hub: run Azure services in your own datacenter
- Azure Stack Edge: compute + AI at edge locations
- Azure Arc: manage on-premise/multi-cloud resources from Azure portal

Hybrid Cloud Combination of public and private cloud, connected to allow workloads to move between them.

Azure hybrid services:
- Azure VPN Gateway: encrypt on-premise to Azure over internet
- Azure ExpressRoute: private dedicated connection to Azure (up to 100 Gbps)
- Azure Arc: unified management plane for hybrid resources
- Azure File Sync: sync on-premise file servers to Azure Files

Multi-Cloud: Many organizations also use multiple cloud providers. Azure Arc extends Azure management to AWS and GCP resources.

---

Q2. What is the difference between IaaS, PaaS, and SaaS on Azure?

Shared responsibility matrix:

---

Q3. What are the key cloud benefits that Azure provides?

High Availability: Azure SLAs guarantee uptime. Multi-region deployments with Azure Traffic Manager provide 99.99%+ availability. Availability Zones within a region protect against datacenter failure.

Scalability:

• Vertical scaling (scale up): move to larger VM SKU.
• Horizontal scaling (scale out): Azure Virtual Machine Scale Sets auto-add/remove VMs.
• Serverless (Azure Functions, Logic Apps): scales from 0 to millions of requests.

Elasticity: Pay only for what you use. Azure Autoscale adjusts capacity in response to demand (CPU, custom metrics, schedule).

Agility: Provision resources in minutes via portal, CLI, ARM templates, or Bicep. Self-service without hardware procurement cycles.

Disaster Recovery: Azure Site Recovery (ASR) replicates on-premise or Azure VMs to a secondary region. One-click failover. Azure Backup for application-consistent backups.

Economies of scale: Microsoft's global purchasing power means lower per-unit cost than individual enterprise procurement.

---

Core Azure Services

Q4. What are Azure's core compute services?

Azure Virtual Machines (VMs) IaaS. Full OS control. Windows or Linux. Use for: lift-and-shift migrations, legacy apps, custom configurations.

VM families:
- General Purpose (D-series): balanced CPU/memory
- Compute Optimized (F-series): high CPU-to-memory
- Memory Optimized (E/M-series): large memory (SAP HANA)
- Storage Optimized (L-series): local NVMe storage
- GPU (N-series): ML training, rendering, visualization

Azure App Service PaaS for web apps. Supports .NET, Java, Python, Node.js, PHP, Ruby. Automatic OS patching, scaling, SSL, custom domains. App Service Plans define compute tier.

Azure Functions Serverless compute. Event-driven (HTTP trigger, Timer, Service Bus, Blob, Cosmos DB, etc.). Consumption plan: pay per execution. Premium plan: warm instances, VNet integration.

Azure Container Instances (ACI) Run containers without managing servers. Best for short-lived batch jobs or burst compute.

Azure Kubernetes Service (AKS) Managed Kubernetes. Microsoft manages the control plane; you manage worker nodes. Integrates with Azure AD, Azure Monitor, Azure Container Registry.

Azure Virtual Machine Scale Sets (VMSS) Auto-scaling group of identical VMs. Supports up to 1,000 VMs. Integrates with Azure Load Balancer and Azure Autoscale.

---

Q5. What are Azure's core storage services?

Azure Blob Storage Object storage for unstructured data: images, videos, backups, logs, data lake.

Access tiers:
- Hot: frequently accessed (highest storage cost, lowest access cost)
- Cool: infrequently accessed (30-day minimum, lower storage cost)
- Cold: rarely accessed (90-day minimum)
- Archive: near-line (180-day minimum, hours to rehydrate)

Blob types:
- Block Blobs: most common (text, binary, videos)
- Append Blobs: log file appending
- Page Blobs: VHD files for Azure VM disks (random read/write)

Azure Files Fully managed SMB/NFS file shares in the cloud. Mount on Windows, Linux, macOS. Replace on-premise file servers with Azure File Sync.

Azure Disk Storage Managed disks for Azure VMs.

- Standard HDD: dev/test, infrequent access
- Standard SSD: production workloads with lower IOPS needs
- Premium SSD: mission-critical OLTP (up to 20,000 IOPS)
- Ultra Disk: highest IOPS and throughput (database workloads)

Azure Queue Storage Simple message queue for decoupling application components. Up to 64 KB per message, 7-day retention. For larger messages or more features, use Azure Service Bus.

Azure Table Storage NoSQL key-value store for structured data. Part of Azure Cosmos DB for Table API (table storage is the legacy version).

Storage replication options:

---

Q6. What are Azure's core database services?

Azure SQL Database Fully managed PaaS relational database (SQL Server engine). Automatic backups, patching, HA. Serverless tier scales compute to zero. Hyperscale tier: up to 100 TB, rapid scale.

Azure Cosmos DB Globally distributed, multi-model NoSQL database. APIs: Core (SQL), MongoDB, Cassandra, Gremlin (graph), Table. Single-digit millisecond latency. 99.999% availability SLA. Multi-region writes with automatic conflict resolution.

Azure Database for MySQL / PostgreSQL / MariaDB Managed versions of popular open-source databases. Automatic backups, patching, HA with standby replica.

Azure Synapse Analytics Unified analytics platform combining data warehousing (SQL Pools -- formerly SQL Data Warehouse) + big data (Spark Pools) + data integration (Synapse Pipelines, built on ADF) in one service.

Azure Cache for Redis Managed Redis. Used for: session store, application cache, leaderboards, pub/sub messaging.

---

Q7. What is Azure Networking, and what are the core network services?

Azure Virtual Network (VNet) Private network in Azure. Subnets, address spaces, security boundaries. Similar to AWS VPC.

Address space: 10.0.0.0/16
  Subnets:
    10.0.1.0/24 -- web tier (public, with internet access)
    10.0.2.0/24 -- app tier (private, no direct internet)
    10.0.3.0/24 -- data tier (private, isolated)

Azure Load Balancer Layer 4 (TCP/UDP). Internal (private) or public. Hash-based distribution, health probes.

Azure Application Gateway Layer 7 HTTP/HTTPS. URL-based routing, SSL termination, WAF (Web Application Firewall). Similar to AWS ALB.

Azure Front Door Global CDN + WAF + load balancer. Routes to fastest region, caches at edge POPs, anycast routing. Similar to AWS CloudFront + Global Accelerator combined.

Azure VPN Gateway Site-to-site VPN: connect on-premise to Azure VNet over encrypted internet tunnel. Point-to-site VPN: individual device to Azure VNet.

Azure ExpressRoute Dedicated private connection from on-premise to Azure (via a connectivity provider). Not over public internet. Up to 100 Gbps. Used for: hybrid cloud, compliance requirements, consistent low latency.

Azure DNS Host public DNS zones in Azure (high availability, fast resolution). Private DNS zones for name resolution within VNets without exposing to internet.

---

Security and Identity

Q8. What are the key Azure security services?

Microsoft Entra ID (formerly Azure Active Directory) Cloud identity and access management.

Key capabilities:
- SSO to 3,000+ SaaS applications
- MFA enforcement (authenticator app, SMS, FIDO2)
- Conditional Access: require MFA + compliant device for sensitive apps
- Privileged Identity Management (PIM): just-in-time admin access
- Identity Protection: ML-based risk detection (impossible travel, leaked credentials)
- B2B: invite external users as guests
- B2C: customer identity management (100M+ users)

Azure Key Vault Centralized secrets management.

from azure.keyvault.secrets import SecretClient
from azure.identity import DefaultAzureCredential

# Use managed identity -- no credentials in code
credential = DefaultAzureCredential()
client = SecretClient(vault_url="https://myvault.vault.azure.net", credential=credential)

# Retrieve secret
db_password = client.get_secret("database-password").value

Azure Defender for Cloud (formerly Azure Security Center) Unified security management and threat protection. Secure Score: measures your security posture (0-100). Recommendations: actionable steps to improve score. Alerts: detected threats across VMs, containers, databases, networks.

Azure Sentinel (Microsoft Sentinel) Cloud-native SIEM + SOAR. Collects security data across enterprise (Azure, on-premise, other clouds). ML-based anomaly detection, automated incident response playbooks (Logic Apps).

Azure DDoS Protection

• Basic: always-on, automatic protection included free for all Azure resources.
• Standard: enhanced protection with attack telemetry, rapid response support, cost protection guarantee.

---

Q9. What is the Azure Trust Center and compliance certifications?

Azure compliance portfolio (common interview mentions):

Microsoft Trust Center: Central portal for Azure compliance documentation, audit reports, privacy policies.

Azure Compliance Manager: Tool to assess compliance posture, track implementation of controls, generate compliance reports.

Data residency: Azure regions allow customers to choose geographic location for data storage. Paired regions (e.g., East US/West US, UK South/UK West) ensure data stays within the same geopolitical boundary for compliance.

---

Azure Governance

Q10. What are Azure Management Groups, Subscriptions, Resource Groups, and Resources?

Hierarchy:

Management Groups (root tenant level)
  |-- Management Group: Production
  |     |-- Subscription: Prod-East
  |     |     |-- Resource Group: webapp-prod-rg
  |     |           |-- VM, App Service, SQL DB, Storage...
  |     |-- Subscription: Prod-West
  |-- Management Group: Development
        |-- Subscription: Dev-Team-A
        |-- Subscription: Dev-Team-B

Management Groups Group multiple subscriptions for policy inheritance and RBAC. Root management group contains all subscriptions. Up to 6 levels of hierarchy.

Subscriptions Billing boundary + access control boundary. Separate subscriptions for: prod/dev isolation, department chargebacks, regional deployments.

Resource Groups Logical container for related resources (same lifecycle, same app). Resources must belong to exactly one resource group. Delete resource group to delete all resources. Apply tags, RBAC, policies at this level.

Resources Individual service instances (VM, storage account, database, etc.).

---

Q11. What are Azure Policies and Role-Based Access Control (RBAC)?

Azure Policy Enforce organizational standards and assess compliance at scale.

// Policy: require tags on all resources
{
  "if": {
    "field": "tags['Environment']",
    "exists": "false"
  },
  "then": {
    "effect": "deny"
  }
}

Policy effects:

• Deny: Prevent non-compliant resource creation.
• Audit: Log non-compliant resources (no blocking).
• Append: Add fields to resource properties.
• Modify: Add/update tags during create/update.
• DeployIfNotExists: Deploy a related resource if it doesn't exist.

Policy initiatives (policy sets): Groups of policies applied together. Example: "CIS Microsoft Azure Foundations Benchmark" -- 100+ policies bundled.

Azure RBAC: Role-based access control with 3 key components:

• Principal: Who? (User, Group, Service Principal, Managed Identity)
• Role Definition: What actions? (built-in or custom role with allowed/denied actions)
• Scope: Where? (management group / subscription / resource group / resource)

Built-in roles:

# Assign Reader role on resource group
az role assignment create \
    --assignee "[email protected]" \
    --role "Reader" \
    --scope "/subscriptions/{sub-id}/resourceGroups/webapp-rg"

---

Q12. What is Azure Blueprint?

Azure Blueprints package governance components (policies, RBAC, resource groups, ARM templates) into a single repeatable definition that can be applied to multiple subscriptions.

Blueprint components:

1. Policy assignments: Enforce compliance rules.
2. Role assignments: Set up access control.
3. Resource Groups: Ensure consistent structure.
4. ARM templates: Deploy specific resources (monitoring, networking).

Use case: New subscription onboarding. Apply a "Secure Baseline" blueprint that: creates standard resource groups, applies compliance policies, sets up monitoring, assigns roles -- all in one operation. Blueprint assignment is tracked (unlike ARM templates deployed directly); can audit which subscriptions have the blueprint applied and at what version.

---

Azure Pricing and Management

Q13. How does Azure pricing work, and what tools manage costs?

Pricing models:

Pay-As-You-Go (PAYG) No commitment. Pay per second/hour/GB. Most expensive per unit, zero commitment.

Reserved Instances (1-year or 3-year) Pre-pay for specific VM family/region/OS. 40-72% savings over PAYG. Can exchange or cancel with fees.

Azure Savings Plans for Compute Commit to spend ($/hour) for 1 or 3 years. Applies automatically to any eligible compute (VMs, Functions, ACI) in any region. More flexible than Reserved Instances.

Spot VMs (Azure Spot) Use surplus Azure capacity at up to 90% discount. Evicted with 30-second notice when Azure needs capacity. For: batch jobs, dev/test, fault-tolerant workloads.

Azure Hybrid Benefit Use existing Windows Server / SQL Server / Linux licenses on Azure. Up to 40% savings on VMs + additional savings on SQL databases. Also applies to AKS (license discount for node VMs).

Cost management tools:

Cost control strategies:

1. Budgets with alerts: alert at 80%, 100%, 120% of budget
2. Tags: tag by department/project for cost allocation reports
3. Auto-shutdown: dev/test VMs shut down nights/weekends
4. Right-sizing: Azure Advisor + VM Insights identify over-provisioned VMs
5. Delete unused resources: unattached disks, idle VMs, orphaned snapshots

---

Q14. What is Azure Monitor, and how does it provide observability?

Azure Monitor is the umbrella monitoring service collecting metrics and logs from all Azure resources.

Data sources:

Azure resources -> Azure Monitor
  |-- Metrics: numerical time-series (CPU, memory, requests/sec)
  |-- Logs (Azure Monitor Logs / Log Analytics): structured log data
  |-- Traces: Application Insights distributed tracing
  |-- Events: Activity Log (who did what in Azure), Resource Health

Log Analytics workspace: Central repository for logs. Queried using Kusto Query Language (KQL).

// Find VMs with CPU > 90% in last hour
Perf
| where ObjectName == "Processor"
| where CounterName == "% Processor Time"
| where TimeGenerated > ago(1h)
| where CounterValue > 90
| summarize avg(CounterValue) by Computer
| order by avg_CounterValue desc

Azure Alerts:

• Metric alerts: trigger when metric crosses threshold.
• Log alerts: trigger on KQL query results.
• Activity Log alerts: trigger on Azure operations (e.g., "VM deleted").
• Smart detection: Application Insights auto-detects anomalies.

Action Groups: Reusable set of notification/action recipients. Email, SMS, webhook, Azure Function, Logic App, ITSM connector.

Application Insights: APM (Application Performance Monitoring) for web apps. Auto-collected: request rates, response times, failures, dependencies. Distributed tracing across microservices. Live Metrics stream.

Azure Service Health: Personalized view of Azure service incidents, planned maintenance, and health advisories affecting your subscriptions and regions. Distinct from Azure Status page (all Azure globally).

---

Azure Developer Services

Q15. What is Azure App Service, and what are its key features?

Azure App Service is a fully managed PaaS for hosting web applications, REST APIs, and mobile backends.

App Service Plan tiers:

Key features:

- Deployment slots: staging -> production slot swap (zero downtime deployment)
  Traffic splitting: 10% to staging, 90% to production (A/B testing)
  
- Auto-scaling: scale based on CPU, memory, queue depth, custom metrics
  Schedule-based: scale to 10 instances weekdays 9-5
  
- Managed TLS: free certificates for custom domains
  
- Custom domains: CNAME or A record, verified via TXT record
  
- VNet Integration: App Service (Premium) -> private VNet resources
  
- App Service Environment (ASE): dedicated infrastructure in your VNet
  For: strict compliance, internal-only apps, dedicated compute

Deployment options:

# GitHub Actions CI/CD
- Push to main -> GitHub Actions builds + deploys to staging slot
- Manual approval -> slot swap to production

# Azure CLI deployment
az webapp deployment source config-zip \
    --resource-group myRG \
    --name myapp \
    --src app.zip

# Container deployment
az webapp config container set \
    --resource-group myRG \
    --name myapp \
    --docker-custom-image-name myregistry.azurecr.io/myapp:v2

---

Q16. What are Azure DevOps services?

Azure DevOps is a suite of developer services for end-to-end DevOps:

Azure Pipelines example (YAML):

trigger:
  branches:
    include: [main]

pool:
  vmImage: 'ubuntu-latest'

stages:
- stage: Build
  jobs:
  - job: BuildAndTest
    steps:
    - task: UsePythonVersion@0
      inputs:
        versionSpec: '3.11'
    - script: |
        pip install -r requirements.txt
        pytest tests/ --junitxml=test-results.xml
      displayName: 'Run tests'
    - task: PublishTestResults@2
      inputs:
        testResultsFiles: 'test-results.xml'
    - task: Docker@2
      inputs:
        command: 'buildAndPush'
        containerRegistry: 'myACRServiceConnection'
        repository: 'myapp'
        tags: '$(Build.BuildId)'

- stage: Deploy
  dependsOn: Build
  condition: succeeded()
  jobs:
  - deployment: DeployToProduction
    environment: production
    strategy:
      runOnce:
        deploy:
          steps:
          - task: AzureWebApp@1
            inputs:
              azureSubscription: 'my-azure-service-connection'
              appName: 'my-web-app'
              package: '$(Pipeline.Workspace)/**/*.zip'

---

Real-World Scenarios

Q17. How would you migrate an on-premise application to Azure?

Azure Migration Framework (5 Rs):

Assessment phase (Azure Migrate):

Azure Migrate Hub:
1. Discovery: install Azure Migrate appliance on-premise
   Discovers: VMs (VMware, Hyper-V, physical), databases, web apps
2. Assessment: size VMs correctly for Azure, estimate costs
   Dependency analysis: identify apps that need to move together
3. Migration: replicate VMs to Azure with minimal downtime
   Azure Site Recovery agent for replication
   Cutover: stop replication, redirect traffic

Database migration:

- SQL Server to Azure SQL Database: Azure Database Migration Service
- Assessment: Data Migration Assistant (DMA) identifies compatibility issues
- Migration: online (minimal downtime) or offline
- Post-migration: validate queries, performance, connections

---

Q18. Design a highly available web application on Azure.

Architecture:

Users -> Azure Front Door (global CDN + WAF + load balancing)
              |
              v
        Azure Application Gateway (regional WAF + SSL termination)
              |
              v
        VM Scale Set or App Service (Premium, multi-AZ)
        [Stateless application tier]
              |
         _____|_____
        |           |
     Azure SQL    Azure Cache
     Database     for Redis
  (Business Critical, (session store,
   Zone-redundant)    app cache)

High availability design choices:

SLA composition:

App Service (99.95%) * SQL DB Business Critical (99.99%) * Front Door (99.99%)
= ~99.93% combined SLA

---

FAQ

Q: What is the difference between Azure and on-premises Total Cost of Ownership? On-premises costs include: hardware procurement, datacenter space/power/cooling, hardware maintenance, IT staff for patching and administration, upfront capital expenditure, and underutilization (most servers run at 15-20% average CPU). Azure converts capital expenses (CapEx) to operational expenses (OpEx), eliminates datacenter costs, provides elasticity to match costs with actual usage, and includes high availability and patching in service pricing. The Azure TCO Calculator helps model this comparison. Confirm with actual vendor quotes for your specific workload scale.

Q: What is Azure Resource Manager and how does it differ from classic deployment? Azure Resource Manager (ARM) is the current deployment model (introduced 2014). All resources are deployed as a group with a common lifecycle (Resource Groups). ARM templates provide infrastructure-as-code. Consistent API for all management operations. Classic deployment (Azure Service Manager) is the legacy model, deprecated. Microsoft migrated all classic resources to ARM. Always use ARM/Bicep for new deployments. Confirm migration deadlines for any classic resources on the official Azure retirement notices page.

Q: How do Azure Availability Zones protect against failures? Each Azure region with AZ support has at least 3 Availability Zones -- physically separate datacenters within the region with independent power, cooling, and networking. Azure services deployed as zone-redundant automatically replicate across all three AZs (e.g., Zone-Redundant Storage, Azure SQL Business Critical, Application Gateway v2). Services deployed as zonal are pinned to a specific AZ (e.g., a VM in AZ-1). If AZ-1 goes down, zone-redundant services remain available via AZ-2 and AZ-3. SLAs improve when deploying across AZs (e.g., Azure SQL Business Critical: 99.99% with AZs vs 99.95% single-AZ).

---

Related Topics

• AWS Solutions Architect Interview Questions
• GCP Interview Questions
• DevOps Engineer Interview Questions
• MLOps Interview Questions
• Data Science Interview Questions