# Azure Revision and Interview Questions — Azure

Source: https://www.skillbyai.com/en/azure/p-revision

> Recall the key Azure services and decisions under exam or interview pressure.

## Cheat sheet

**Hierarchy**: Entra tenant → management groups → subscriptions → resource groups → resources. **Identity**: Entra ID for authentication, Azure RBAC (principal + role + scope, inherited downward) for authorisation, managed identities instead of secrets. **Compute**: VMs/scale sets (full control), App Service (web PaaS, slots), Container Apps (serverless containers), AKS (managed Kubernetes), Functions (event-driven). **Messaging**: Service Bus (commands), Event Grid (discrete events, push), Event Hubs (streams). **Data**: Blob tiers Hot/Cool/Cold/Archive; LRS/ZRS/GRS/GZRS; Azure SQL, PostgreSQL Flexible, Cosmos DB (partition key, five consistency levels). **Network**: VNets, NSGs (low number first), non-transitive peering, private endpoints with privatelink DNS, Load Balancer / App Gateway / Front Door / Traffic Manager. **Ops**: Bicep + what-if, OIDC pipelines, Azure Monitor + KQL, Key Vault, Policy, Defender, budgets.

## Common interview questions

Practise answering each in two or three sentences with a trade-off.

```text
1. Resource group vs subscription: what is each boundary for?
2. Owner vs Contributor vs User Access Administrator?
3. System-assigned vs user-assigned managed identity: when each?
4. App Service vs Container Apps vs AKS for a new API?
5. Service Bus vs Event Grid vs Event Hubs, with an example each.
6. LRS vs ZRS vs GZRS: what failure does each survive?
7. How do you choose a Cosmos DB partition key?
8. Private endpoint vs service endpoint; why does DNS matter?
9. Front Door vs Application Gateway?
10. How would you deploy from GitHub to Azure without secrets?
```

## Answer with the decision, then the reason

Interviewers want judgement, not a list of product names. Start with "I would use Container Apps" and follow with the requirement it satisfies and the alternative you rejected.

**Quiz:** A Contributor on a resource group tries to give a teammate access to it. What happens?

- [ ] It succeeds because Contributor has full access
- [ ] It succeeds only for Reader access
- [ ] It fails because roles cannot be scoped to resource groups
- [x] It fails because Contributor cannot manage role assignments

*Answer:* It fails because Contributor cannot manage role assignments. Contributor can manage resources but not access; granting roles needs Owner, User Access Administrator or a role with role-assignment permissions.