Azure developer scenario questions with answers

1. Q1. Your App Service needs to read secrets from Key Vault and data from Azure SQL. How do you do it without storing any credentials?

   Turn on a managed identity for the App Service (system-assigned, or user-assigned if several resources share it). Grant that identity the 'Key Vault Secrets User' role on the vault and create a database user for it in Azure SQL.

   In code, use DefaultAzureCredential from Azure.Identity. It uses the managed identity in Azure and your developer sign-in locally, so the same code works in both places and there is no secret to rotate or leak.

   var client = new SecretClient(
       new Uri("https://my-vault.vault.azure.net/"),
       new DefaultAzureCredential());
   KeyVaultSecret secret = await client.GetSecretAsync("ApiKey");

   Official documentation

2. Q2. Compare the Azure Functions Flex Consumption, Premium and Dedicated plans. Which would you pick for an API that must respond quickly but has quiet nights?

   Flex Consumption scales to zero and bills per execution, with optional always-ready instances and VNet support. Premium keeps pre-warmed instances (no cold start) with VNet integration and longer runs, billed for the instances you keep. Dedicated runs on an App Service plan you already pay for.

   For a latency-sensitive API with quiet periods, Flex Consumption with one or two always-ready instances is usually the best balance; choose Premium if you need its specific features. The legacy Linux Consumption plan is being retired, so new apps should not start on it.

   Official documentation

3. Q3. When would you use Azure Service Bus instead of Azure Storage Queues?

   Storage Queues are simple and cheap: large queues, at-least-once delivery, messages up to 64 KB, basic visibility timeouts.

   Service Bus is an enterprise broker: topics and subscriptions (publish/subscribe), sessions for ordered processing, duplicate detection, dead-letter queues, scheduled messages, transactions and larger messages. Choose Service Bus when you need ordering, pub/sub or these delivery guarantees; Storage Queues when you just need a simple backlog.

   Official documentation

4. Q4. How do you choose a partition key in Azure Cosmos DB, and what goes wrong with a bad one?

   Pick a property with many distinct values that spreads both storage and requests evenly, and that appears in most of your queries' filters, such as tenantId or userId (or a hierarchical key such as tenant then user).

   A bad key (for example country or a date) creates hot partitions: one logical partition takes most of the traffic and gets throttled (HTTP 429) while the rest of the provisioned throughput sits idle. Queries without the partition key fan out across partitions and cost more RUs. The partition key can't be changed later without migrating data.

   Official documentation

5. Q5. Logs must be kept for 7 years but are rarely read after 30 days. How do you keep Blob Storage costs low?

   Use access tiers with a lifecycle management policy: Hot for recent data, then move blobs to Cool after 30 days, Cold later, and Archive for long-term retention, and delete them after 7 years.

   Archive is the cheapest to store but blobs are offline: reading one needs rehydration, which can take hours, and early deletion fees apply. For compliance, add an immutability (WORM) policy so logs can't be changed or deleted early.

   {
     "rules": [{
       "name": "logs",
       "type": "Lifecycle",
       "definition": {
         "filters": { "blobTypes": ["blockBlob"], "prefixMatch": ["logs/"] },
         "actions": { "baseBlob": {
           "tierToCool": { "daysAfterModificationGreaterThan": 30 },
           "tierToArchive": { "daysAfterModificationGreaterThan": 180 },
           "delete": { "daysAfterModificationGreaterThan": 2555 }
         } }
       }
     }]
   }

   Official documentation

6. Q6. A partner needs to upload one file to your storage account for the next hour. How do you give access safely?

   Issue a shared access signature (SAS) scoped to just that container or blob, with only write/create permission and a one-hour expiry.

   Prefer a user delegation SAS, which is signed with Microsoft Entra credentials instead of the account key and can be revoked by revoking the delegation key. Never share the storage account key itself; it grants full access.

   Official documentation

7. Q7. How do you deploy a new version of an App Service web app with zero downtime and an instant rollback?

   Deploy to a staging deployment slot, warm it up and test it, then swap it with production. The swap is a routing change, so users see no downtime, and swapping back is the rollback.

   Mark environment-specific settings (such as a connection string to the staging database) as deployment slot settings so they stay with the slot instead of moving during the swap. Slots need the Standard tier or higher.

   Official documentation

8. Q8. Users report slow pages. How do you find the cause with Azure Monitor and Application Insights?

   Instrument the app with the Azure Monitor OpenTelemetry distro (UseAzureMonitor()). Application Insights then collects requests, dependencies (SQL, HTTP), exceptions and traces with correlation IDs.

   Use the Performance view to find the slowest operations, then drill into a sample to see the end-to-end transaction: which dependency took the time. Use Live Metrics during an incident, and set alerts on response time and failure rate.

   builder.Services.AddOpenTelemetry().UseAzureMonitor();

   Official documentation

9. Q9. What does Azure API Management add in front of your APIs?

   A gateway with policies applied without code changes: authentication (validate JWT, subscription keys), rate limits and quotas, caching, request and response transformation, and IP filtering.

   It also provides a developer portal, versions and revisions, and analytics. It is a common answer when a scenario asks to expose several backend APIs securely to external developers with throttling.

   Official documentation

10. Q10. Event Grid or Event Hubs: which do you choose for 'react when a blob is uploaded' and for 'ingest millions of telemetry events per second'?

    Blob uploaded: Event Grid. It is a push-based event router for discrete events (something happened) with filtering and retries, and it triggers Functions or webhooks.

    Telemetry ingestion: Event Hubs. It is a high-throughput streaming platform with partitions, retention and consumer groups, so several consumers can read the stream at their own pace. Service Bus fits a third case: business messages that need reliable, ordered processing.

    Official documentation

11. Q11. When would you deploy a .NET API to Azure Container Apps instead of App Service or AKS?

    Container Apps runs containers serverlessly: scaling with KEDA rules (HTTP, queue length), scale to zero, revisions with traffic splitting, and Dapr built in, with no Kubernetes cluster to manage.

    Choose App Service for a straightforward web app without containers, AKS when you need full Kubernetes control, and Container Apps for microservices and event-driven workers in between. .NET Aspire can deploy straight to Container Apps.

    Official documentation

12. Q12. Explain the cache-aside pattern with Azure Managed Redis.

    The app checks the cache first. On a miss it reads from the database, writes the result to the cache with an expiry, and returns it. On updates it writes to the database and removes or updates the cache entry.

    Set sensible expirations so stale data ages out, and guard against stampedes when a hot key expires (HybridCache does this for you). The cache is an optimisation: the app must still work if it is unavailable.

    Official documentation

Original questions written to explain concepts; not taken from any certification exam. Spotted a mistake? See our corrections policy.