Introduction to Cloud Infrastructure (AZ-900) interview questions

The Pricing Calculator estimates a planned deployment and the TCO Calculator compares on-premises vs Azure. After deployment, Microsoft Cost Management shows actual spend, and Budgets with alerts warn you before you overspend. Azure Advisor recommends right-sizing and reserved-instance savings.

Protect the business first: a production outage affecting users usually wins. State your rule — impact and urgency over who is shouting loudest — communicate quickly to set expectations, delegate or ask for help, and park or renegotiate the lower-impact items with their owners. Show calm, a clear framework, and that you keep people informed.

RBAC controls who can do what — it grants users and groups permissions on resources. Azure Policy controls what the resources themselves may be — it enforces rules such as allowed regions, required tags or permitted SKUs, and can audit or deny non-compliant deployments. You use both together.

Use Reserved Instances or a Savings Plan to commit to one or three years for a large discount over pay-as-you-go, and apply Azure Hybrid Benefit if you have eligible Windows Server or SQL licenses. For interruptible work use Spot VMs instead.

Be specific and show it is a habit: hands-on labs and home projects, following release notes and a few trusted sources, a certification roadmap, reading other people’s code or post-mortems, and teaching others to cement what you learn. Tie it to this role’s stack. Enthusiasm plus a concrete routine beats a vague "I love learning".

ACI runs a single container quickly with no orchestration — good for short tasks and burst jobs. AKS is a managed Kubernetes cluster for complex, scalable microservices that need orchestration. App Service is a PaaS for web apps and APIs where you want built-in scaling, deployment slots and certificates without managing containers at all.

Give a concrete example: how you set clear expectations, paired on real work, let them struggle productively before stepping in, gave specific feedback, and gradually handed over ownership. Mention a result — they shipped something, passed a certification, became independent. Leadership is about multiplying others, not doing it all yourself.

Microsoft Entra ID (formerly Azure AD) is a cloud identity and access service that authenticates users to cloud apps using modern protocols (OAuth/OIDC/SAML) and supports MFA and Conditional Access. On-premises AD DS uses Kerberos/LDAP for domain-joined devices. They are connected with Microsoft Entra Connect for hybrid identity.

Use the STAR method: briefly set the Situation and Task, then spend most of your answer on the Action — how you broke the problem down, what you tried, how you tested — and finish with the Result and what you learned. Pick a real example with a measurable outcome (time saved, outage resolved) and show your reasoning, not just the fix.

A resource group is a logical container for resources that share a lifecycle. You deploy, manage, apply RBAC and tag resources at the group level, and deleting the group deletes everything in it. Resources in a group can be in different regions, but the group itself has a location for its metadata.

Security and operations are split between Microsoft and the customer. Microsoft always secures the physical datacenter, host and network. The customer always owns their data, accounts and access. Responsibility for the OS, network controls and applications shifts to Microsoft as you move from IaaS to PaaS to SaaS. You are always responsible for identity and data.

Connect your answer to the actual job and company: what about the work, the stack or the mission fits your strengths and goals. For the three-year question, show healthy ambition and direction (deeper expertise, more ownership, perhaps leading) that the company could realistically support, so it reads as commitment, not a stepping stone.

Explain how you gathered the facts you could quickly, identified the biggest risk, made a reversible decision where possible, and set a point to re-evaluate. Note how you communicated the uncertainty and your assumptions. Show judgement and bias for action — making a sound call and adjusting beats waiting for perfect information.

Lead with the impact in their terms (cost, risk, time, customers affected), not the technical cause. Use a simple analogy, avoid jargon, and offer a clear recommendation with options and trade-offs. Confirm they have understood and tell them what you need from them. The goal is a confident decision, not to show how much you know.

Show that you separated the person from the problem. Explain how you listened to their reasoning, brought data or a small proof of concept instead of opinions, looked for the shared goal (reliability, deadline, cost), and either reached agreement or disagreed-and-committed to the team’s decision. Avoid blaming; emphasise the outcome and the relationship staying intact.

Pick a real failure and own it without blaming others. Describe how you contained the impact, communicated honestly, fixed the root cause (not just the symptom), and added a safeguard — a test, a monitor, a checklist, a runbook — so it cannot recur. Interviewers want accountability and a blameless, learning mindset, not a claim that you never fail.

Set a cadence and a single source of truth: short, regular updates in plain language with status, impact, next step and ETA — even when the news is "no change yet". Tailor the detail to the audience and never let people find out bad news late. Reliable, proactive communication builds the trust that lets you do the technical work.

IaaS gives you the virtual machines and networking and you manage the OS and up (Azure Virtual Machines). PaaS gives you a managed platform to deploy code or data without managing the OS (Azure App Service, Azure SQL Database). SaaS is finished software you just use (Microsoft 365). As you move IaaS → PaaS → SaaS you trade control for less management overhead.

A management group is a container above subscriptions. You use it to apply policy and RBAC once and have it inherited by many subscriptions — for example, an enterprise applying a "allowed-regions" policy across every subscription in a hierarchy, rather than configuring each one by hand.

A Region is a set of datacenters in one geographic area. Availability Zones are physically separate datacenters within a region with independent power, cooling and network — deploy across zones for high availability. A Region Pair is two regions in the same geography used for replication and sequential updates, giving disaster-recovery protection.