Azure Interview Questions Part #3


Below are the questions for Azure interview :-

Q #1 What all could be the backend of Basic Load balancer.
Q #2 Customer wanted very low latency between the Azure VM as that’s the need or requirement of the app. What all could you suggest.
Q #3 What is the best way to check which NSG rule is blocking the traffic.
Q #4 How to enable Hybrid benefit in Azure or how can I deploy VM using HUB ?
Q #4 What is scaling , Types and how can you use it to benefit your app?
Q #6 Can you change the Name of the Azure VM on the portal? If yes how ?
Q #7 Can you add the existing machine in the AV-set ? if yes how ?
Q #8 Difference between Managed disk and Unmanaged Disk ?
Q #9 If you want to load balance between AV-Zones what kind of Azure Load balancer you need ?
Q #10 If I create a standard managed disk from an existing VHD that's 80 GB, how much will that cost me?



Lets discuss the Answers -

Q #1  What all could be the backend of Basic Load balancer
Single VM , multiple VM only if part of AV-set & VMSS

Q #2 Customer wanted very low latency between the Azure VM as that’s the need or requirement of the app. What all could you suggest
PPG , Accelerated networking & RSS ( Receive Side Scaling)

A proximity placement group is an Azure Virtual Machine logical grouping capability that you can use to decrease the inter-VM network latency associated with your applications. When the VMs are deployed within the same proximity placement group, they are physically located as close as possible to each other. Proximity placement groups are particularly useful to address the requirements of latency-sensitive workloads.

Accelerated networking enables single root I/O virtualization (SR-IOV) to a VM, greatly improving its networking performance. This high-performance path bypasses the host from the datapath, reducing latency, jitter, and CPU utilization, for use with the most demanding network workloads on supported VM types.

Accelerated networking enables on supported VM types & for all other Windows VMs, using Receive Side Scaling (RSS) can reach higher maximal throughput than a VM without RSS.


https://youtu.be/s2MvpRG9bQo - Accelerated Networking



Q #3 What is the best way to check which NSG rule is blocking the traffic.
Use the inbuilt feature of Azure monitor called network watcher under network and diagnostic tools you will find IP flow verify . This feature can you give exact rule which is blocking the traffic.


Q #4 How to enable Hybrid benefit in Azure or how can I deploy VM using HUB ?
You can create from marketplace and use save money options and if you want to utilize the HUB for existing one you can use configuration option on VM pane and use HUB

Q #5 What is scaling , Types and how can you use it to benefit your app?



Q #6 Can you change the Name of the Azure VM on the portal? If yes how ?



Q #7 Can you add the existing machine in the AV-set ? if yes how ?



Q #8 Difference between Managed disk and Unmanaged Disk ?

Managed Disks = are managed by Microsoft Azure and you don't need any storage account while created new disk. Since the storage account is managed by Azure you do not have full control of the disks that are being created.
Un-managed Disks = is something which requires you to create a storage account before you create any new disk. Since, the storage account is created and owned by you, you have full control over all the data that is present on your storage account. Additionally, you also need to take care of encryption, data recovery plans etc.

New features or benefits of Managed disk :-
1.Simple and scalable VM deployment: Managed Disks will allow you to create up to 10,000 VM disks in a subscription, which will enable you to create thousands of VMs in a single subscription.
2.Better reliability for Availability Sets: Managed Disks provides better reliability for Availability Sets by ensuring that the disks of VMs in an Availability Set are sufficiently isolated from each other to avoid single points of failure.
3.      Highly durable and available
4.      Granular access control: You can use Azure Role-Based Access Control (RBAC) to assign specific permissions for a managed disk to one or more users. Managed Disks exposes a variety of operations, including read, write (create/update), delete, and retrieving a shared access signature (SAS) URI for the disk.
5.      Azure Backup service support: Use Azure Backup service with Managed Disks to create a backup job with time-based backups, easy VM restoration and backup retention policies


Q #9 If you want to load balance between AV-Zones what kind of Azure Load balancer you need ?
we need Standard LB which is compatible as per zones and standard IP if its public LB.

Q #10 If I create a standard managed disk from an existing VHD that's 80 GB, how much will that cost me?
A standard managed disk created from an 80-GB VHD is treated as the next available standard disk size, which is an S10 disk. You're charged according to the S10 disk pricing.

Azure Interview Questions Part #2




Q #1 Explain the fault domain
that it is a logical working domain in which the underlying hardware is sharing a common power source and switch network. This means that when VMs is created the Azure distributes the VM across the fault domain that limits the potential impact of hardware failure, power interruption or outages of the network.

Q #2 Explain the Update domain
It is a logical group that undergoes maintenance by rebooting the system. The system automatically distributes the created VMs across the updated domain that enables the user to run any one of the applications while the Azure platform is undergoing maintenance. The update domain does not work sequentially to the manual rebooting.

Q #3 What is blob and how many types are there in Azure
Blobs – Blob stands for Binary large objects & Azure Blob storage is Microsoft's object storage solution for the cloud. Blob storage is optimized for storing massive amounts of unstructured data. We have 3 types of blobs

·                  Block blobs – this is made up of blocks of data that can be managed individually upto 4.7TB. It stores text and binary data.

·                    Append Blobs – this is also made up of block as block blob but are optimized for append operations. This is ideal for scenarios such as logging data from virtual machines.

·                    Page Blobs – This is for random access files up to 8 TB in size. Page blobs store virtual hard drive (VHD) files and serve as disks for Azure virtual machines

Q #4 Difference between AV-Set and AV-Zone



Q #5 What is Service Principle & if you have contributor access can you create Service Principle.

An Azure service principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources. This access is restricted by the roles assigned to the service principal, giving you control over which resources can be accessed and at which level. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity.

Create an App >> Assing Role (permissions) >> Use App ID & certificates to give access to the app, hosted service and automated tools.

Contributor can not create the SP because its about giving access to the application.

Q #6 Are there any restrictions on using IP addresses within these subnets and what’s the smallest subnet that we can create.


Yes. Azure reserves 5 IP addresses within each subnet. These are x.x.x.0-x.x.x.3 and the last address of the subnet. x.x.x.1-x.x.x.3 is reserved in each subnet for Azure services.
  • x.x.x.0: Network address
  • x.x.x.1: Reserved by Azure for the default gateway
  • x.x.x.2, x.x.x.3: Reserved by Azure to map the Azure DNS IPs to the VNet space
  • x.x.x.255: Network broadcast address
The smallest supported IPv4 subnet is /29, and the largest is /8 (using CIDR subnet definitions). IPv6 subnets must be exactly /64 in size.

Q #7 How to reset the local admin password of VM

We can do that from Azure portal from the VM pane under Support and troubleshooting we have Password reset Option.

Q #8 How to reset the NIC



Q #9 Why we re-deploy the VM & what it does.

If you have been facing difficulties troubleshooting Remote Desktop (RDP) connection or application access to Windows-based Azure virtual machine (VM), redeploying the VM may help. When you redeploy a VM, Azure will shut down the VM, move the VM to a new node within the Azure infrastructure, and then power it back on, retaining all your configuration options and associated resources. You will loose the data on temp disk.

We can Redeploy from Azure portal under support and troubleshooting.


Q #10 What all you will do, if you are unable to RDP on Azure VM

1.     Reset Remote Desktop configuration.
2.     Check Network Security Group rules / Cloud Services endpoints.
3.     Review VM console logs.
4.     Reset the NIC for the VM.
5.     Check the VM Resource Health.
6.     Reset your VM password.
7.     Restart your VM.
8.     Redeploy your VM.


Stay Tuned for next part !!!!!!!

Azure Interview Questions Part- #1

In this blog we will talk about the frequently asked interview questions in case of Azure Administrators, Cloud engineers, Azure Engineers, Cloud Associates etc etc , basically these questions blogs would go from basic to intermediate and  latter post would also include advance questionnaire as well.

Since this is my first blog on Azure interview questions so we will start with basic three question that everyone should prepare which would create the first impression because you have prepared them well & why i am saying that because rest of the question you dont know but these three questions are yours and your experience on cloud so lets get started.



Question #1 : Talk about yourself or introduce yourself ?

Answer : We all know that its been asked so many times and our motive is cloud talk however this is our first blog so have to mention from the beginning. Here you can talk about you work experience, your career and anything you are confident with unless you see Interviewers are interested if you are going little off-track then technology but nothing wrong talking about other stuff but be the better judge of situation.

Question #2 : What you do in your daily life as a cloud engineer or what you actually do in Azure ?

Answer : This what i was talking about you can prepare this question like anything and you should everyone asks this question and this is your opportunity where you mention most of thing that you are comfortable with and explain is such a way that you know what you talking about, try to touch all the services which shows your cloud knowledge.

Question #3 : Describe any issue or scenario that you recently faced and fixed ?

Answer : This is the 3rd and last question where you can actually through a very good impression & i have seen this question quite often and i do ask my interview this helps me figure out about the interview a lot hence i would suggest you need to prepare at least 5 scenario or situations where you got stuck and what all troubleshooting steps you implemented to fix it. Usually what happens we do not face challenges everyday & if its been a while or few days we forget hence you need to prepare this question because this time ball is in your court. Also beware alot of questions may come with your explanation hence you should know your topics well.


************* Lets get started with Azure related questions **************

Question #4 : What type of disks used by Azure VM ?

Answer :  3 types of disks used by Azure VM :- OS Disk, Data Disk & Temporary Storage.

https://www.youtube.com/watch?v=32ndVoyso1I



Question #5 :  Can you use the temporary storage or disk to store data ?

Answer : Its not recommended to use important data on temp storage or disk because you will risk loosing data & that cant be recovered because this space is on the host machine and in case of VM re-sizing, shutdown, updating host or hardware issue on host , your VM might move to different host.
       

Question #6 : Can you change the Drive letter of temporary Disk , if yes then How?

Answer : Yes you can change the Drive letter of the temporary disk by moving the page file to C:drive temporarily and then change the drive letter once done move the page file back to new Drive letter assigned temporary disk.


https://docs.microsoft.com/en-in/azure/virtual-machines/windows/change-drive-letter?toc=%2fazure%2fvirtual-machines%2fwindows%2fclassic%2ftoc.json


Question #7 : Can i add the existing machine to Av-set if  yes then how and if no whats the work-around ?

Answer : No, you can not move the existing VM to the AV-Set however if it has been asked to move the existing VM to Av-set then we need downtime for that & need to delete the VM and re-create the VM inside AV-Set. If there are many machines then you can utilize powershell script available on powershell center.


Question #8 : Can you change the size of OS-Disk if yes then how ?

Answer : Yes you can increase the size of OS-Disk but not decrease and you need to deallocate the VM for this means downtime required not much but yes it requires. Once VM is deallocated then you need to go to the VM >> settings >> Disk >> Os-disk >> Configuration >> increase the size.

Its not dome yet once it is increased from portal then you need to login to the VM and extend the disk from the disk management as well.


Question #9 : If you have stopped your Azure VM from inside a VM, would it incur changes ?


Answer : Yes it would you should atopp from Azure portal and VM should be in De-allocated state if you dont want additional charges.


Question #10 : How do you fix the issue if your NSG is fine but you still unable to RDP ?

Answer : Yes i have seen this issue & in this case we need to reset the RDP configuration from Azure portal that would fix the issue. "This process will enable Remote Desktop service in the VM, and create a firewall rule for the default RDP port 3389."


Series has been started, soon Part-2 be coming !!!!



Azure AD Conditional Access Policies - Go through


Conditional Access Policies – ( Azure AD Premium P1 or P2 feature)

As name suggests its policy based on certain condition which needs to met to access your organization resources or application if not then certain challenges need to fulfill  like MFA or Password reset or access blocked.


Conditional Access policies are enforced after the first-factor authentication has been completed. Conditional Access is not intended as an organization's first line of defense for scenarios like denial-of-service (DoS) attacks, but can use signals from these events to determine access.



Based on certain situations as defined below conditional access policies decide either to grant access or block access if grant then what else needed to confirm that you are who you say you are.




Situations –

·        User logging in with unknown location or not from office.
·        Organizations can create trusted IP address ranges that can be used when making policy decisions if request not coming from that range the Policy applies.
·        Users with devices of specific platforms or marked with a specific state can be used when enforcing Conditional Access policies.
·        Azure AD ID Protection can trigger the policy on case of Sign-in risk & many more.



Conditional Access Policies – Decisions:

Block Access – Off course that’s restrictive if you don’t want to provide access if conditions are odd.

Grant Access – In this situation, need to fulfill certain conditions like –

  • Require multi-factor authentication
  • Require device to be marked as compliant
  • Require Hybrid Azure AD joined device
  • Require approved client app
  • Require app protection policy (preview)


Commonly applied policies -

Many organizations have common access concerns that Conditional Access policies can help with such as:

  • Requiring multi-factor authentication for users with administrative roles
  • Requiring multi-factor authentication for Azure management tasks
  • Blocking sign-ins for users attempting to use legacy authentication protocols
  • Requiring trusted locations for Azure Multi-Factor Authentication registration
  • Blocking or granting access from specific locations
  • Blocking risky sign-in behaviors
  • Requiring organization-managed devices for specific applications


So as discussed above - Conditional Access policy is an if-then statement, of Assignments and Access controls. A Conditional Access policy brings signals together, to make decisions, and enforce organizational policies. Lets create and talk about all the components simultaneously.

Lets go to Azure Active Directory and click on Conditional Access as shown :- 




Once you hit the conditional access and you would landed on this page where it shows all the relevant components and add button for policy. (Shown Below)





Under Manage you will see Named location where you can define the region like you head-office or branches along with the IP range as a known location or secure location as shown below -





Next component is Terms of use which provides a simple method that organizations can use to present information to end users. You need to click on terms of use and click New terms.


Below is the template and you can even upload the pdf and all. To now more click below link - 

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/terms-of-use




Now lets click on New Policy at the top and check what all options we have and configure it with policy that would allow you to login without MFA if you are in head-office and if not the MFA.




Under assignment we have users and groups that you want your policy to apply , you can choose all or selected and we do have option to exclude as well. Be cautious because you can lock yourself out if you apply this to all user including yours that what the exclamation says at the bottom highlighted

The assignments portion controls the who, what, and where of the Conditional Access policy.
(below picture)




Second option that we have is cloud apps and you can choose cloud applications that will be subjected to the policy again be cautious it also include Azure portal if you choose all apps.




Now its time to define conditions and we have multiple conditions here to define. 
First one is Sign-in risk which comes from Azure AD ID Protection and the risk detection's generated there can influence your conditional access policies as shown below -





Now its time to define the locations -
Location data is provided by IP geolocation data. Administrators can choose to define locations and choose to mark some as trusted like those for their organization's network locations.
(below picture)





Next option is in preview - client apps (shown below)

By default Conditional Access policies apply to browser apps, mobile apps, and desktop clients that support modern authentication.

This assignment condition allows Conditional Access policies to target specific client applications not using modern authentication.






Now its time to check the Device state which is in preview -
This control is used to exclude devices that are hybrid Azure AD joined, or marked a compliant in Intune. This exclusion can be done to block unmanaged devices.



Now all conditioned defined and lets check the Access controls i.e. Block access and Grant access.

    The Grant control can trigger enforcement of one or more controls.
  • Require multi-factor authentication (Azure Multi-Factor Authentication)
  • Require device to be marked as compliant (Intune)
  • Require Hybrid Azure AD joined device
  • Require approved client app
  • Require app protection policy





Session controls can limit the experience











  • Use app enforced restrictions
    • Currently works with Exchange Online and SharePoint Online only.
      • Passes device information to allow control of experience granting full or limited access.
  • Use Conditional Access App Control
    • Uses signals from Microsoft Cloud App Security to do things like:
      • Block download, cut, copy, and print of sensitive documents.
      • Monitor risky session behavior.
      • Require labeling of sensitive files.







  • If you worked on Powershell , you must be aware of what if ,  its exactly the same just to check if policy build is correct or applied correctly to the users




    In below snippet you can see at the bottom "policies that would apply"






    Alright folks so we at the end of this post and we learned what Azure Ad conditional access policy is how to create and apply ad what all are the components. Well this post is not all its just a pass through and if you want to know more please check the MS docs , reference link below 

    https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/





    Azure AD SSPR "Self Service Password Reset" - Go through

    Well as name suggest this is a great feature which gives you ability to reset your password rather calling service desk or bothering AD Admins.

    Before we go ahead and see how to enable this feature, lets understand the pre-requisite of this feature first. We have few scenarios to understand with respect to password reset, change , unlock or write back incase of hybrid identity and their AD license requirement -

    ·        Self-Service Password Change for cloud users
    o   I am a cloud-only user and know my password.
    §  I would like to change my password to something new.
    o   This functionality is included in all editions of Azure AD.

    ·        Self-Service Password Reset for cloud users
    o   I am a cloud-only user and have forgotten my password.
    §  I would like to reset my password to something I know.
    o   This functionality is included in Azure AD Premium P1 or P2, Microsoft 365 Business, or Office 365.

    ·        Self-Service Password Reset/Change/Unlock with on-premises writeback
    o   I am a hybrid user my on-premises Active Directory user account is synchronized with my Azure AD account using Azure AD Connect. I would like to change my password, have forgotten my password, or been locked out.
    §  I would like to change my password or reset it to something I know, or unlock my account, and have that change synchronized back to on-premises Active Directory.

    o   This functionality is included in Azure AD Premium P1 or P2, or Microsoft 365 Business.





    Before people could register themselves for SSPR we need to enable this feature and to enable to we need to go to Azure Active Directory and select password reset as shown.



    Once you hit the password reset you would landed into the below page where under settings you could see whether you want to enable this feature for selected users or all or none hence select accordingly. (shown below)




    We have selected all users in our demo as shown above and now we need to set the authentication method you can select 1 or 2 methods. We have selected Email and mobile phone as authentication methods and we have selected 1 in no. of methods required to reset. as shown below -




    Most important thing is we are now registering all users to select there authentication method for SSPR so make sure you have send the communication to all of your users. As shown in below snippet we have 180 days to enable it.



    Now we have enable the SSPR registration for all the users with email and mobile phone as authentication method and from now onward whenever user login they would get prompt to set this up as shown below -




    Once you hit next you would see both the authentication method that we have selected. (shown below)







    Now once you have selected the authentication method in SSPR and its time to check the registration hence click on cant access your account and it would ask you to verify id so that it could prompt you SSPR authentication method as shown below -



    Below is the snippet where you would enter your ID and captcha -


    Enter you mobile no. to receive the code for the verification and you can reset your password in the next screen.


    Reference links below -




    What is RBAC Baseline in Azure Landing Zone?

      What is RBAC Baseline in Azure Landing Zone? In simple terms, an RBAC baseline is the default set of access roles and assignments...