Interview Prep — Principal Azure Engineer / Architect

A running reference for the questions a strong panel actually asks — and the level of answer that separates senior from principal. Pair each section with the phase that builds the mechanism, so your answer is "I implemented this," not "I read about it."

How principal interviews differ

A senior candidate explains what a service does. A principal explains how it works under the hood, when it breaks, what it costs, and what they'd trade. Every answer below should end with a tradeoff and, where possible, a number.

1. Control plane & IaC (P00–P02)

  • "Walk me through what happens when you run terraform apply against Azure." — HCL → plan (state vs desired diff → create/update/replace/delete; ForceNew ⇒ replace), DAG ordering, each resource = an ARM PUT (idempotent) → RP. State lock via blob lease. Drift = real ≠ state.
  • "ARM template vs Bicep vs Terraform vs CDKTF — when each?" — Same engine underneath; choose by team (HCL multi-cloud → Terraform; Azure-only typed → Bicep; programmatic synth → CDKTF). Defend with blast radius, state ownership, and drift story, not taste.
  • "Incremental vs Complete deployment mode — what's the foot-gun?" — Complete deletes un-templated resources in the RG. Name a time it would have wiped something.
  • "How do you make a deployment idempotent and safe to re-run?" — PUT desired state, no imperative side effects, what-if/plan first, deployment stacks with deny-settings.

2. Identity, OAuth2 & JWT (P03)

  • "Draw the authorization-code + PKCE flow." — verifier/challenge (S256), redirect with code, back-channel token exchange with verifier, ID token (OIDC) + access token.
  • "How do you validate a JWT? In what order, and what fails closed?" — kid → JWKS key → signature → iss → aud → nbf/exp (±skew) → scp/roles. Skipping aud = the confused-deputy.
  • "Client credentials vs on-behalf-of vs managed identity — when?" — daemon vs middle- tier delegation vs secret-less Azure workload.
  • "scp vs roles?" — delegated (user present) vs application (daemon) authorization.

3. Authorization — RBAC & Policy (P04–P05)

  • "A user is Owner on the subscription but can't read a blob. Why?" — control-plane vs data-plane: Owner grants Actions, not DataActions; needs Storage Blob Data Reader.
  • "How does deny win?" — deny assignments override role assignments; walk the evaluation.
  • "How would you enforce 'no public storage accounts' across 200 subscriptions?" — Azure Policy deny at a management group, policy-as-code in Git, exemptions time-boxed.
  • "Effective permissions at a resource?" — union of inherited assignments minus NotActions, minus deny.

4. Networking (P06)

  • "A VM can't reach a storage account over its Private Endpoint. Diagnose." — DNS: the FQDN must resolve to the private IP via the Private DNS zone; check NSG, then UDR next-hop, then the zone link. (Almost always DNS.)
  • "Two NSG rules match a packet — which wins?" — lowest priority number; first match; stateful return.
  • "Force all egress through a firewall — how?" — UDR 0.0.0.0/0 → NVA next-hop; mind longest-prefix and asymmetric routing.
  • "Size a VNet for 3 subnets of ~500 hosts each." — /23 per subnet (512 − 5), parent /21; show the −5 reserved.

5. Containers & CI/CD (P07–P08)

  • "Why pin by digest, not :latest?" — tags are mutable; digests are immutable + content-addressed; reproducibility + supply-chain.
  • "How does a registry save space across images?" — shared content-addressed layers; GC marks live-manifest blobs and sweeps the rest.
  • "Deploy from CI without storing a cloud secret." — OIDC workload-identity federation (issuer/subject/audience match) → short-lived token.
  • "Blue-green vs canary — pick one and defend." — instant rollback vs gradual exposure; tie to blast radius and the health gate.

6. Events & serverless (P10–P11)

  • "Exactly-once with Service Bus?" — there is no exactly-once delivery; you get at-least-once + an idempotent/dedup consumer = exactly-once effect. Peek-lock, DeliveryCount, DLQ.
  • "Event Grid vs Service Bus vs Event Hubs?" — reactive push routing vs enterprise broker (ordering/sessions/transactions) vs high-throughput stream.
  • "Why must a Durable orchestrator be deterministic?" — it's replayed from history; a clock/random/IO call would diverge on replay. Side effects go in activities.
  • "Cold start — when does it matter and how do you fix it?" — Consumption scale-to-zero; Premium/Flex pre-warmed instances, or keep-warm.

7. Secrets & reliability (P12, P14)

  • "How does a Function authenticate to Key Vault with no secret?" — Managed Identity → IMDS token → Key Vault data-plane (RBAC). Envelope encryption + KEK rotation.
  • "Compose the SLA of: Front Door → APIM → Function → Cosmos." — multiply the serial availabilities; show where redundancy raises it; name the weakest link.
  • "A dependency is failing — retries are making it worse. What do you do?" — backoff + jitter under a retry budget, circuit breaker, honor 429/Retry-After, shed load.

The system-design loop (use in every round)

  1. Clarify the workload: RPS, payload size, latency SLO, availability target, data residency, compliance.
  2. Sketch control plane (identity, RBAC, policy, landing zone) and data plane (network, compute, events, storage) — principals always draw both.
  3. Quantify: SLA composition, cost/month, partition/instance sizing, retry budget.
  4. Name the tradeoff per Well-Architected pillar and write the ADR sentence.
  5. Fail it: what's the blast radius, the throttling limit, the DR story, the rollback?

See ../system-design/README.md for worked reference designs.