CAMPUX Cloud Bootcamp
CAMPUX · The Interview · Question Bank

The questions they actually ask.

Drawn from real Azure cloud-engineer job postings and the questions hiring panels reach for, categorised by topic — and every one mapped to the class that answers it, so a weak answer is one click from becoming a strong one.

This is not a memorisation list. Interviewers can tell a recited answer from an understood one in a sentence. Use each card two ways: cover the "what they're really testing" line and answer the question aloud, then read the line and the class it points to. The point is not to have the answer — it is to have built the thing the answer describes.

A hand-drawn line illustration of an interview: two panellists seated at the left of a desk facing a single candidate at the right, with the candidate circled in red pen and labelled "you". The panel you
The room Two chairs, a desk, and half an hour. The cards below are the questions asked from the left of it; the last section is what you ask back from the right.

Cloud Fundamentals

Classes 1–6 · AZ-900

The warm-up round. Panels use it to sort people who memorised definitions from people who can reason about trade-offs — so answer with a decision, not a dictionary entry.

What's the difference between IaaS, PaaS, and SaaS — and how do you choose?
Testing: whether you pick per workload by chores-vs-control, not per company by fashion. Strong answers name a real example of each.
Explain the shared responsibility model. What is always the customer's, in every service model?
Testing: that you know data and identity never transfer to the provider — and that most breaches are configuration, not provider compromise.
Regions, availability zones, region pairs — what are they and why do they matter?
Testing: reliability design. Can you place instances across zones and reason about what each level of redundancy survives?
Answered in Class 2 & Class 12
Why does moving to the cloud change the finance conversation — CapEx to OpEx?
Testing: whether you lead with speed and elasticity, not "it's cheaper" — the claim a real bill disproves.

Identity & Governance

Classes 7–9 · AZ-104

Where mid-level interviews get real. Identity is the security boundary of the cloud, and panels probe whether you grant the narrowest access at the lowest scope by instinct.

Service principal vs managed identity — what's the difference, and when do you use each?
Testing: the credential-hygiene ladder. The strong answer prefers managed identity inside Azure and federation outside — no stored secrets.
Answered in Class 9
Explain RBAC. What separates Owner, Contributor, and Reader?
Testing: least privilege — and the load-bearing detail that Contributor can build anything but cannot grant access to others.
Answered in Class 8
RBAC versus Azure Policy — what does each one control?
Testing: who-may-act versus what-may-exist. Bonus: an Owner still cannot create a resource a deny policy forbids.
Answered in Class 8
What is a management group, and why run a hierarchy instead of one subscription?
Testing: scope inheritance — a rule set high flows down to every subscription, now and every one created later.
Answered in Class 7

Networking

Classes 10, 13–15 · AZ-104

The depth most self-taught candidates are missing, and the panel knows it. Expect a whiteboard and "draw me the request path."

Walk me through connecting a web app to a database with no public exposure at all.
Testing: the private-endpoint pattern end to end — VNet integration, private endpoint, private DNS zone, public access disabled.
Answered in Class 14
Service endpoint versus private endpoint — what's the real difference?
Testing: that a service endpoint firewalls a public endpoint while a private endpoint gives the service a private IP and can remove the public door entirely.
Answered in Class 14
A private endpoint is configured but the app still can't reach the service. Where do you look first?
Testing: the DNS trap — a missing or unlinked private DNS zone resolves the name back to the public IP. Always check resolution from inside the network.
Answered in Class 14 & Class 15
Load Balancer, Application Gateway, Front Door — how do you choose between them?
Testing: the scope-and-layer grid: regional vs global, Layer 4 vs Layer 7, and where a WAF belongs.
Answered in Class 13
How are NSG rules evaluated when several could match?
Testing: priority order — lowest number first, stopping at the first match. Most "the deny isn't working" incidents are a priority mistake.
Answered in Class 10

Compute & Storage

Classes 11–12 · AZ-104

Bread-and-butter questions where the tell is cost-awareness: can you size to the workload rather than to fear?

How would you handle a workload with a sharp seasonal peak and a long quiet trough?
Testing: elasticity made real — autoscale rules or scale sets up for the peak and down for the trough, or scale-to-zero on the right platform.
Answered in Class 11 & Class 27
Explain storage redundancy: LRS, ZRS, GRS, GZRS.
Testing: matching the spend to the disaster you must survive — a failed disk, a lost zone, a lost region — not to the worst you can imagine.
Answered in Class 12
What's the catch with the Archive access tier?
Testing: that Archive is offline — you must rehydrate before reading, which can take hours. Never the home for a backup you might restore under pressure.
Answered in Class 12
When would you reach for a VM instead of App Service or Container Apps?
Testing: chores versus control — IaaS only when a named requirement (OS access, a machine-bound licence) forces it, and someone signs for the toil.
Answered in Class 11 & Class 27

Infrastructure as Code

Classes 20–21 · AZ-400

The two-salary-band divide. Panels want to hear that your infrastructure is text, reviewed and reproducible — and that you can defend a tool choice with a rule, not a preference.

Bicep or Terraform — which do you choose, and why?
Testing: the decision rule, not a loyalty. It comes down to who keeps the books — Azure for Bicep, its own state for Terraform — and whether you need multi-cloud reach.
Answered in Class 21
What is Terraform state, and why is it sensitive?
Testing: that state is the ledger between code and cloud, holds secrets in plain text, needs a locked remote backend, and never goes in Git.
Answered in Class 21
How do you see exactly what a change will do before you apply it?
Testing: what-if / plan — and reading the delete lines twice, because a declarative typo can drop a resource.
Answered in Class 20 & Class 21
How do you keep infrastructure code reviewable as it grows?
Testing: modules — small, named, reusable files that each fit in a reviewer's head, composed rather than crammed into one template.
Answered in Class 20

CI/CD & DevOps

Classes 17–24, 40 · AZ-400

The questions with the sharpest right answers. One in particular — how the pipeline authenticates — separates candidates who store a secret from those who don't.

How does your pipeline authenticate to Azure?
Testing: OIDC federation — GitHub signs a token, Entra trades it for minutes of access, nothing stored. The answer most candidates cannot give.
Answered in Class 23
How do you gate a deploy to production?
Testing: environments with required reviewers, and a subject claim scoped so only an approved run can reach the production credential.
Answered in Class 22 & Class 23
GitFlow or trunk-based development — which, and when?
Testing: that the answer is a consequence of deployment frequency, not fashion. Ship often, trunk-based; ship on a slow cadence, GitFlow earns its overhead.
Answered in Class 19
Why is a workflow file a security-sensitive artifact?
Testing: that it can read secrets and deploy to production, so it must be reviewed with the same care as production code — trigger, permissions, steps, gates.
Answered in Class 22

Monitoring & Cost

Classes 28–32 · AZ-400

Where operational maturity shows. Panels want the person who reads the invoice like telemetry and whose pager means something.

You're paged that the app is down. Walk me through your first five minutes.
Testing: the diagnostic method — find when the error rate bent from telemetry, then find what changed just before it, from the Activity Log.
Answered in Class 29 & Class 36
Why do resource logs need a diagnostic setting but platform metrics don't?
Testing: the surprise that logs are thrown away by default — nothing flows to a workspace until you open the valve, and you discover it mid-incident.
Answered in Class 28
How do you keep a team from ignoring its alerts?
Testing: signal-to-noise as a design choice — every alert actionable, owned, and rare. Three that fire beat forty that trained people to look away.
Answered in Class 30
The bill tripled. Walk me through finding out why.
Testing: cost analysis as a query — group then filter to the culprit — and the four usual suspects: orphans, oversized compute, non-prod running 24/7, and data movement.
Answered in Class 32

Security

Classes 8, 9, 31 · AZ-400

Answer these with a posture, not a product list — the difference between naming a medicine cabinet and describing your health.

Where do your secrets live, and who can read them?
Testing: Key Vault surfaced as references, read by a managed identity through an RBAC role — nothing in code, config, or the pipeline.
Answered in Class 31 & Class 9
What's your defence-in-depth story for a public web app?
Testing: layers that fail independently — WAF at the edge, private endpoints beneath, a keyless identity, a vault for secrets, the data tier off the internet.
Answered in Class 31, 13 & 14
A live key just got committed to a public repo. What do you do, in order?
Testing: rotate first — the secret is burned the instant it's pushed. Assess the blast radius, remove it from history, then move the workload off stored secrets.
Answered in Class 9 & Class 31
What could an attacker do with your CI pipeline, and how do you bound it?
Testing: the least-privilege audit — what each service principal reaches, which runs can become it, the GITHUB_TOKEN's scope, and who reviews the file.
Answered in Class 31

AI Infrastructure

Classes 33–35

The market's vaguest requirement — "AI a plus" — and your chance to answer it with infrastructure instead of a chat window.

How would you run an internal AI assistant on Azure OpenAI, privately?
Testing: a private endpoint, public access disabled, key auth off, the app authenticating by managed identity — the Class 14 pattern applied to the model.
Answered in Class 34 & Class 35
Several teams share one model. How do you know who is spending what?
Testing: an API Management gateway metering tokens per key, with per-caller limits and the counts charted — the sentence that gets an AI-infra candidate hired.
Answered in Class 35
What actually drives the cost of an AI conversation?
Testing: output priced above input, history compounding with the square of the length, and the model choice as an order-of-magnitude multiplier.
Answered in Class 35
What is the context window, and why does it explain most "AI is acting weird" bugs?
Testing: that the model knows only its weights plus what's in the window — not in the weights, not in the window, not known. Every AI bug is a question about the window.
Answered in Class 33

Behavioural & Scenario

Classes 36–37 · the Capstones

The round candidates underprepare and panels weight heavily. Answer in the shape of a real story — situation, action, result — and let your capstones supply the specifics.

Tell me about a time you troubleshot an issue that spanned several services.
Testing: a method under pressure — detect, triage, mitigate, learn — and a rollback before a root-cause hunt. Use a real incident, not a hypothetical.
Answered in Class 36
Describe a cost anomaly you found and fixed.
Testing: that you treat spend as telemetry — the group-and-filter drill, the culprit named, the guardrail added so it can't recur.
Answered in Class 32
How do you run a postmortem after an outage?
Testing: blameless by design — systems in the findings, not people; contributing causes in the plural; every action with an owner and a date.
Answered in Class 36
Walk me through a project you built end to end.
Testing: the whole reason the course ends in artifacts. Open a capstone, draw the request path, and defend every layer against the five pillars.

The questions you ask them

Interviews go both ways

"Do you have any questions for us?" is not the end of the interview — it is part of it, and the strongest candidates treat it as their own diligence. Good questions signal seniority and, just as importantly, tell you whether to accept the offer. Ask a few of these; then listen to how they answer, not only what they say.

What does success look like for this role at 30, 60, and 90 days?
What a good answer reveals: whether the team has actually thought about onboarding. A crisp, staged answer means a plan exists; a vague one means you will write it yourself. Either way you now know.
How is the team structured, and who would I work most closely with day to day?
What a good answer reveals: team dynamics and where you'd sit in them — one team or shared across many, a clear lead or a flat scrum, and whether the people who'd review your work are named or hand-wavy.
Team shape decides your day
What's the culture around on-call, incidents, and postmortems?
What a good answer reveals: whether failure is treated as a systems problem or a personal one. "Blameless" said plainly is a green flag; a pause, or "we find who caused it," tells you what a bad night here feels like.
Judge it against Class 36
How does code actually get to production here?
What a good answer reveals: the real engineering maturity behind the job post. Pull request, review, gated pipeline, no stored secrets — or a person clicking in the portal on a Friday. This one question separates the roles.
Measure it against Phase Three
How are architecture and tooling decisions made?
What a good answer reveals: whether you'll have a voice or inherit edicts — a design-review culture and written trade-offs, or "the lead decides." Neither is wrong; knowing which lets you choose with your eyes open.
Decision rules, from every class
How do you balance new feature work against reliability and tech debt?
What a good answer reveals: whether operations are valued or merely tolerated. A team that budgets time for toil relief and monitoring is a team you can grow in; one that only ships features will burn you on the pager.
The Phase Four question
How do you support learning and growth for engineers here?
What a good answer reveals: whether this job is a ladder or a treadmill — real answers name mentorship, conference budgets, time for certifications, or internal mobility. Silence here is its own answer.
Your growth is the point
What's the single biggest challenge the team is facing right now?
What a good answer reveals: candour, and what you'd actually walk into. A specific, honest challenge is a gift — it tells you the real work — while a polished non-answer tells you how much they'll level with you once you're inside.
Listen for the honest one