1. What does IAM stand for in cloud security?
IAM controls who can access which resources in the cloud. It enforces authentication (who you are) and authorization (what you can do).
Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Microsoft · Cloud Basics
Practice Cloud Basics questions specifically asked in Microsoft interviews – ideal for online test preparation, technical rounds and final HR discussions.
Questions
42
Tagged for this company + subject
Company
Microsoft
View company-wise questions
Subject
Cloud Basics
Explore topic-wise practice
Go through each question and its explanation. Use this page for targeted revision just before your Microsoft Cloud Basics round.
IAM controls who can access which resources in the cloud. It enforces authentication (who you are) and authorization (what you can do).
For complete preparation, combine this company + subject page with full company-wise practice and subject-wise practice. You can also explore other companies and topics from the links below.
Firewall rules define which traffic is allowed or denied to resources based on IP, port, and protocol. They can be configured at instance, subnet, or project level to ensure proper access control.
Tools like Terraform, Anthos, and Azure Arc provide unified management. They allow consistent policy enforcement, deployment, and monitoring across environments.
Combining instance types gives flexibility and savings. Critical services use on-demand or reserved capacity, while background tasks use cheaper spot instances.
Choose regions close to your customers for lower latency. Consider data residency laws, available services, and cost differences before deciding.
Start with discovery to map dependencies, then move non-critical workloads first. Use hybrid connectivity like VPN or Direct Connect, test performance, and validate backups before full migration.
Apply least-privilege IAM roles, encrypt data, enable logging, and segment networks. Also ensure patching automation and enforce multi-factor authentication for critical access.
AWS offers VPC Flow Logs, Azure has Network Watcher, and GCP uses Cloud Armor for traffic analysis and DDoS protection. These tools track traffic patterns and detect suspicious activities automatically.
Pay-as-you-go means you pay only for the resources you actually use — such as compute hours or storage space. This model avoids large upfront costs and makes the cloud budget-friendly for startups and enterprises.
Zero Trust means never trust by default — always verify every request. It enforces strict identity checks and segmentation, assuming that both internal and external networks can be compromised.
Stateless apps make scaling easy because any instance can handle any request. Session data is stored in external caches or databases instead of local memory.
Azure Resource Manager (ARM) is the deployment and management layer for Azure. It enables consistent creation and configuration of resources using templates or CLI.
Storage classes allow data to be placed in cost-effective tiers. Frequently accessed data stays in hot storage, while infrequent data moves to cold or archive storage.
Automation ensures repeatable, error-free configurations and faster deployments. It eliminates manual intervention for tasks like provisioning, scaling, and patching.
A hospital might keep patient data on-prem for compliance but use public cloud for analytics. This mix ensures both security and flexibility without moving sensitive data outside control.
Use least privilege access, enable multi-factor authentication, and rotate credentials regularly. Group permissions with roles instead of assigning them individually for better security and management.
Monitoring can trigger automated rollbacks or alerts when deployment errors occur. Integrating tools like Prometheus or CloudWatch ensures continuous visibility throughout the release cycle.
Azure Blob Storage is a scalable object store for unstructured data. It supports hot, cool, and archive tiers to optimize cost and access speed.
Multi-region storage replicates data across geographically distant data centers. This improves availability, reduces latency for global users, and provides disaster recovery protection.
Cloud providers offer encryption at rest using managed keys or customer-managed keys. Data in transit is secured with SSL or TLS to prevent interception and ensure privacy.
Cold storage is ideal for data that is rarely accessed but must be retained for compliance or analysis. It costs much less than hot storage but retrieval times are slower.
Implement unified IAM policies, encrypt data at rest and in transit, and use secure VPN or private links. Continuous monitoring and centralized logging keep visibility across all environments.
Jenkins automates building, testing, and deploying applications. It integrates with version control systems and cloud services to run complete CI/CD pipelines.
Azure DevOps offers tools for planning, coding, building, testing, and deploying software. It supports CI/CD pipelines, version control, and project tracking in one suite.
Continuous Integration merges code changes frequently and runs automated tests. Continuous Delivery automates deployment to staging or production, ensuring quick, reliable releases with minimal downtime.
Cloud platforms provide scalability, API-based provisioning, and managed services. This allows DevOps teams to deploy, test, and scale applications rapidly with minimal infrastructure overhead.
Hybrid cloud combines on-premise infrastructure with public or private cloud services. It allows secure data sharing and flexible scaling between both environments.
Vendor lock-in happens when applications rely heavily on one provider’s tools and APIs. Switching providers becomes expensive and complex due to compatibility issues.
AWS Direct Connect and Azure ExpressRoute create dedicated private links. They offer better security and lower latency compared to public internet connections.
VM Import/Export allows transferring existing VMs to and from AWS. Similar tools exist in Azure (Migrate) and GCP (Migrate for Compute Engine).
Monitoring helps track system health, usage, and errors. It ensures services stay available and allows early detection of performance problems.
Azure Monitor collects telemetry from resources and applications. It integrates with Log Analytics and Application Insights for deeper diagnostics.
Azure Advisor analyzes usage patterns and suggests optimizations. It covers cost, performance, security, and reliability recommendations.
Use auto-scaling to match resources with demand, and shut down idle instances. Choose reserved or spot instances for predictable workloads, and enable budgets or alerts for cost tracking.
Object storage keeps data as objects with metadata and a unique ID. It is ideal for storing files, logs, media, and backups at scale.
Cloud providers handle the security *of* the cloud — like data centers and networks. Users manage security *in* the cloud — like access control and data protection.
A Resource Group is a logical container that holds related Azure resources such as VMs, databases, and storage accounts. It helps manage lifecycle, permissions, and monitoring as a single unit.
Azure Active Directory (Azure AD) manages user authentication and permissions across Microsoft cloud services. It supports single sign-on, MFA, and integration with on-prem directories.
VM Scale Sets allow you to deploy and manage a group of identical VMs. They automatically increase or decrease the number of instances based on CPU load or demand, ensuring high availability and scalability.
An ARM template is a JSON file that defines Azure infrastructure in code. It enables consistent deployments, version control, and automation using Infrastructure-as-Code principles.
A VPC is a logically isolated section of a cloud provider’s network. It lets you define subnets, routing tables, and firewalls to control communication between resources.
Encryption protects data from unauthorized access by converting it into unreadable text. Most cloud providers support encryption both at rest and in transit.