Azure Monitor – Interview Q&A

1. Azure Monitor Fundamentals

Q1. What is Azure Monitor?

Priority: High

Azure Monitor is a centralized monitoring service that collects and analyzes metrics, logs, and telemetry from Azure resources and applications. It helps identify performance issues, troubleshoot failures, and configure alerts.

Key Points: Metrics, Logs, Application Insights, Alerts.

Q2. What is a Metric in Azure?

Priority: High

A metric is a numerical measurement collected over time to monitor resource performance and health.

Example: VM CPU usage = 85%, App Service requests = 1,000.

Key Points: Time-series data, Metrics Explorer, metric alerts.

Q3. What is a Log in Azure?

Priority: High

A log is a detailed record of activities, events, errors, and operations generated by Azure resources or applications.

Example: SQL connection timeout, failed deployment, application exception.

Key Points: Log Analytics Workspace, KQL, troubleshooting.

Q4. What is a Trace in Azure?

Priority: High

A trace tracks the execution flow of a request across application components and services. It helps identify slow operations and failures.

Key Points: Application Insights, Trace ID, Span, distributed tracing.

Q5. What is the difference between Metrics, Logs, and Traces?

Priority: High

Q6. What are Changes and Events in Azure?

Priority: Medium

A Change represents a modification to resource configuration, such as updating an NSG rule. An Event represents an occurrence, such as starting a VM or uploading a blob.

Key Points: Activity Log, Change Analysis, Event Grid.

Q7. What are the three pillars of observability?

Priority: High

The three pillars are Metrics, Logs, and Traces. Together, they help monitor system health, investigate failures, and identify performance bottlenecks.

Q8. What is the difference between Platform Metrics and Custom Metrics?

Priority: Medium

Platform metrics are automatically collected by Azure, such as VM CPU usage. Custom metrics are published by applications or monitoring solutions to track business-specific measurements.

Q9. What is Aggregation in Azure Metrics?

Priority: High

Aggregation combines multiple measurements into a summarized value using Average, Minimum, Maximum, Sum, or Count.

Example: Average CPU usage over five minutes = 60%.

Q10. What is Granularity in Azure Metrics?

Priority: High

Granularity specifies the time interval used to group metric measurements.

Example: Display average CPU utilization every 1 minute or 5 minutes.

Q11. What is a Dimension in Azure Metrics?

Priority: High

A dimension is an attribute used to filter or split metric data into categories, where supported.

Example: Split HTTP requests by status code or App Service instance.

Source: Azure Metric – Log, Trace, Change and Event.

2. Azure App Service Metrics

Q12. How do you monitor metrics in Azure App Service?

Priority: High

Open Azure Portal → App Service → Monitoring → Metrics. Select a metric, aggregation, time range, and granularity to analyze application performance.

Q13. What are the important App Service metrics?

Priority: High

• CPU Time – CPU processing consumed.

• Memory Working Set – Application memory usage.

• Requests – Number of HTTP requests.

• HTTP 5xx – Server-side errors.

• Response Time – Time taken to respond to requests.

Q14. What is the difference between CPU Time and CPU Percentage?

Priority: Medium

CPU Time measures CPU processing consumed by an application. CPU Percentage measures relative CPU utilization, commonly monitored at the App Service Plan level.

Key Point: The metric scope and unit are different.

Q15. How do you identify HTTP 500 errors in App Service?

Priority: High

Open App Service → Metrics and select HTTP Server Errors or the appropriate HTTP 5xx metric. Use Application Insights and application logs to investigate the actual exception.

Q16. How do you monitor slow API requests?

Priority: High

Use App Service response-time metrics to identify latency increases. Use Application Insights request telemetry and dependency tracing to find slow APIs or SQL queries.

Q17. Do App Service platform metrics require an agent?

Priority: Medium

No. Azure automatically collects basic App Service platform metrics. Additional application-level diagnostics and distributed tracing require appropriate monitoring configuration.

Source: Monitor Metrics in Azure App Service.

3. Azure Activity Log & Log Analytics Workspace

Q18. What is Azure Activity Log?

Priority: High

Azure Activity Log records subscription-level management operations such as creating, updating, deleting, or restarting Azure resources.

Key Points: Automatically collected, management-plane operations, auditing.

Q19. What is the default retention period for Azure Activity Logs?

Priority: Medium

Azure Activity Logs are retained for 90 days by default. For longer retention, export them to Log Analytics Workspace or Azure Storage.

Q20. What is a Log Analytics Workspace?

Priority: High

A Log Analytics Workspace is a centralized Azure Monitor resource that stores and organizes logs from multiple Azure resources.

Key Points: Centralized log storage, KQL, monitoring, troubleshooting.

Q21. What is the difference between Azure Monitor and Log Analytics Workspace?

Priority: High

Azure Monitor is the overall monitoring platform for metrics, logs, alerts, and application telemetry. Log Analytics Workspace is a resource primarily used to store and query monitoring logs.

Q22. What is the difference between Activity Log and Resource Log?

Priority: High

Q23. What are Diagnostic Settings in Azure?

Priority: High

Diagnostic Settings configure the export of supported Azure resource logs, metrics, and Activity Logs to destinations such as Log Analytics Workspace, Storage Account, or Event Hubs.

Q24. How do you send Activity Logs to Log Analytics Workspace?

Priority: High

Navigate to Azure Monitor → Activity Log → Export Activity Logs → Diagnostic Settings. Select the required categories, choose Log Analytics Workspace, and save.

Q25. Can multiple Azure resources use one Log Analytics Workspace?

Priority: Medium

Yes. Multiple VMs, App Services, SQL databases, and other supported resources can send their monitoring logs to the same workspace.

Q26. What is the difference between Application Insights and Log Analytics Workspace?

Priority: High

Application Insights provides application performance monitoring, including requests, exceptions, dependencies, and tracing. Log Analytics Workspace stores and supports querying the associated telemetry.

Q27. Is Log Analytics Workspace mandatory for Azure Monitor?

Priority: Medium

No. Platform metrics and the default Azure Activity Log work without a workspace. A workspace is needed when collecting and querying data through Azure Monitor Logs.

Source: Azure Activity Log and Log Analytics Workspace.

4. Kusto Query Language (KQL)

Q28. What is KQL in Azure?

Priority: High

Kusto Query Language (KQL) is a query language used to retrieve, filter, summarize, and analyze log and telemetry data.

Key Points: Log Analytics, Application Insights, Azure Data Explorer, Microsoft Sentinel.

Q29. What is the difference between SQL and KQL?

Priority: High

SQL is primarily used to query and manage relational databases. KQL is optimized for analytical queries over logs, events, and time-series data.

Key Point: Azure Monitor Logs uses read-only KQL queries.

Q30. What is the pipe (|) operator in KQL?

Priority: High

The pipe operator passes the result of one operation to the next operation for further processing.

AzureActivity
| where ActivityStatusValue == "Failure"
| take 10

Q31. What are the most important KQL operators?

Priority: High

Q32. How do you retrieve the latest 10 Azure Activity Logs?

Priority: High

AzureActivity
| order by TimeGenerated desc
| take 10

Returns the 10 most recent records available in the AzureActivity table.

Q33. How do you find failed Azure operations using KQL?

Priority: High

AzureActivity
| where ActivityStatusValue == "Failure"
| project TimeGenerated, OperationNameValue, Caller

Filters failed management operations and displays their timestamp, operation name, and caller.

Q34. What is summarize in KQL?

Priority: High

summarize performs aggregation such as counting records, calculating averages, or finding maximum values.

AzureActivity
| summarize Total = count() by ResourceGroup

Q35. What is the difference between project and extend?

Priority: Medium

project selects or calculates the output columns, while extend adds calculated columns and retains the existing columns.

Q36. What is bin() in KQL?

Priority: Medium

bin() groups values, commonly timestamps, into fixed intervals for time-series analysis.

AzureActivity
| summarize Total = count() by bin(TimeGenerated, 1h)

Q37. How do you retrieve logs from the last 24 hours?

Priority: High

AzureActivity
| where TimeGenerated > ago(24h)

ago(24h) calculates the timestamp 24 hours before the query executes.

Q38. What is the difference between take and top?

Priority: Medium

take returns an arbitrary number of rows without guaranteed ordering. top sorts by a specified column and returns the highest or lowest records.

Q39. How do you find application exceptions using KQL?

Priority: High

AppExceptions
| where TimeGenerated > ago(1h)
| order by TimeGenerated desc
| take 20

Returns recent exceptions from workspace-based Application Insights telemetry.

Q40. How do you find slow API requests using KQL?

Priority: High

AppRequests
| where TimeGenerated > ago(1h)
| where DurationMs > 3000
| project TimeGenerated, Name, DurationMs
| order by DurationMs desc

Identifies requests taking more than three seconds, using the DurationMs column in the workspace-based AppRequests table.

Source: Kusto Query Language in Azure.

5. Data Collection Rule (DCR)

Q41. What is a Data Collection Rule in Azure?

Priority: High

A Data Collection Rule (DCR) defines which monitoring data should be collected, how it should be processed, and where it should be sent.

Key Points: Data sources, transformations, destinations.

Q42. Why do we need a DCR?

Priority: High

DCRs provide centralized control over data collection and routing. They can help reduce unnecessary data ingestion and associated monitoring costs.

Q43. What is Azure Monitor Agent (AMA)?

Priority: High

Azure Monitor Agent collects supported guest operating system logs and performance data from Azure VMs and Azure Arc-enabled servers.

Key Point: AMA uses DCRs to determine its collection configuration.

Q44. What is the relationship between AMA, DCR, and Log Analytics Workspace?

Priority: High

Azure Virtual Machine
         |
         v
Azure Monitor Agent (AMA)
         |
         v
Data Collection Rule (DCR)
         |
         v
Log Analytics Workspace
         |
         v
KQL Queries / Alerts

AMA collects, DCR configures collection, and Log Analytics Workspace stores the data.

Q45. What is the difference between DCR and Diagnostic Settings?

Priority: High

Q46. Can one DCR be associated with multiple VMs?

Priority: Medium

Yes. A single DCR can be associated with multiple compatible Azure VMs, allowing consistent monitoring configurations.

Q47. Does a DCR store logs?

Priority: High

No. A DCR defines collection and routing rules. The collected logs are stored in a configured destination, such as Log Analytics Workspace.

Q48. How do you create a DCR in Azure?

Priority: High

Open Azure Monitor → Data Collection Rules → Create. Configure the rule, add supported resources, choose data sources and destinations, then create the rule.

Q49. How can a DCR reduce monitoring costs?

Priority: Medium

A DCR can collect only required data and apply supported ingestion-time transformations to filter unnecessary records before storage.

Q50. Is DCR required to monitor VM CPU Percentage?

Priority: High

No. Azure automatically collects the VM's platform CPU Percentage metric. A DCR and AMA are generally used for additional guest OS monitoring, such as memory counters or Windows Event Logs.

Source: Data Collection Rule in Azure.

6. Azure Monitor Alerts – Stateful vs Stateless

Q51. What is an Alert in Azure?

Priority: High

An Azure Monitor alert automatically detects specified conditions in Azure resources and can trigger notifications or automated actions.

Example: Send an email when VM CPU usage exceeds 80%.

Q52. What are the main types of Azure Monitor alerts?

Priority: High

Q53. What is a Stateful Alert?

Priority: High

A stateful alert remembers the active alert condition and avoids repeatedly firing for the same ongoing problem. It automatically resolves after recovery criteria are satisfied.

Example: CPU remains above 80% for 20 minutes, but the alert fires once for that incident.

Q54. What is a Stateless Alert?

Priority: High

A stateless alert does not maintain an ongoing active/resolved state. It can fire again whenever the configured condition is met during subsequent evaluations.

Example: An error-count alert fires repeatedly while the threshold continues to be exceeded.

Q55. What is the difference between Stateful and Stateless Alerts?

Priority: High

Q56. Are Azure Metric Alerts stateful by default?

Priority: High

Yes. Azure Monitor metric alerts are stateful by default. Disabling automatic alert resolution makes the metric alert stateless.

Q57. When does a Stateful Metric Alert resolve?

Priority: Medium

Typically, a stateful metric alert resolves when the condition is no longer met for three consecutive evaluations. Specific behavior can depend on the metric and alert configuration.

Q58. What is an Action Group in Azure?

Priority: High

An Action Group defines the notifications or actions executed when an alert fires.

Examples: Email, SMS, webhook, Azure Function, Logic App.

Q59. What is the difference between an Alert Rule and an Action Group?

Priority: High

An Alert Rule defines when an alert should fire. An Action Group defines what action should be performed when it fires.

Q60. What are Azure Alert Severity Levels?

Priority: Medium

Source: Azure Monitor Alerts – Stateful vs Stateless.

7. Creating Azure Monitor Alerts

Q61. How do you create an Azure Monitor Alert?

Priority: High

Navigate to Azure Portal → Monitor → Alerts → Create → Alert Rule. Select the resource, configure the condition, assign an Action Group, set severity, and create the alert.

Q62. What is an Alert Threshold?

Priority: High

A threshold is the value that determines whether an alert condition is satisfied.

Example: Average CPU Percentage greater than 80%.

Q63. What is Evaluation Frequency?

Priority: High

Evaluation frequency determines how often Azure Monitor checks the alert condition.

Example: Evaluate the CPU metric every one minute.

Q64. What is Lookback Period or Window Size?

Priority: High

The lookback period defines the historical data window used to evaluate the alert condition.

Example: Every minute, evaluate average CPU usage over the previous five minutes.

Q65. What is the difference between Static and Dynamic Thresholds?

Priority: High

A static threshold uses a manually configured value, such as CPU greater than 80%. A dynamic threshold uses historical metric patterns to identify abnormal behavior.

Q66. How do you test an Azure Monitor Alert?

Priority: Medium

Temporarily set a threshold below the observed metric value, wait for evaluation, and verify the fired alert and Action Group notification. Restore the original threshold afterward.

Q67. Why is an Azure Alert not firing?

Priority: High

Common reasons include an unmet threshold, incorrect metric or scope, disabled alert rule, missing data, or incorrect evaluation settings.

Q68. Why is an alert email not received?

Priority: Medium

Verify the Action Group configuration, recipient email, notification settings, and whether the alert actually fired. Also check spam filtering and notification delivery.

Source: Create an Azure Monitor Alert.

8. Scenario-Based Interview Questions

Q69. Your ASP.NET Core API hosted in Azure App Service is slow. How do you troubleshoot?

Priority: High

Check App Service response-time and resource metrics. Use Application Insights to inspect slow requests, dependency calls, and exceptions, then analyze the relevant telemetry using KQL.

Q70. Your Azure VM suddenly becomes unavailable. How do you investigate?

Priority: High

Check Azure Monitor metrics, Activity Logs, and Resource Health. Review recent configuration changes, VM status, and guest OS logs where available.

Q71. Your production API returns HTTP 500 errors. Which Azure service would you use?

Priority: High

Use Application Insights to investigate failed requests and exceptions. Use Log Analytics and KQL for detailed analysis and configure alerts for recurring failures.

Q72. You want to monitor Windows Event Logs from 10 Azure VMs. What would you configure?

Priority: High

Configure Azure Monitor Agent and an appropriate Data Collection Rule associated with the VMs. Send the collected events to Log Analytics Workspace for querying and alerting.

Q73. You want an email whenever a production VM is deleted. Which alert should you create?

Priority: High

Create an Azure Activity Log Alert for the relevant VM deletion operation and associate an Action Group with an email notification.

Q74. How would you monitor an ASP.NET Core application in production?

Priority: High

Use Azure Monitor for resource metrics, Application Insights for requests and dependencies, Log Analytics for centralized queries, and Action Groups for notifications.

Architecture:

ASP.NET Core Web API
         |
         v
Azure App Service
         |
         v
Azure Monitor
         |
    +----+----------------+
    |                     |
    v                     v
 Metrics           Application Insights
    |                     |
    |                     v
    |             Log Analytics Workspace
    |                     |
    |                     v
    |                 KQL Queries
    |                     |
    +----------+----------+
               |
               v
          Alert Rules
               |
               v
          Action Group
               |
               v
       Email / Webhook