We use cookies for site analytics. Accept to help us understand how the site is used. See our Privacy Policy for details.
Login and subscription juggling, the resource-group model everything hangs off, JMESPath --query, and the VM / storage / AKS / Key Vault / App Service commands worth knowing cold.
The Azure CLI is more consistent than its AWS counterpart - almost every command is az <group> <subgroup> <verb> where the verbs are the same handful (create, list, show, update, delete, wait) across every service. Once you internalise that shape you can guess commands you have never run, which is exactly the skill AZ-104 and AZ-204 questions probe. The other thing to internalise early: in Azure everything lives in a resource group inside a subscription, and a resource group is a real lifecycle boundary, not a tag. Deleting one deletes everything in it. Set a default resource group and you stop repeating -g on every command; forget which subscription you are in and you will create resources in the wrong place.
| Command | What it does | Common flags | Example |
|---|---|---|---|
| az login | Browser-based sign-in. Falls back to device code on headless machines. | --use-device-code, --tenant <id>, --service-principal -u <appId> -p <secret> --tenant <id>, --identity (managed identity on an Azure VM) | az login --use-device-code |
| az account show | Which subscription and tenant am I in? The equivalent of a pre-flight check. | --query '[name,id]' --output tsv | az account show --query name --output tsv |
| az account list / set | List available subscriptions and switch the active one. | list --output table --all; set --subscription <name-or-id> | az account set --subscription 'Production' |
| az configure | Persistent defaults so you stop typing -g and -l everywhere. | --defaults group=rg-prod location=eastus, --list-defaults, --output table | az configure --defaults group=rg-prod location=eastus |
| az group create / list / delete | Resource groups. Delete is recursive over everything inside - there is no undo. | create -n -l; delete -n --yes --no-wait; list --output table | az group create -n rg-prod -l eastus |
| az upgrade / az version | Update the CLI in place; print core and extension versions. | upgrade --yes, extension add --name <ext> | az version --output table |
| Command | What it does | Common flags | Example |
|---|---|---|---|
| az vm create | Create a VM, plus a NIC, public IP, NSG and vnet if they do not exist. | -g -n --image Ubuntu2204 --size Standard_B2s --admin-username --generate-ssh-keys --vnet-name --subnet --public-ip-address "" (none) | az vm create -g rg-prod -n web1 --image Ubuntu2204 --size Standard_B2s --admin-username azureuser --generate-ssh-keys |
| az vm list / show | Inventory. Add -d (show details) to get power state and IPs, which the plain list omits. | -d --output table, --query, -g | az vm list -d --output table |
| az vm start / stop / deallocate | stop shuts the OS down but you keep paying for compute; deallocate releases the hardware and stops compute billing. This distinction is exam bait. | -g -n, --no-wait | az vm deallocate -g rg-prod -n web1 |
| az vm run-command invoke | Run a script inside a VM with no SSH/RDP and no inbound port. Excellent break-glass answer. | --command-id RunShellScript | RunPowerShellScript, --scripts | az vm run-command invoke -g rg-prod -n web1 --command-id RunShellScript --scripts 'systemctl restart nginx' |
| az vm resize | Change SKU. Reboots the VM. | --size, --no-wait | az vm resize -g rg-prod -n web1 --size Standard_D2s_v5 |
| az network vnet create / subnet create | Virtual networks and subnets. | vnet create --address-prefix 10.0.0.0/16 --subnet-name default --subnet-prefix 10.0.1.0/24 | az network vnet create -g rg-prod -n vnet-main --address-prefix 10.0.0.0/16 |
| az network nsg rule create | NSG rule. Priority is mandatory and lower numbers win; the first match stops evaluation. | --nsg-name --name --priority --access Allow|Deny --protocol --destination-port-ranges --source-address-prefixes | az network nsg rule create -g rg-prod --nsg-name nsg-web -n allow-https --priority 100 --access Allow --protocol Tcp --destination-port-ranges 443 |
| az network public-ip create | Public IP. Standard SKU is zone-redundant and static. | --sku Standard --allocation-method Static --zone 1 2 3 | az network public-ip create -g rg-prod -n pip-web --sku Standard --allocation-method Static |
| Command | What it does | Common flags | Example |
|---|---|---|---|
| az storage account create | Storage account - the container for blobs/files/queues/tables. | --sku Standard_LRS|Standard_GRS|Premium_LRS, --kind StorageV2, --access-tier Hot|Cool, --min-tls-version TLS1_2, --allow-blob-public-access false | az storage account create -g rg-prod -n stprodassets --sku Standard_LRS --kind StorageV2 --allow-blob-public-access false |
| az storage blob upload / download | Single-blob transfer. upload-batch/download-batch for directories. | --account-name --container-name --name --file, --auth-mode login (use your Entra identity instead of a key), --overwrite | az storage blob upload-batch --account-name stprodassets -d '$web' -s ./dist --auth-mode login |
| az storage account keys list | Access keys. Prefer --auth-mode login or a SAS - keys are account-wide and cannot be scoped. | --query '[0].value' -o tsv | az storage account keys list -g rg-prod -n stprodassets --query '[0].value' -o tsv |
| az keyvault create | Key Vault. Enable purge protection for anything production - it blocks permanent deletion inside the retention window. | --enable-rbac-authorization true, --enable-purge-protection true, --retention-days 90 | az keyvault create -g rg-prod -n kv-prod --enable-rbac-authorization true --enable-purge-protection true |
| az keyvault secret set / show | Write and read a secret. | --vault-name --name --value | --file, show --query value -o tsv | az keyvault secret show --vault-name kv-prod --name db-password --query value -o tsv |
| az ad sp create-for-rbac | Service principal plus a role assignment. The standard CI credential. | --name --role Contributor --scopes /subscriptions/<id>/resourceGroups/rg-prod, --sdk-auth | az ad sp create-for-rbac --name ci-deploy --role Contributor --scopes /subscriptions/$SUB/resourceGroups/rg-prod |
| az role assignment create / list | Azure RBAC. Scope is a hierarchy - management group, subscription, resource group, resource - and assignments inherit downward. | --assignee --role --scope; list --all --output table | az role assignment create --assignee user@example.com --role Reader --scope /subscriptions/$SUB |
| Command | What it does | Common flags | Example |
|---|---|---|---|
| az aks create | Managed Kubernetes cluster. | --node-count --node-vm-size --enable-managed-identity --network-plugin azure --attach-acr <registry> --enable-cluster-autoscaler --min-count --max-count | az aks create -g rg-prod -n aks-prod --node-count 3 --enable-managed-identity --attach-acr acrprod |
| az aks get-credentials | Merge the cluster context into ~/.kube/config so kubectl works. | --overwrite-existing, --admin (bypasses Entra RBAC) | az aks get-credentials -g rg-prod -n aks-prod --overwrite-existing |
| az aks nodepool add / scale / upgrade | Node pool lifecycle, independent of the control plane. | --cluster-name --name --node-count --node-vm-size --mode User|System --kubernetes-version | az aks nodepool scale -g rg-prod --cluster-name aks-prod -n userpool --node-count 5 |
| az acr build / login | Build a container image in Azure Container Registry without a local Docker daemon. | --registry --image name:tag . | az acr build --registry acrprod --image api:v2 . |
| az webapp up | Zero-config deploy of the current directory - creates the plan and app if needed. Great for demos. | --name --runtime 'NODE:20-lts' --sku B1 --location | az webapp up --name my-api --runtime 'NODE:20-lts' --sku B1 |
| az webapp config appsettings set | Environment variables. Setting them restarts the app. | --settings KEY=value KEY2=value2, --slot staging | az webapp config appsettings set -g rg-prod -n my-api --settings NODE_ENV=production |
| az webapp deployment slot swap | Blue/green swap between deployment slots - the standard zero-downtime answer. | --slot staging --target-slot production | az webapp deployment slot swap -g rg-prod -n my-api --slot staging --target-slot production |
| az webapp log tail | Live application logs. | --provider application, --slot | az webapp log tail -g rg-prod -n my-api |
Time and space complexity for the data structures, sorting algorithms, and search routines that show up in coding interviews. Skim the row, remember the row, defend the row in an interview.
The recurring shapes - sliding window, two pointers, fast/slow, BFS/DFS, backtracking, DP, divide & conquer, binary search variants, union-find, topological sort. Each entry: when to reach for it, the template, complexity, and which classic problems use it.
The recurring forks in system design interviews. CAP, PACELC, sync vs async, push vs pull, SQL vs NoSQL, sharding shapes, consistency models, cache strategies, idempotency, and rate limiting. For each, the options and when to choose each.
Filesystem layout, the commands you actually use (find / grep / awk / sed / xargs), processes and signals, networking, permissions, basic shell scripting, and a vi survival kit.
Query clause order, every JOIN type and when to use it, aggregates vs window functions, what indexes actually buy you, transaction isolation levels, and the NULL / WHERE-vs-HAVING / EXISTS-vs-IN gotchas interviewers fish for.
The everyday commands, every undo scenario mapped to its fix, rebase vs merge with a side to pick, interactive rebase, bisect, the reflog safety net, stash, and the flags worth aliasing.
The docker and kubectl commands you reach for daily, Dockerfile best practices, how layer caching actually works, the core k8s objects in one screen, requests vs limits, liveness vs readiness, and a step-by-step CrashLoopBackOff debug flow.
Method semantics and idempotency, the ~15 status codes that matter, resource naming rules, offset vs cursor pagination, versioning and auth tradeoffs, error body conventions, rate-limit headers, and the smells reviewers flag.
The STAR structure with timing, what interviewers actually grade, eight question archetypes and how to frame each, the anti-patterns that sink answers (rambling, "we" instead of "I", no metrics), and a 30-second answer skeleton.
TCP vs UDP, the TLS and TCP handshakes, HTTP versions, status codes, DNS resolution, the OSI and TCP/IP layer models, and the ports you are expected to know in an interview.
Anchors, character classes, quantifiers, groups, alternation, lookarounds, backreferences, and flags - plus practical patterns and the gotchas that trip people up in interviews.
The USE method, a first-five-minutes triage runbook, and the CPU, memory, disk, network, and tracing commands you reach for when a Linux box is misbehaving.
A fast reference for concurrency primitives, synchronization tradeoffs, the memory model, and the classic bugs that show up in systems interviews and real code.
A reference for the theorems, consistency models, replication and partitioning strategies, delivery guarantees, and resilience patterns that come up in system design interviews.
Topics, partitions, and consumer groups, the three delivery semantics and how Kafka actually achieves each, ordering guarantees, rebalancing, retention vs compaction, and a straight Kafka vs SQS vs RabbitMQ vs Kinesis comparison.
Schema, types, and resolvers, the three operation kinds, the N+1 problem and DataLoader, cursor vs offset pagination, error handling that actually works, security (depth limiting, query cost), and an honest answer to 'when does REST beat GraphQL'.
State and why it must be remote and locked, the init/plan/apply lifecycle, modules and variables, count vs for_each, workspaces, import and drift, a command table, and the gotchas (prevent_destroy, secrets in state) that mark real production experience.
How LLMs work in one paragraph, the knobs (context window, temperature, top-p), system vs user prompts, few-shot and chain-of-thought, RAG and embeddings, the fine-tune-vs-prompt decision, tool calling, eval basics, and the interview questions teams actually ask now.
How B-tree indexes actually work, composite index column order, covering indexes, reading EXPLAIN ANALYZE, why the planner ignores your index, join algorithms, N+1, keyset pagination, and the 'why is this query slow' scenarios interviews are built on.
Profiles and credential resolution, the --query vs --filters distinction that trips people up, and the EC2 / S3 / IAM / VPC / Lambda / CloudWatch commands you actually reach for under time pressure.
Configurations and the project/ADC model, gcloud vs gsutil vs bq, and the Compute Engine / GKE / Cloud Run / IAM / BigQuery commands that carry the ACE and Professional exams.
Chart anatomy, the values precedence order that explains every "why did my override not apply", install vs upgrade --install, template vs dry-run vs diff, and rollback.
The gh commands that remove the browser round-trip: PR create/review/merge, issues, run watching and log digging on Actions, releases, and gh api for anything without a command.
The same operation in all three CLIs, side by side - compute, storage, networking, IAM, Kubernetes, serverless and logging - plus the service-name mapping and the model differences the equivalences hide.
Reading is the floor. The signal in interviews comes from working problems out loud and defending your tradeoffs. Spin up an AI mock interview or run a coding challenge to put these to work.