Azure 클라우드 엔지니어 심층 면접 질문: 완벽 가이드

# Traffic Manager 프로필 생성
az network traffic-manager profile create \
  --name myTMProfile \
  --resource-group myResourceGroup \
  --routing-method Performance \
  --unique-dns-name mytmprofile

# 엔드포인트 추가
az network traffic-manager endpoint create \
  --name eastus-endpoint \
  --profile-name myTMProfile \
  --resource-group myResourceGroup \
  --type azureEndpoints \
  --target-resource-id /subscriptions/.../appgw-eastus

# SQL 지리적 복제 구성
az sql db replica create \
  --name myDatabase \
  --resource-group myResourceGroup \
  --server primary-server \
  --partner-server secondary-server \
  --partner-resource-group myResourceGroup

# AKS 클러스터 생성
az aks create \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --node-count 3 \
  --enable-addons monitoring \
  --generate-ssh-keys \
  --network-plugin azure \
  --enable-managed-identity

# 자격 증명 가져오기
az aks get-credentials \
  --resource-group myResourceGroup \
  --name myAKSCluster

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: myregistry.azurecr.io/myapp:v1
        ports:
        - containerPort: 80
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 250m
            memory: 256Mi
---
apiVersion: v1
kind: Service
metadata:
  name: myapp-service
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: myapp

# 배포
kubectl apply -f deployment.yaml

# 스케일링
kubectl scale deployment myapp --replicas=5

# 이미지 업데이트
kubectl set image deployment/myapp myapp=myregistry.azurecr.io/myapp:v2

// main.bicep
param location string = resourceGroup().location
param vmName string = 'myVM'
param adminUsername string

@secure()
param adminPassword string

resource vnet 'Microsoft.Network/virtualNetworks@2021-02-01' = {
  name: 'myVNet'
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [
        '10.0.0.0/16'
      ]
    }
    subnets: [
      {
        name: 'default'
        properties: {
          addressPrefix: '10.0.1.0/24'
        }
      }
    ]
  }
}

resource nic 'Microsoft.Network/networkInterfaces@2021-02-01' = {
  name: '${vmName}-nic'
  location: location
  properties: {
    ipConfigurations: [
      {
        name: 'ipconfig1'
        properties: {
          subnet: {
            id: vnet.properties.subnets[0].id
          }
          privateIPAllocationMethod: 'Dynamic'
        }
      }
    ]
  }
}

resource vm 'Microsoft.Compute/virtualMachines@2021-03-01' = {
  name: vmName
  location: location
  properties: {
    hardwareProfile: {
      vmSize: 'Standard_B2s'
    }
    osProfile: {
      computerName: vmName
      adminUsername: adminUsername
      adminPassword: adminPassword
    }
    storageProfile: {
      imageReference: {
        publisher: 'Canonical'
        offer: 'UbuntuServer'
        sku: '18.04-LTS'
        version: 'latest'
      }
    }
    networkProfile: {
      networkInterfaces: [
        {
          id: nic.id
        }
      ]
    }
  }
}

output vmId string = vm.id

# Bicep 템플릿 배포
az deployment group create \
  --resource-group myResourceGroup \
  --template-file main.bicep \
  --parameters adminUsername=azureuser adminPassword='P@ssw0rd123!'

# 배포 전 유효성 검사
az deployment group validate \
  --resource-group myResourceGroup \
  --template-file main.bicep

# Azure Advisor 권장 사항 사용
az advisor recommendation list \
  --category Cost \
  --output table

# VM 자동 종료 구성
az vm auto-shutdown \
  --resource-group myResourceGroup \
  --name myVM \
  --time 1900 \
  --email [email protected]

# 예산 생성
az consumption budget create \
  --budget-name monthly-budget \
  --amount 1000 \
  --time-grain Monthly \
  --start-date 2024-01-01 \
  --end-date 2024-12-31

# 제한적인 규칙으로 NSG 생성
az network nsg create \
  --resource-group myResourceGroup \
  --name myNSG

# 기본적으로 모든 인바운드 트래픽 거부, 특정 트래픽 허용
az network nsg rule create \
  --resource-group myResourceGroup \
  --nsg-name myNSG \
  --name DenyAllInbound \
  --priority 4096 \
  --access Deny \
  --direction Inbound

# 저장 시 암호화 활성화
az storage account update \
  --name mystorageaccount \
  --resource-group myResourceGroup \
  --encryption-services blob file

# SQL에 대한 TDE 활성화
az sql db tde set \
  --resource-group myResourceGroup \
  --server myserver \
  --database mydatabase \
  --status Enabled

# Key Vault 생성
az keyvault create \
  --name myKeyVault \
  --resource-group myResourceGroup \
  --location eastus

# 비밀 저장
az keyvault secret set \
  --vault-name myKeyVault \
  --name DatabasePassword \
  --value 'P@ssw0rd123!'

# 보조 데이터베이스 (읽기 복제본) 생성
az sql db replica create \
  --resource-group myResourceGroup \
  --server primary-server \
  --name myDatabase \
  --partner-server secondary-server \
  --partner-resource-group myResourceGroup

# 보조 데이터베이스로 장애 조치
az sql db replica set-primary \
  --name myDatabase \
  --resource-group myResourceGroup \
  --server secondary-server

# 장애 조치 그룹 생성
az sql failover-group create \
  --name my-failover-group \
  --resource-group myResourceGroup \
  --server primary-server \
  --partner-server secondary-server \
  --partner-resource-group myResourceGroup \
  --failover-policy Automatic \
  --grace-period 1 \
  --add-db myDatabase

# 장애 조치 시작
az sql failover-group set-primary \
  --name my-failover-group \
  --resource-group myResourceGroup \
  --server secondary-server

// .NET 예제
string connectionString = 
    "Server=tcp:my-failover-group.database.windows.net,1433;" +
    "Initial Catalog=myDatabase;" +
    "Persist Security Info=False;" +
    "User ID=myuser;" +
    "Password=mypassword;" +
    "MultipleActiveResultSets=False;" +
    "Encrypt=True;" +
    "TrustServerCertificate=False;" +
    "Connection Timeout=30;" +
    "ApplicationIntent=ReadWrite;";  // or ReadOnly for secondary

# 복제 지연 확인
az sql db replica list-links \
  --name myDatabase \
  --resource-group myResourceGroup \
  --server primary-server

# 메트릭 보기
az monitor metrics list \
  --resource /subscriptions/.../databases/myDatabase \
  --metric "connection_successful" \
  --start-time 2024-11-26T00:00:00Z

// C# HTTP 트리거
using System.IO;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;

public static class HttpTriggerFunction
{
    [FunctionName("ProcessOrder")]
    public static async Task<IActionResult> Run(
        [HttpTrigger(AuthorizationLevel.Function, "post", Route = null)] HttpRequest req,
        [Queue("orders", Connection = "AzureWebJobsStorage")] IAsyncCollector<string> orderQueue,
        ILogger log)
    {
        log.LogInformation("Processing order request");
        
        string requestBody = await new StreamReader(req.Body).ReadToEndAsync();
        
        // Validate and process
        if (string.IsNullOrEmpty(requestBody))
        {
            return new BadRequestObjectResult("Order data is required");
        }
        
        // Add to queue for processing
        await orderQueue.AddAsync(requestBody);
        
        return new OkObjectResult(new { message = "Order queued successfully" });
    }
}

# Function App 생성
az functionapp create \
  --resource-group myResourceGroup \
  --consumption-plan-location eastus \
  --runtime dotnet \
  --functions-version 4 \
  --name myFunctionApp \
  --storage-account mystorageaccount

# 로컬에서 배포
func azure functionapp publish myFunctionApp

# 앱 설정 구성
az functionapp config appsettings set \
  --name myFunctionApp \
  --resource-group myResourceGroup \
  --settings \
    "DatabaseConnection=..." \
    "ApiKey=..."

# Application Insights 활성화
az functionapp config appsettings set \
  --name myFunctionApp \
  --resource-group myResourceGroup \
  --settings "APPINSIGHTS_INSTRUMENTATIONKEY=..."

// function.json
{
  "bindings": [
    {
      "type": "queueTrigger",
      "direction": "in",
      "name": "orderMessage",
      "queueName": "orders",
      "connection": "AzureWebJobsStorage"
    },
    {
      "type": "blob",
      "direction": "out",
      "name": "outputBlob",
      "path": "processed/{rand-guid}.json",
      "connection": "AzureWebJobsStorage"
    },
    {
      "type": "cosmosDB",
      "direction": "out",
      "name": "outputDocument",
      "databaseName": "OrdersDB",
      "collectionName": "Orders",
      "createIfNotExists": true,
      "connectionStringSetting": "CosmosDBConnection"
    }
  ]
}

// 오케스트레이터 함수
[FunctionName("OrderOrchestrator")]
public static async Task<object> RunOrchestrator(
    [OrchestrationTrigger] IDurableOrchestrationContext context)
{
    var order = context.GetInput<Order>();
    
    // Step 1: Validate order
    var isValid = await context.CallActivityAsync<bool>("ValidateOrder", order);
    if (!isValid)
    {
        return new { status = "Invalid order" };
    }
    
    // Step 2: Process payment
    var paymentResult = await context.CallActivityAsync<PaymentResult>("ProcessPayment", order);
    
    // Step 3: Update inventory
    await context.CallActivityAsync("UpdateInventory", order);
    
    // Step 4: Send notification
    await context.CallActivityAsync("SendNotification", order);
    
    return new { status = "Order processed", orderId = order.Id };
}

// host.json
{
  "version": "2.0",
  "extensions": {
    "queues": {
      "maxPollingInterval": "00:00:02",
      "batchSize": 16,
      "maxDequeueCount": 5,
      "newBatchThreshold": 8
    },
    "http": {
      "routePrefix": "api",
      "maxConcurrentRequests": 100,
      "maxOutstandingRequests": 200
    }
  },
  "functionTimeout": "00:05:00"
}

# VNet 피어링 생성 (A에서 B로)
az network vnet peering create \
  --name vnetA-to-vnetB \
  --resource-group myResourceGroup \
  --vnet-name vnetA \
  --remote-vnet /subscriptions/.../resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/vnetB \
  --allow-vnet-access \
  --allow-forwarded-traffic

# 역방향 피어링 생성 (B에서 A로)
az network vnet peering create \
  --name vnetB-to-vnetA \
  --resource-group myResourceGroup \
  --vnet-name vnetB \
  --remote-vnet /subscriptions/.../resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/vnetA \
  --allow-vnet-access \
  --allow-forwarded-traffic

# 피어링 상태 확인
az network vnet peering show \
  --name vnetA-to-vnetB \
  --resource-group myResourceGroup \
  --vnet-name vnetA \
  --query peeringState

# 공유 서비스가 있는 허브 VNet
# 다른 애플리케이션/팀을 위한 스포크 VNet

# 게이트웨이 전송 활성화 (허브에 VPN 게이트웨이가 있음)
az network vnet peering update \
  --name hub-to-spoke1 \
  --resource-group myResourceGroup \
  --vnet-name hub-vnet \
  --set allowGatewayTransit=true

# 원격 게이트웨이 사용 (스포크에서 허브의 게이트웨이 사용)
az network vnet peering update \
  --name spoke1-to-hub \
  --resource-group myResourceGroup \
  --vnet-name spoke1-vnet \
  --set useRemoteGateways=true

# 피어링 메트릭 보기
az monitor metrics list \
  --resource /subscriptions/.../virtualNetworks/vnetA \
  --metric "BytesSentRate" \
  --start-time 2024-11-26T00:00:00Z