AZ-104 Deploy and Manage Azure Compute — 10 Questions

Question 1

You have an application that writes heavily to Azure-managed disks and requires the highest consistent IOPS and lowest latency. Which disk type should you choose?

Accepted Answer

Ultra Disk. Azure Ultra Disk offers the highest performance among Azure managed disks, with up to 160,000 IOPS per disk and sub-millisecond latency, exceeding Premium SSD v2's 80,000 IOPS. Therefore, Ultra Disk is the correct choice for applications requiring the highest consistent IOPS and lowest latency.

Answer

Standard HDD

Answer

Standard SSD

Answer

Premium SSD v2

Question 2

You need to run a scheduled script on an Azure virtual machine every time the VM starts. Which feature should you use?

Accepted Answer

A Custom Script Extension. To run a script every time an Azure VM starts, use the Custom Script Extension to deploy a script that creates a scheduled task configured to run at system startup. The Custom Script Extension itself executes only during provisioning or when manually invoked; it does not rerun automatically on each boot. Therefore, B is correct because it is the only option that allows executing custom code, and you can use it to set up the startup trigger.

Answer

Boot diagnostics

Answer

Azure Policy

Answer

An availability set

Question 3

You are deploying a Windows Server VM for an internal app. The VM must support Secure Boot and vTPM later, its OS disk must survive host moves, and the team wants the lowest-cost managed disk tier that still behaves like a normal writable OS disk. Which two choices should you make? Select two.

Accepted Answer

Use a Generation 2 Windows Server Marketplace image.. Secure Boot and vTPM are only supported on Generation 2 VMs in Azure, which use UEFI firmware and GPT-partitioned OS disks. A Generation 2 Windows Server Marketplace image provides the necessary firmware and partitioning. Additionally, Azure Trusted Launch (which enables Secure Boot and vTPM) requires a managed OS disk and supports only Premium SSD and Standard SSD tiers, not Standard HDD. Therefore, Standard SSD is the lowest-cost managed disk tier that supports vTPM while remaining a durable, writable OS disk. Ephemeral disks do not survive host moves and unmanaged VHDs are not managed disks, so they are incorrect.

Answer

Use an ephemeral OS disk to reduce storage cost.

Answer

Use an unmanaged VHD stored in a storage account.

Answer

Use a Generation 1 image and enable Secure Boot after deployment.

Question 4

A reporting application needs an Azure VM with at least 8 vCPUs and 64 GiB of RAM. The workload is memory-heavy, and the team wants a reasonable starting point. Which VM family should the administrator choose?

Accepted Answer

E-series. The E-series is Azure's memory-optimized VM family, designed for workloads that require a high memory-to-CPU ratio. For a memory-heavy reporting application, the E-series (e.g., E8s_v3 with 8 vCPUs and 64 GiB RAM) provides the needed memory efficiently and is a reasonable starting point. While a D-series VM like D16s_v3 can also meet the minimum specs, it does so with double the vCPUs, making E-series a more cost-effective and appropriate choice for memory-intensive workloads.

Answer

B-series

Answer

D-series

Answer

F-series

Question 5

A support desk needs to reset the local administrator password on specific virtual machines by using the VMAccess extension and restart those VMs. They must not be able to resize the machines, change networking, or manage disks. What should the administrator create?

Accepted Answer

Create a custom role with only the required VM actions and assign it at the virtual machine scope. The support desk needs only specific actions to reset the local admin password via the VMAccess extension (Microsoft.Compute/virtualMachines/extensions/write) and to restart VMs (Microsoft.Compute/virtualMachines/restart/action), without permissions to resize, change networking, or manage disks. A custom role at the VM scope allows granting precisely these required actions while excluding broader management actions. This follows the principle of least privilege and prevents unintended modifications to other resources.

Answer

Assign the Virtual Machine Contributor built-in role at the subscription scope

Answer

Assign the Contributor role at the resource group scope

Answer

Use an Azure Policy assignment to allow the VMAccess extension

Question 6

A business-critical application runs in a region that does not support availability zones. It uses two Azure VMs and must survive planned maintenance and a single host failure, but it does not need automatic scale-out. Which two actions should the administrator take? Select two.

Accepted Answer

Place both VMs in the same availability set. An availability set provides redundancy within a single region that does not support availability zones, protecting against both planned maintenance (via update domains) and host failures (via fault domains). By placing both VMs in the same availability set, Azure ensures they are distributed across multiple fault domains (up to 3) and update domains (up to 20), so a single hardware failure or planned maintenance event does not affect both VMs simultaneously.

Answer

Deploy the VMs so Azure distributes them across fault and update domains within that set

Answer

Deploy the VMs in separate availability zones

Answer

Convert the workload to a single larger VM

Answer

Put the VMs in a proximity placement group

Question 7

An application runs on two VMs in one Azure region. The business wants protection from a single hardware host failure and planned maintenance, but it does not require protection from an entire datacenter outage. Which two choices should the administrator make? Select two.

Accepted Answer

Place both VMs in an availability set.. An availability set distributes VMs across multiple fault domains (hardware hosts) and update domains within a single Azure datacenter. This protects against a single hardware host failure and planned maintenance (update domains ensure VMs are not rebooted simultaneously during updates). To benefit from this protection, you must have at least two VMs running in the same availability set; a single VM does not receive any fault or update domain isolation. Therefore, Option B (placing both VMs in an availability set) and Option D (keeping at least two running VMs in that availability set) are correct. Availability zones would protect against a full datacenter outage, which is not required here, and Azure Site Recovery is for disaster recovery to another region.

Answer

Place the workload in a single VM with a premium SSD.

Answer

Use availability zones across the region.

Answer

Replicate the VMs to another region with Azure Site Recovery.

Question 8

A batch container in Azure Container Instances should stop after a successful run and may retry only when the process fails. Which two restart policies are correct for that style of workload? Select two.

Accepted Answer

OnFailure. Azure Container Instances restart policies: Always restarts regardless of exit code; OnFailure restarts only when the process fails (non-zero exit code) and does not restart after success; Never never restarts after completion, regardless of exit code. For a batch workload that should stop after a successful run and may retry only on failure, OnFailure is the correct policy. Never would not retry on failure, so it is not suitable.

Answer

Never

Answer

Always

Answer

Manual

Answer

Scheduled

Question 9

A data disk was accidentally deleted from a production VM. The team has a snapshot of that disk from the previous night and wants the fastest Azure-side recovery path with the least risk of overwriting the existing OS disk. What should the administrator do first?

Accepted Answer

Create a new managed disk from the snapshot, then attach that disk to the VM.. Creating a new managed disk from the snapshot and attaching it to the VM is the fastest Azure-side recovery path. This directly restores the deleted data disk without affecting the existing OS disk. The new data disk can be created from the snapshot and attached within minutes using the Azure portal, CLI, or PowerShell, with minimal downtime.

Answer

Restore the entire virtual machine from the snapshot and overwrite the current instance.

Answer

Convert the snapshot into a temporary storage account and copy the files back manually.

Answer

Recreate the VM from the same marketplace image and restore only the deleted disk later.

Question 10

A scale set of application VMs uploads JSON files to one blob container. The identity must not use secrets, must keep working if an instance is reimaged or replaced, and the same identity should be reusable across all instances. What should the administrator configure?

Accepted Answer

A user-assigned managed identity, attached to the scale set, with Storage Blob Data Contributor scoped to the container.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource, can be assigned to multiple VMs in a scale set, and persists independently of any VM instance lifecycle. This ensures the identity remains available even if an instance is reimaged or replaced, and it avoids the need for secrets. The Storage Blob Data Contributor role scoped to the specific container grants the necessary permissions for uploading JSON files without exposing account-level access.

Answer

A system-assigned managed identity on each VM instance, with account-wide storage permissions.

Answer

A shared access signature stored in the VM image and renewed annually.

Answer

The storage account access key, because it allows the most reliable upload path.