AZ-104 Deploy and Manage Azure Compute Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use an Azure Compute Gallery image version created from the approved hardened build.

  Why this is correct

  Azure Compute Gallery (formerly Shared Image Gallery) centralizes approved VM images and supports versioning, so the hardened Windows build is captured once and can be reused without re-hardening. It also allows replication to multiple regions and controlled sharing across subscriptions/tenants, making it the authoritative source for compliant VM deployments. This directly addresses the requirement for an approved baseline rather than ad-hoc configuration.

• ✓

  Reference that gallery image as the source image in the VM deployment.

  Why this is correct

  When deploying, you must specify the gallery image definition/version as the source image in the template or CLI/PS. This ties the new VM to the approved, hardened configuration, preventing use of unapproved marketplace images or manual baselines. It also ensures that any replicated image version is used consistently across environments, so the VM inherits OS config, security policies, and pre-installed components exactly as validated.

• ✓

  Include the IIS extension or a custom script extension in the same deployment template or script.

  Why this is correct

  Use the CustomScriptExtension or IIS-specific DSC/extension inside the same ARM/Bicep deployment to install IIS during provisioning. This is idempotent and automated, so every VM gets identical software state without RDP/console access, and it is a standard practice for declarative infrastructure as code. It also avoids post-deployment drift because the configuration is part of the deployment pipeline, not a manual follow-up.

• ✗

  Start from a fresh marketplace image and harden it manually after the VM is running.

  Why it's wrong here

  Using a raw marketplace image means applying security patches, registry changes, and OS policies manually after provisioning, which is time-consuming and error-prone; if not every step is followed exactly, the VM can become non-compliant. The approved hardened build is already pre-validated, so this path duplicates work and is inconsistent with the premise that a hardened baseline already exists. Moreover, manual hardening after deployment does not scale and cannot be audited as easily as image-based provisioning.

  When this WOULD be correct

  This option would be correct in a scenario where no pre-approved hardened image exists, and the administrator is required to create a new baseline by manually hardening a fresh marketplace image and then capturing it as a custom image for future deployments.

• ✗

  Install IIS interactively after logging in to the VM with an administrator account.

  Why it's wrong here

  Logging in manually to install IIS introduces human error and is non-repeatable; each administrator might change settings, use different versions, or forget steps, breaking the approved baseline. It also requires exposed WinRM/RDP credentials and interactive sessions, which conflicts with strict CI/CD and security-compliance practices that demand automated, auditable provisioning. In an exam context, this would be marked incorrect because Azure offers extensions and templates for hands-off configuration.

  When this WOULD be correct

  If the question asked for a one-time manual setup for a single VM without automation requirements, or if the scenario involved troubleshooting or post-deployment configuration where interactive access is needed.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question