AZ-104 Deploy and Manage Azure Compute Practice Question
A Linux VM restarts after a configuration change and now stops before the sign-in prompt. The administrator cannot use SSH. Which Azure feature should be checked first to inspect the startup process?
⚠ Common exam trap
Many exam-takers confuse Boot diagnostics with Network Watcher or assume Azure Advisor can provide real-time troubleshooting, but only Boot diagnostics gives direct access to the VM's serial console and boot logs when SSH is unavailable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Boot diagnostics
Boot diagnostics captures serial console output and screenshots of the VM, allowing you to view kernel messages, boot logs, and the exact point where the startup process halts. Since SSH is unavailable and the VM stops before the sign-in prompt, this is the first Azure feature to check for troubleshooting the boot sequence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Boot diagnostics
Why this is correct
Boot diagnostics is the correct first step because it captures two key artifacts: a screenshot of the VM's display and a serial console log that streams from the boot process before the operating system fully loads. For a Linux VM that restarts and then fails to come up, the serial log can reveal kernel panics, failed fstab mounts, missing device drivers, or misconfigured systemd services. This data is preserved even when the VM has no network connectivity or an unreachable SSH daemon, making it the only option that directly exposes boot-stage output.
- ✗
Network Watcher packet capture
Why it's wrong here
Network Watcher packet capture is a diagnostic tool for inspecting network traffic flows into and out of the VM's virtual network interface, typically used to analyze communication problems like blocked ports, malicious traffic, or application-level connectivity issues. It does not collect any console output, boot logs, or kernel messages, and it assumes the VM is already running and reachable enough to have a functioning network stack. After a configuration change causes a restart, a boot failure may occur before the network interface is initialized, so packet capture would likely contain no useful data about why the system failed to start.
When this WOULD be correct
When a VM is unreachable over the network (e.g., SSH fails) and you need to capture network packets to analyze traffic patterns, identify packet loss, or detect security threats. For example, if a VM is not responding to SSH due to a firewall rule or DDoS attack, packet capture would be the correct tool.
- ✗
Azure Advisor
Why it's wrong here
Azure Advisor is a continuous assessment service that analyzes resource configurations and usage telemetry to provide best-practice recommendations across cost, security, reliability, performance, and operational excellence. It does not collect VM boot logs, nor does it offer any real-time or historical troubleshooting of startup failures. After a VM restarts and becomes inaccessible, Advisor might suggest changes to increase availability or performance, but it cannot tell you why the boot failed or what kernel/init error occurred, so it is not a boot diagnostic tool.
When this WOULD be correct
A question asks: 'Which Azure service provides personalized recommendations to improve the reliability, security, and performance of your Azure resources?' In that context, Azure Advisor is the correct answer.
- ✗
Managed identity
Why it's wrong here
Managed identity is an Azure Active Directory feature that provides the VM with an automatically managed service principal, allowing it to authenticate to Azure services such as Key Vault, Storage, or Azure SQL without embedding credentials in code. It operates entirely at the application and ARM authentication layer, and it does not interact with the VM's local boot sequence, kernel, or system initialization. While a misconfigured managed identity could prevent an application from accessing resources, it cannot cause a VM to fail booting after a configuration change, so it is irrelevant to diagnosing startup failures.
When this WOULD be correct
A scenario where a VM needs to access Azure Key Vault or Azure Storage without managing secrets, and the question asks for the feature that enables secure authentication without credentials.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Boot diagnosticsCorrect answer▾
Why this is correct
Boot diagnostics is the correct first step because it captures two key artifacts: a screenshot of the VM's display and a serial console log that streams from the boot process before the operating system fully loads. For a Linux VM that restarts and then fails to come up, the serial log can reveal kernel panics, failed fstab mounts, missing device drivers, or misconfigured systemd services. This data is preserved even when the VM has no network connectivity or an unreachable SSH daemon, making it the only option that directly exposes boot-stage output.
✗Network Watcher packet captureWrong answer — click to see why▾
Why this is wrong here
Network Watcher packet capture is used to diagnose network traffic issues, not to inspect the startup process of a VM. The question involves a VM that stops before the sign-in prompt, which is a boot or OS-level problem, not a network connectivity issue.
★ When this WOULD be the correct answer
When a VM is unreachable over the network (e.g., SSH fails) and you need to capture network packets to analyze traffic patterns, identify packet loss, or detect security threats. For example, if a VM is not responding to SSH due to a firewall rule or DDoS attack, packet capture would be the correct tool.
Why candidates choose this
Candidates may confuse the inability to SSH with a network problem, assuming that packet capture can help diagnose why SSH is failing, when in fact the issue is a boot failure that occurs before network services start.
✗Azure AdvisorWrong answer — click to see why▾
Why this is wrong here
Azure Advisor provides recommendations for best practices in reliability, security, performance, and cost, but it does not offer real-time or historical access to the VM's startup logs or serial console output, which are needed to diagnose a boot failure.
★ When this WOULD be the correct answer
A question asks: 'Which Azure service provides personalized recommendations to improve the reliability, security, and performance of your Azure resources?' In that context, Azure Advisor is the correct answer.
Why candidates choose this
Candidates may think Azure Advisor can help diagnose issues because it provides recommendations for VM health, but it lacks the granular, low-level boot diagnostic data required for troubleshooting startup problems.
✗Managed identityWrong answer — click to see why▾
Why this is wrong here
Managed identity is used for authenticating to Azure services without storing credentials, not for troubleshooting boot or startup issues. It does not provide any mechanism to inspect the VM startup process.
★ When this WOULD be the correct answer
A scenario where a VM needs to access Azure Key Vault or Azure Storage without managing secrets, and the question asks for the feature that enables secure authentication without credentials.
Why candidates choose this
Candidates may confuse managed identity with other identity-related troubleshooting tools, or think it can be used to remotely access the VM's boot process via some identity-based mechanism.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.