AZ-104 Deploy and Manage Azure Compute Practice Question
A Windows VM must install a monitoring agent, run a bootstrap script during provisioning, and download a configuration file from an Azure resource without storing any credentials in the script or on disk. Which two Azure compute features should the administrator use? Select two.
⚠ Common exam trap
A common mix-up: candidates confuse boot diagnostics (Option C) with a method to run scripts, or think that a managed disk (Option D) can replace the need for secure credential storage, when in fact the combination of managed identity and Custom Script Extension is the only secure, credential-free approach for post-deployment automation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Custom Script Extension to run the bootstrap actions after provisioning.
The Custom Script Extension (CSE) is the correct Azure feature to run a bootstrap script after provisioning because it executes a script on the VM during or after deployment, enabling installation of the monitoring agent and other configuration tasks. It is the standard method for post-deployment automation on Azure VMs, and it can reference a script stored in Azure Storage or a public URL without embedding credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a Custom Script Extension to run the bootstrap actions after provisioning.
Why this is correct
The Custom Script Extension is an Azure VM extension that lets you execute a configured script after the VM is provisioned. It can be delivered via ARM templates, Azure CLI, or PowerShell, and handles download, execution, and logging of the script. This is the standard mechanism for bootstrapping software installation, including monitoring agents, on Windows VMs, because it runs with the VM's local privileges and can be idempotent if written correctly.
- ✓
Assign a system-assigned managed identity to the virtual machine.
Why this is correct
A system-assigned managed identity gives the VM an Azure Active Directory identity that is automatically created and deleted with the VM. It allows the VM to authenticate to Azure APIs, such as Key Vault or Storage, without embedding credentials in scripts or files. This is a critical complement to the Custom Script Extension, because the bootstrap script can use the identity to fetch secrets or configs, but the identity itself does not execute the bootstrap or install anything.
- ✗
Enable boot diagnostics and review the serial console output.
Why it's wrong here
Boot diagnostics captures the VM's serial console output and screenshots, which is invaluable when a VM fails to start or the script errors during early boot. However, it is purely a diagnostic tool—it does not execute scripts, install agents, or modify the VM's state. Reviewing serial output can help you debug why the bootstrap failed, but it cannot perform the bootstrap itself.
When this WOULD be correct
A question where a VM fails to boot and the administrator needs to view kernel logs or debug boot issues without RDP/SSH access. The correct answer would be to enable boot diagnostics and review serial console output.
- ✗
Attach a read-only managed disk to store the configuration file.
Why it's wrong here
Attaching a read-only managed disk provides persistent block storage that the VM can mount to access files, but it does not run any code or establish any authentication context. While you could store a bootstrap script on it, the disk alone cannot execute the script or trigger deployment-time actions; a separate mechanism like Custom Script Extension is required. Moreover, read-only disks are not a security boundary for secrets because the VM still needs a way to access them.
When this WOULD be correct
A question where a VM needs to access a static configuration file that is pre-stored on a managed disk, and the VM has a managed identity to authenticate to the disk, with no requirement to download from an Azure resource like a storage account.
- ✗
Use an availability set to keep the bootstrap script highly available.
Why it's wrong here
An availability set is a logical grouping of VMs that ensures their physical placement across fault and update domains to preserve service availability during hardware failures or maintenance. It has no bearing on software installation, script execution, or identity management. While high availability is important for hosted services, it does not assist with bootstrapping a single VM; the bootstrap must be run individually regardless of placement.
When this WOULD be correct
In a scenario where the requirement is to ensure that a set of VMs remain available during planned or unplanned maintenance, and the question asks for a feature to achieve high availability for the application, an availability set would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use a Custom Script Extension to run the bootstrap actions after provisioning.Correct answer▾
Why this is correct
The Custom Script Extension is an Azure VM extension that lets you execute a configured script after the VM is provisioned. It can be delivered via ARM templates, Azure CLI, or PowerShell, and handles download, execution, and logging of the script. This is the standard mechanism for bootstrapping software installation, including monitoring agents, on Windows VMs, because it runs with the VM's local privileges and can be idempotent if written correctly.
✗Enable boot diagnostics and review the serial console output.Wrong answer — click to see why▾
Why this is wrong here
Boot diagnostics and serial console output are used for troubleshooting boot failures, not for installing agents or running scripts without credentials. They do not execute custom scripts or download files securely.
★ When this WOULD be the correct answer
A question where a VM fails to boot and the administrator needs to view kernel logs or debug boot issues without RDP/SSH access. The correct answer would be to enable boot diagnostics and review serial console output.
Why candidates choose this
Candidates may confuse boot diagnostics with a method to run scripts or retrieve configuration, as it provides console access, but it is read-only and not for automated provisioning tasks.
✗Attach a read-only managed disk to store the configuration file.Wrong answer — click to see why▾
Why this is wrong here
Attaching a read-only managed disk does not allow the VM to download a configuration file from an Azure resource without storing credentials; the disk itself is a storage resource that would require authentication to access, and it does not solve the credential storage problem.
★ When this WOULD be the correct answer
A question where a VM needs to access a static configuration file that is pre-stored on a managed disk, and the VM has a managed identity to authenticate to the disk, with no requirement to download from an Azure resource like a storage account.
Why candidates choose this
Candidates may think a read-only disk is a secure way to provide configuration files without credentials, but they overlook that the disk still needs authentication to attach and that the requirement is to download from an Azure resource, not attach a disk.
✗Use an availability set to keep the bootstrap script highly available.Wrong answer — click to see why▾
Why this is wrong here
An availability set provides high availability for VMs by distributing them across fault and update domains, but it does not execute scripts or manage credentials. It cannot run a bootstrap script or download a configuration file without storing credentials.
★ When this WOULD be the correct answer
In a scenario where the requirement is to ensure that a set of VMs remain available during planned or unplanned maintenance, and the question asks for a feature to achieve high availability for the application, an availability set would be the correct answer.
Why candidates choose this
Candidates may confuse availability sets with high availability of scripts or think that distributing VMs across domains somehow helps with script execution or credential management, not realizing that availability sets address VM uptime, not provisioning tasks.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
Custom script extension
A virtual machine extension for Azure that downloads and runs scripts on a VM after it is deployed, used for configuration, software installation, and post-deployment tasks.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.