AZ-104 Deploy and Manage Azure Compute Practice Question
A Windows VM must install IIS after provisioning and then run a script that registers the server with an internal API by using the VM's managed identity. The same steps must run automatically whenever the VM is deployed from Bicep. What should be added to the deployment?
⚠ Common exam trap
Candidates often confuse resource locks or availability sets with automation capabilities, mistakenly thinking they can trigger scripts, when in reality only extensions like Custom Script Extension or Desired State Configuration can perform post-deployment configuration tasks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Custom Script Extension on the VM
The Custom Script Extension (CSE) is the correct choice because it allows you to run PowerShell or Bash scripts on an Azure VM after provisioning, enabling the installation of IIS and execution of a registration script that leverages the VM's managed identity. Since the requirement specifies that these steps must run automatically whenever the VM is deployed from Bicep, the CSE can be declared as a resource in the Bicep template, ensuring it executes on every deployment. This directly addresses the need for post-deployment configuration without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A read-only resource lock on the VM resource group
Why it's wrong here
A read-only resource lock on the resource group prevents any user or process from modifying, deleting, or creating resources within that scope, including the VM and its settings. However, a lock is purely a governance control; it has no compute or execution engine to run scripts, install Windows features, or change the operating system state. Thus, it cannot install IIS or execute provisioning workflows.
When this WOULD be correct
A read-only resource lock would be correct if the question asked for a method to prevent accidental deletion or modification of critical resources after deployment, such as protecting a production VM from unintended changes.
- ✓
A Custom Script Extension on the VM
Why this is correct
The Custom Script Extension is an Azure VM extension that executes a provided PowerShell script after the VM is provisioned, making it the correct choice for installing IIS and running post-deployment tasks. You can deploy it via Azure PowerShell, CLI, or an ARM template, and it supports idempotent execution patterns, enabling you to bootstrap the OS with exactly the required roles and features.
- ✗
An availability set containing the VM
Why it's wrong here
An availability set improves VM resilience by distributing instances across fault domains and update domains, ensuring that at least one VM remains available during maintenance or hardware failures. It is a high-availability topology feature and does not include any agent, extension, or automation mechanism to configure the operating system or install roles like IIS. Its sole purpose is to prevent downtime, not to perform post-provisioning setup.
When this WOULD be correct
A question asks: 'You need to ensure that two VMs running a critical application are not both affected by the same hardware failure or maintenance event. What should you configure?' In that scenario, an availability set would be the correct answer.
- ✗
A proximity placement group for the VM
Why it's wrong here
A proximity placement group is an Azure construct that aligns VMs within the same data center region to minimize network latency between them, typically used for tightly coupled workloads requiring high throughput. It influences only physical placement and network distance, not the software configuration or operating system state of the VM. Therefore, it has no role in installing IIS or running setup scripts after provisioning.
When this WOULD be correct
When deploying multiple VMs that require low network latency between them (e.g., for a high-performance computing cluster or latency-sensitive application), a proximity placement group ensures they are physically close in the datacenter.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Custom Script Extension on the VMCorrect answer▾
Why this is correct
The Custom Script Extension is an Azure VM extension that executes a provided PowerShell script after the VM is provisioned, making it the correct choice for installing IIS and running post-deployment tasks. You can deploy it via Azure PowerShell, CLI, or an ARM template, and it supports idempotent execution patterns, enabling you to bootstrap the OS with exactly the required roles and features.
✗A read-only resource lock on the VM resource groupWrong answer — click to see why▾
Why this is wrong here
A read-only resource lock prevents any modifications to the VM resource group, including the Custom Script Extension needed to install IIS and run the registration script. It does not automate post-deployment configuration.
★ When this WOULD be the correct answer
A read-only resource lock would be correct if the question asked for a method to prevent accidental deletion or modification of critical resources after deployment, such as protecting a production VM from unintended changes.
Why candidates choose this
Candidates may confuse resource locks with automation or think locking the resource group ensures the VM runs scripts, misunderstanding that locks only restrict operations, not execute them.
✗An availability set containing the VMWrong answer — click to see why▾
Why this is wrong here
An availability set provides high availability for VMs by distributing them across fault and update domains, but it does not execute scripts or install software after provisioning. It cannot automate IIS installation or managed identity registration.
★ When this WOULD be the correct answer
A question asks: 'You need to ensure that two VMs running a critical application are not both affected by the same hardware failure or maintenance event. What should you configure?' In that scenario, an availability set would be the correct answer.
Why candidates choose this
Candidates may confuse availability sets with deployment automation, thinking that grouping VMs together ensures consistent configuration, but availability sets only affect placement, not post-deployment actions.
✗A proximity placement group for the VMWrong answer — click to see why▾
Why this is wrong here
A proximity placement group reduces network latency between VMs but does not install IIS or run scripts; it has no role in post-deployment configuration or managed identity usage.
★ When this WOULD be the correct answer
When deploying multiple VMs that require low network latency between them (e.g., for a high-performance computing cluster or latency-sensitive application), a proximity placement group ensures they are physically close in the datacenter.
Why candidates choose this
Candidates may confuse placement groups with configuration management, thinking 'proximity' implies automated setup, or they may overthink the question and assume a placement group is needed for managed identity to work.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Custom script extension
A virtual machine extension for Azure that downloads and runs scripts on a VM after it is deployed, used for configuration, software installation, and post-deployment tasks.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Windows VM must automatically run a setup script after provisioning to install an agent, create a folder, and write configuration files. The administrator wants the script to be delivered through Azure management and run without a human signing in. What should be used?
medium- ✓ A.Custom Script Extension
- B.Availability set
- C.Azure Load Balancer
- D.Route table
Why A: The Custom Script Extension (CSE) is the correct Azure feature to automatically run a setup script on a Windows VM after provisioning. It downloads and executes scripts from Azure Storage or GitHub, runs as the local system account, and requires no user sign-in, making it ideal for post-deployment configuration like installing agents and writing files.
Variation 2. You need to run a script inside an Azure virtual machine after deployment to install application prerequisites. Which feature should you use?
medium- A.Azure Policy
- ✓ B.A Custom Script Extension
- C.Boot diagnostics
- D.A proximity placement group
Why B: The Custom Script Extension (CSE) is the correct feature because it allows you to run a script inside an Azure VM after deployment, making it ideal for installing application prerequisites. CSE downloads and executes scripts on the VM, supporting both Windows (via PowerShell) and Linux (via Bash) environments, and can be applied during initial provisioning or to an existing VM.
Variation 3. You deploy a Windows Server VM and need to run several PowerShell commands after deployment without signing in to the VM. Which Azure feature should you use?
easy- ✓ A.Use the Custom Script Extension on the VM.
- B.Put the VM in an availability zone.
- C.Attach a managed identity and rely on Azure Policy.
- D.Create a snapshot before startup.
Why A: The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run PowerShell or Bash scripts on a VM after deployment without requiring interactive sign-in. It executes the script via the Azure VM Agent, which runs as a local system process, making it ideal for post-deployment configuration tasks like installing software or running commands.
Variation 4. A Windows VM must install an agent and copy a configuration file automatically after provisioning. The administrator wants Azure to run the setup step without logging into the VM manually. Which feature should be used?
easy- A.Boot diagnostics
- ✓ B.VM extension
- C.Managed disk encryption
- D.Availability set
Why B: VM extensions are the correct Azure feature to automatically install agents and apply configurations during or after provisioning without manual login. The Custom Script Extension (CSE) specifically can execute a PowerShell or Bash script to install the agent and copy the configuration file, running as a post-deployment task via Azure Resource Manager (ARM) templates, Azure CLI, or PowerShell.
Variation 5. A Windows VM needs a one-time command run immediately after deployment, and a second VM must automatically install an agent and copy configuration files during provisioning. Which two Azure compute features should the administrator use? Select two.
medium- ✓ A.Run Command
- ✓ B.Custom Script Extension
- C.Azure Monitor agent
- D.Azure Policy assignment
- E.Azure Bastion
Why A: Run Command (A) is correct because it allows a one-time command to be executed immediately on a Windows VM after deployment, without requiring any agent or extension. Custom Script Extension (B) is correct because it enables automated installation of an agent and copying of configuration files during VM provisioning by running a script (e.g., PowerShell or Bash) as part of the deployment process.
Variation 6. A Windows VM must install a monitoring agent, run a bootstrap script during provisioning, and download a configuration file from an Azure resource without storing any credentials in the script or on disk. Which two Azure compute features should the administrator use? Select two.
hard- ✓ A.Use a Custom Script Extension to run the bootstrap actions after provisioning.
- ✓ B.Assign a system-assigned managed identity to the virtual machine.
- C.Enable boot diagnostics and review the serial console output.
- D.Attach a read-only managed disk to store the configuration file.
- E.Use an availability set to keep the bootstrap script highly available.
Why A: The Custom Script Extension (CSE) is the correct Azure feature to run a bootstrap script after provisioning because it executes a script on the VM during or after deployment, enabling installation of the monitoring agent and other configuration tasks. It is the standard method for post-deployment automation on Azure VMs, and it can reference a script stored in Azure Storage or a public URL without embedding credentials.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.