AZ-104 Deploy and Manage Azure Compute Practice Question
A Windows VM needs a one-time command run immediately after deployment, and a second VM must automatically install an agent and copy configuration files during provisioning. Which two Azure compute features should the administrator use? Select two.
⚠ Common exam trap
It's easy for candidates to confuse Azure Monitor agent (a data-collection tool) with the ability to run scripts or install software, or they think Azure Policy can execute commands, when in fact it only audits or enforces configurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run Command
Run Command (A) is correct because it allows a one-time command to be executed immediately on a Windows VM after deployment, without requiring any agent or extension. Custom Script Extension (B) is correct because it enables automated installation of an agent and copying of configuration files during VM provisioning by running a script (e.g., PowerShell or Bash) as part of the deployment process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run Command
Why this is correct
Run Command is a native Azure capability that lets you execute a script on a running Windows VM directly via the platform—no inbound RDP/SSH port, no agent-side interactive sign-in, and no need to deploy additional files. It is designed precisely for one-time, on-demand administrative actions (e.g., resetting config, installing a quick patch) and can be invoked from the portal, Azure CLI, or PowerShell, making it the fastest fit for 'run a command immediately'.
- ✓
Custom Script Extension
Why this is correct
Custom Script Extension (CSE) downloads and runs scripts on a VM, but it is intended for post-provisioning configuration, such as installing software or applying settings during deployment workflows. While it can be triggered on an existing VM, it is deployed as an extension resource and typically used for repeatable, automation-oriented tasks—not the lightweight, one-off, immediate execution that Run Command provides. CSE also requires the VM to be running and the agent to be healthy.
- ✗
Azure Monitor agent
Why it's wrong here
Azure Monitor Agent (AMA) is a data-collection extension that gathers metrics and logs from the OS and sends them to Log Analytics or other destinations. Its sole purpose is telemetry ingestion; it does not implement a command runner or script execution interface. Even though AMA runs as an extension on the VM, it cannot be repurposed to launch administrative commands.
When this WOULD be correct
A question asks: 'You need to collect performance metrics and logs from Azure VMs and send them to a Log Analytics workspace. Which feature should you use?' Azure Monitor agent would be the correct answer.
- ✗
Azure Policy assignment
Why it's wrong here
Azure Policy is a governance service that enforces rules on Azure resources (e.g., tagging, locations, SKU restrictions) at evaluation time. It can apply compliance actions like 'deny' or 'deployIfNotExists', but it has no capability to execute arbitrary shell commands on a VM. Policy evaluation is asynchronous and triggered by resource events, not suitable for on-demand script execution.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion grants interactive RDP/SSH access through a secure, browser-based TLS session, but it is a remote access gateway, not an automation mechanism. Using Bastion would require an administrator to manually sign in and type the command into a console—defeating the purpose of a one-time, immediate, non-interactive run. Furthermore, Bastion only provides connectivity; it has no built-in job or script execution engine.
When this WOULD be correct
An administrator needs to provide secure, browser-based RDP/SSH access to Azure VMs without exposing public IP addresses. The correct answer would be Azure Bastion when the question asks for a PaaS service that enables secure remote access to VMs in a virtual network.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Run CommandCorrect answer▾
Why this is correct
Run Command is a native Azure capability that lets you execute a script on a running Windows VM directly via the platform—no inbound RDP/SSH port, no agent-side interactive sign-in, and no need to deploy additional files. It is designed precisely for one-time, on-demand administrative actions (e.g., resetting config, installing a quick patch) and can be invoked from the portal, Azure CLI, or PowerShell, making it the fastest fit for 'run a command immediately'.
✗Azure Monitor agentWrong answer — click to see why▾
Why this is wrong here
Azure Monitor agent is for collecting telemetry data from VMs, not for running one-time commands or installing agents during provisioning. The question requires immediate command execution and automated agent installation, which are not capabilities of Azure Monitor agent.
★ When this WOULD be the correct answer
A question asks: 'You need to collect performance metrics and logs from Azure VMs and send them to a Log Analytics workspace. Which feature should you use?' Azure Monitor agent would be the correct answer.
Why candidates choose this
Candidates may confuse Azure Monitor agent with the Custom Script Extension because both involve 'agents' and 'extensions', leading them to think it can install software or run scripts during provisioning.
✗Azure BastionWrong answer — click to see why▾
Why this is wrong here
Azure Bastion provides secure RDP/SSH connectivity to VMs without public IPs, but it does not execute one-time commands or install agents during provisioning. The question requires features for post-deployment command execution and automated provisioning tasks.
★ When this WOULD be the correct answer
An administrator needs to provide secure, browser-based RDP/SSH access to Azure VMs without exposing public IP addresses. The correct answer would be Azure Bastion when the question asks for a PaaS service that enables secure remote access to VMs in a virtual network.
Why candidates choose this
Candidates may confuse Azure Bastion's ability to connect to VMs with the ability to run commands or configure VMs, assuming that secure access implies management capabilities.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Custom script extension
A virtual machine extension for Azure that downloads and runs scripts on a VM after it is deployed, used for configuration, software installation, and post-deployment tasks.
Key term
Run command
The Run command is a built-in feature in Windows operating systems that allows you to quickly open programs, files, folders, and system tools by typing a specific command or path directly into a small dialog box.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.