How to Inspect Azure VM Boot Failure with Black Screen Using Boot Diagnostics
After a custom image is applied, a VM restarts to a black screen and never reaches the login prompt. The administrator needs the fastest way to inspect what happened during boot without logging into the guest OS. What should be enabled or reviewed first?
Quick Answer
The answer is Boot diagnostics, which should be enabled and reviewed first to inspect an Azure VM boot failure with a black screen. This tool captures serial console output and screenshots of the VM during the boot process, providing immediate, out-of-band visibility into boot failures like a black screen without requiring guest OS access via RDP or SSH. On the AZ-104 exam, this scenario tests your understanding of Azure’s native troubleshooting tools, often appearing as a distractor against options like resetting the VM’s password or redeploying the image—both of which require guest OS access or are slower. A common trap is assuming you need to enable RDP or SSH first, but boot diagnostics works even when the OS is unresponsive, making it the fastest method for inspecting kernel panics or driver issues. Memory tip: “Boot diagnostics sees what the screen sees” — it captures the exact black screen and console logs, so you don’t have to guess.
⚠ Common exam trap
Candidates often confuse Boot diagnostics (which captures boot-time logs and screenshots) with VM extension status or metrics, mistakenly thinking they can diagnose a boot failure from post-boot telemetry or network checks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Boot diagnostics
Boot diagnostics captures serial console output and screenshots of the VM during boot, allowing you to inspect boot failures like a black screen without guest OS access. This is the fastest method because it provides immediate, out-of-band visibility into the boot process, including kernel panics or driver issues, without requiring RDP or SSH connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Boot diagnostics
Why this is correct
Boot diagnostics captures a screenshot and serial log data that help diagnose failures before the guest OS loads.
- ✗
Azure Monitor metric alert
Why it's wrong here
Metric alerts can notify about symptoms, but they do not show detailed pre-login boot output from the VM.
When this WOULD be correct
When a VM is experiencing intermittent high CPU or memory usage that affects performance, and you need to be notified proactively to investigate before users report issues.
- ✗
VM extension status
Why it's wrong here
Extension status is useful after the OS is running, but it does not show the initial boot screen contents.
- ✗
Network Watcher IP flow verify
Why it's wrong here
IP flow verification analyzes network paths, but this problem is about startup and boot-time visibility.
When this WOULD be correct
When a VM cannot connect to another resource (e.g., a database) and you need to verify if a network security rule is blocking traffic, IP flow verify would be the correct tool to use.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Boot diagnosticsCorrect answer▾
Why this is correct
Boot diagnostics captures a screenshot and serial log data that help diagnose failures before the guest OS loads.
✗Azure Monitor metric alertWrong answer — click to see why▾
Why this is wrong here
Azure Monitor metric alerts monitor performance metrics (e.g., CPU, memory) and trigger notifications, but they do not provide boot-time logs or screenshots to diagnose a black screen issue during VM startup.
★ When this WOULD be the correct answer
When a VM is experiencing intermittent high CPU or memory usage that affects performance, and you need to be notified proactively to investigate before users report issues.
Why candidates choose this
Candidates may think any monitoring tool can help diagnose boot problems, but metric alerts are designed for performance thresholds, not boot diagnostics.
✗Network Watcher IP flow verifyWrong answer — click to see why▾
Why this is wrong here
Network Watcher IP flow verify checks connectivity and security rules for network traffic, not boot issues or OS startup logs. It cannot inspect what happened during VM boot.
★ When this WOULD be the correct answer
When a VM cannot connect to another resource (e.g., a database) and you need to verify if a network security rule is blocking traffic, IP flow verify would be the correct tool to use.
Why candidates choose this
Candidates may confuse network connectivity checks with boot diagnostics, thinking that boot problems are caused by network misconfigurations, or they may overestimate the scope of Network Watcher capabilities.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. After applying a custom image, a VM boots to a black screen with a blinking cursor. The OS never reaches the login prompt. The administrator needs the fastest way to inspect the boot process and view serial console output. What should be enabled or checked?
medium- A.Azure Monitor metrics for the VM
- ✓ B.Boot diagnostics
- C.Network watcher packet capture
- D.Azure Advisor recommendations
Why B: Boot diagnostics captures serial console output and screenshots of the VM during boot. When a VM boots to a black screen with a blinking cursor, the serial console log provides the exact kernel or bootloader messages (e.g., GRUB, initramfs errors) without requiring OS-level access. This is the fastest way to inspect the boot process because it works even when the OS is unresponsive.
Variation 2. After applying a custom image, a Linux VM stops at a black screen before the sign-in prompt. The administrator cannot use RDP or SSH and needs the fastest way to inspect the boot process. Which two actions should they take? Select two.
hard- ✓ A.Enable Boot diagnostics on the virtual machine.
- ✓ B.Review the screenshot and serial log in Boot diagnostics.
- C.Reimage the VM immediately to a clean managed disk.
- D.Increase the VM size to a larger SKU.
- E.Reset the network interface configuration from the portal.
Why A: Enabling Boot diagnostics on the virtual machine allows the administrator to capture serial console output and screenshots of the VM during boot. This is the fastest way to inspect the boot process without requiring network connectivity (RDP/SSH), as the serial log provides kernel-level messages and the screenshot shows the display state at the point of failure.
Variation 3. After applying a custom image, a VM restarts to a black screen and never reaches the sign-in prompt. The administrator wants the fastest way to inspect the boot process without connecting to the guest OS. What should be used?
easy- A.Azure Advisor
- ✓ B.Boot diagnostics
- C.Managed identity
- D.Azure Policy
Why B: Boot diagnostics captures serial console output and screenshots of the VM during the boot process, allowing you to inspect boot failures like a black screen without needing to connect to the guest OS. This is the fastest method because it provides immediate, out-of-band access to boot logs and visual state, even when the OS is unresponsive.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.