AZ-104 Deploy and Manage Azure Compute Practice Question
After a Windows VM is created, the administrator wants IIS installed and a configuration script run automatically without signing in to the server. Which Azure feature should be used?
⚠ Common exam trap
Test-takers frequently confuse Azure Policy (which only audits or enforces configurations) with VM extensions (which actually perform software installation and script execution), leading them to select Azure Policy as the automation tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A virtual machine extension
A virtual machine extension (such as the Custom Script Extension for Windows) allows you to deploy and run scripts on an Azure VM after provisioning, without requiring any interactive sign-in. This is the correct Azure feature to automatically install IIS and execute a configuration script as part of the VM deployment or post-deployment automation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An availability set
Why it's wrong here
An availability set improves resilience by distributing VMs across fault and update domains. It does not install software or execute post-deployment scripts on the VM. It addresses placement and availability, not guest operating system customization.
When this WOULD be correct
When the question asks how to ensure a set of VMs remain available during planned or unplanned maintenance, such as 'You need to guarantee that at least one VM is available during updates. Which feature should you use?'
- ✓
A virtual machine extension
Why this is correct
A VM extension is designed to run additional configuration tasks on a VM after deployment. For example, the Custom Script Extension can install software, copy files, or execute scripts without an interactive logon. This directly matches the requirement to automate IIS installation and post-deployment configuration.
- ✗
An Azure Policy assignment
Why it's wrong here
Azure Policy can audit or deny certain resource properties, but it does not execute guest-level scripts on a VM. It is used for compliance enforcement and configuration governance, not for installing IIS or running operating system scripts after deployment.
When this WOULD be correct
An Azure Policy assignment would be correct if the question asked: 'Which Azure feature ensures that all VMs in a subscription are created only in approved regions?' or 'Which feature can automatically tag resources based on their department?'
- ✗
A network security group rule
Why it's wrong here
An NSG controls traffic flow to and from network interfaces or subnets. It cannot deploy software, modify the operating system, or run scripts on the VM. It is unrelated to application installation and configuration tasks.
When this WOULD be correct
When the question asks how to restrict or allow network traffic to a VM, such as blocking RDP access from the internet or allowing HTTP traffic to a web server, a network security group rule is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A virtual machine extensionCorrect answer▾
Why this is correct
A VM extension is designed to run additional configuration tasks on a VM after deployment. For example, the Custom Script Extension can install software, copy files, or execute scripts without an interactive logon. This directly matches the requirement to automate IIS installation and post-deployment configuration.
✗An availability setWrong answer — click to see why▾
Why this is wrong here
An availability set provides high availability for VMs by distributing them across fault and update domains, but it does not automate software installation or configuration after VM creation.
★ When this WOULD be the correct answer
When the question asks how to ensure a set of VMs remain available during planned or unplanned maintenance, such as 'You need to guarantee that at least one VM is available during updates. Which feature should you use?'
Why candidates choose this
Candidates may confuse availability sets with automation features, thinking they can run scripts or install software as part of the availability set configuration.
✗An Azure Policy assignmentWrong answer — click to see why▾
Why this is wrong here
Azure Policy assignments enforce compliance rules on resources, but they cannot install software or run scripts on a VM. They are used for governance, not post-deployment configuration.
★ When this WOULD be the correct answer
An Azure Policy assignment would be correct if the question asked: 'Which Azure feature ensures that all VMs in a subscription are created only in approved regions?' or 'Which feature can automatically tag resources based on their department?'
Why candidates choose this
Candidates may confuse Azure Policy with automation features, thinking it can enforce software installation or configuration scripts as part of compliance, but Policy only audits or denies resource creation/modification.
✗A network security group ruleWrong answer — click to see why▾
Why this is wrong here
A network security group rule controls inbound/outbound traffic to/from a VM, not the installation or configuration of software like IIS. It cannot run scripts or install applications.
★ When this WOULD be the correct answer
When the question asks how to restrict or allow network traffic to a VM, such as blocking RDP access from the internet or allowing HTTP traffic to a web server, a network security group rule is the correct answer.
Why candidates choose this
Candidates may confuse network-level security with post-deployment configuration, thinking that a rule could trigger script execution or software installation as part of traffic filtering.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.