AZ-104 Deploy and Manage Azure Compute Practice Question
After a Windows VM is deployed, an administrator must install IIS, copy application files, and run a post-deployment configuration script without connecting interactively to the server. Which Azure feature should be used?
⚠ Common exam trap
It's easy for candidates to confuse the Custom Script Extension with other automation tools like Azure Automation or Desired State Configuration (DSC), but the question specifically requires a feature that runs a script post-deployment without interactive login, and CSE is the direct, lightweight solution for that task.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Custom Script Extension.
The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run scripts on an Azure VM after deployment without requiring interactive login. It is specifically designed for post-deployment configuration tasks like installing IIS, copying application files, and executing configuration scripts, all executed via the Azure VM agent.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Custom Script Extension.
Why this is correct
The Custom Script Extension (CSE) is a VM extension that executes scripts on the virtual machine immediately after provisioning or at any later time. It runs as SYSTEM (Windows) or root (Linux), enabling commands such as `Install-WindowsFeature Web-Server` or `apt install nginx` without requiring an interactive RDP/SSH session. CSE can be deployed via ARM templates, Azure CLI, PowerShell, or portal, and is the standard method for post-deployment software installation like IIS. It supports idempotency if the script is written to check for existing installations, and it can retrieve scripts from Azure Storage or GitHub.
- ✗
An availability zone assignment.
Why it's wrong here
An availability zone assignment places the VM in a specific physically separate datacenter within an Azure region to provide resilience against datacenter failures. This is purely a placement and redundancy decision that affects the VM's SLA and fault tolerance, but it has no capability to execute operating system commands or install software. IIS installation requires running a configuration script or command inside the guest OS, which zones cannot do. Zones only ensure that the VM is spread across failure domains, not that any software is installed.
When this WOULD be correct
When a question asks how to protect a VM from datacenter failures or ensure high availability, selecting an availability zone assignment would be correct. For example: 'You need to deploy a VM that remains available if one datacenter fails. Which feature should you use?'
- ✗
A route table association.
Why it's wrong here
A route table association is applied to a subnet and defines custom routes for network traffic, specifying next-hop types like virtual appliances, internet, or virtual networks. This controls how packets flow between resources, but it does not execute any code inside a VM or modify the guest OS state. Installing IIS would require local execution of a script or process, which is completely outside the scope of network-layer configuration. While route tables can facilitate connectivity to download installation files, they cannot perform the installation itself.
When this WOULD be correct
When a question asks how to force all outbound traffic from a subnet through a network virtual appliance (NVA) or firewall, associating a route table with a user-defined route (UDR) that points to the NVA is the correct answer.
- ✗
A user-assigned managed identity alone.
Why it's wrong here
A user-assigned managed identity gives the VM an Azure AD identity for authenticating to Azure services like Key Vault, Storage, or ARM without storing credentials. It is an identity plane feature, not a compute or configuration plane feature, so it cannot run scripts or install software on its own. To install IIS, you'd need a mechanism like Custom Script Extension, DSC, or a configuration management tool; the identity could be used by that mechanism to access protected resources, but the identity alone does nothing. Thus, it is a supporting component, not a standalone solution.
When this WOULD be correct
A user-assigned managed identity would be correct in a scenario where a VM needs to authenticate to Azure services (e.g., Azure Key Vault, Azure Storage) without storing credentials, and no script execution is required. For example, an application running on the VM needs to access secrets from Key Vault using the managed identity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Custom Script Extension.Correct answer▾
Why this is correct
The Custom Script Extension (CSE) is a VM extension that executes scripts on the virtual machine immediately after provisioning or at any later time. It runs as SYSTEM (Windows) or root (Linux), enabling commands such as `Install-WindowsFeature Web-Server` or `apt install nginx` without requiring an interactive RDP/SSH session. CSE can be deployed via ARM templates, Azure CLI, PowerShell, or portal, and is the standard method for post-deployment software installation like IIS. It supports idempotency if the script is written to check for existing installations, and it can retrieve scripts from Azure Storage or GitHub.
✗An availability zone assignment.Wrong answer — click to see why▾
Why this is wrong here
Availability zones are for high availability and fault tolerance by distributing resources across physically separate datacenters; they do not provide any mechanism to install software or run scripts on a VM.
★ When this WOULD be the correct answer
When a question asks how to protect a VM from datacenter failures or ensure high availability, selecting an availability zone assignment would be correct. For example: 'You need to deploy a VM that remains available if one datacenter fails. Which feature should you use?'
Why candidates choose this
Candidates may confuse availability zones with automation features because the term 'zone' sounds like a configuration step, leading them to think it can be used for post-deployment tasks.
✗A route table association.Wrong answer — click to see why▾
Why this is wrong here
A route table association controls network traffic routing between subnets and does not install software or run scripts on a VM.
★ When this WOULD be the correct answer
When a question asks how to force all outbound traffic from a subnet through a network virtual appliance (NVA) or firewall, associating a route table with a user-defined route (UDR) that points to the NVA is the correct answer.
Why candidates choose this
Candidates may confuse network configuration tasks (like routing) with post-deployment automation, thinking route tables can somehow trigger actions on VMs.
✗A user-assigned managed identity alone.Wrong answer — click to see why▾
Why this is wrong here
A user-assigned managed identity alone provides authentication to Azure resources but does not execute scripts or install software on a VM. The question requires running a post-deployment configuration script, which is beyond the capability of a managed identity.
★ When this WOULD be the correct answer
A user-assigned managed identity would be correct in a scenario where a VM needs to authenticate to Azure services (e.g., Azure Key Vault, Azure Storage) without storing credentials, and no script execution is required. For example, an application running on the VM needs to access secrets from Key Vault using the managed identity.
Why candidates choose this
Candidates may confuse managed identities with extensions that perform configuration tasks, or they might think that a managed identity can be used to run scripts via some other mechanism, overlooking that the Custom Script Extension is the direct solution for script execution.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. After a Windows VM is created, the administrator wants IIS installed and a configuration script run automatically without signing in to the server. Which Azure feature should be used?
easy- A.An availability set
- ✓ B.A virtual machine extension
- C.An Azure Policy assignment
- D.A network security group rule
Why B: A virtual machine extension (such as the Custom Script Extension for Windows) allows you to deploy and run scripts on an Azure VM after provisioning, without requiring any interactive sign-in. This is the correct Azure feature to automatically install IIS and execute a configuration script as part of the VM deployment or post-deployment automation.
Variation 2. Based on the exhibit, which Azure feature should the administrator use to install software and run the bootstrap script during VM provisioning?
medium- ✓ A.Azure VM Custom Script Extension
- B.A network security group rule allowing RDP from the Internet
- C.An availability set with two fault domains
- D.A managed disk snapshot restored as the operating system disk
Why A: The Azure VM Custom Script Extension (CSE) is the correct feature because it allows the administrator to execute scripts (such as installing software or running a bootstrap script) during VM provisioning or after the VM is running. The extension downloads the script from Azure Storage or a public URL and executes it using the local system account, making it ideal for post-deployment configuration tasks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.