AZ-104 Deploy and Manage Azure Compute Practice Question
Exhibit
Deployment notes: - Security team published a hardened image - The image has been validated for the organization - New VMs should start from that exact image - The administrator wants a straightforward image-based deployment
Based on the exhibit, the administrator needs to deploy a VM quickly using a preapproved hardened operating system image. Which source should be used when creating the VM?
⚠ Common exam trap
A common mix-up: candidates confuse a VM image source with networking or monitoring components, mistakenly thinking a public IP or NSG rule can serve as an image source, when in fact only a compute gallery or managed image provides the OS disk definition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An approved custom image in an Azure Compute Gallery.
An approved custom image in an Azure Compute Gallery (formerly Shared Image Gallery) is the correct source because it allows the administrator to deploy a VM quickly using a preapproved, hardened operating system image. The Azure Compute Gallery provides versioning, replication, and regional distribution of custom images, ensuring that the hardened OS is readily available for rapid deployment across multiple regions. This aligns with the requirement for a preapproved image that meets security and compliance standards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An approved custom image in an Azure Compute Gallery.
Why this is correct
A custom image in an Azure Compute Gallery lets the team standardize VM deployments on a hardened, approved operating system image. It is the right source when the same validated image should be reused consistently for new VMs. This supports repeatability and compliance across deployments.
- ✗
A temporary public IP address.
Why it's wrong here
A temporary public IP address is a network resource that is attached to a NIC only after the VM is provisioned; it provides outbound and inbound internet connectivity but contains no operating system files, boot sectors, or disk images. When you create a VM, Azure uses the selected image source (e.g., a gallery image or marketplace image) to build the OS disk, while a public IP is simply an optional IP configuration on the network interface. Since it carries no data or executable code, it cannot be used as the source for the VM's operating system, making this option incorrect.
When this WOULD be correct
When the question asks for a method to allow inbound RDP or SSH access to a VM during initial setup, a temporary public IP address assigned to the VM's NIC would be correct.
- ✗
A network security group rule.
Why it's wrong here
A network security group rule is a security filter that matches on source/destination IP, port, protocol, and direction to allow or deny traffic to a NIC or subnet. During VM creation, the NSG rule is applied to the network interface after the OS disk is created; it only governs traffic flow and has no relationship to the OS image or boot disk content. Because an NSG rule contains no disk, partition table, or operating system payload, it cannot serve as the image source for a VM, making it an unrelated configuration artifact in this scenario.
When this WOULD be correct
When a question asks how to restrict inbound traffic to a VM (e.g., allow only HTTPS from a specific IP), creating an NSG rule would be the correct answer.
- ✗
An Azure Monitor alert rule.
Why it's wrong here
An Azure Monitor alert rule is a conditional policy that watches Azure Monitor metrics or log queries and fires actions (such as email, SMS, or webhook) when thresholds are exceeded. It is designed to react to the VM's performance or health after deployment, not to define what operating system or boot image is used during creation. The alert rule resource is associated with the VM via a target resource ID, but it has no ability to provide a disk, VHD, or image reference to the VM deployment process, so it is categorically not a valid source for a new VM.
When this WOULD be correct
When the question asks for a method to automatically notify an administrator when a VM's CPU usage exceeds a threshold, an Azure Monitor alert rule would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An approved custom image in an Azure Compute Gallery.Correct answer▾
Why this is correct
A custom image in an Azure Compute Gallery lets the team standardize VM deployments on a hardened, approved operating system image. It is the right source when the same validated image should be reused consistently for new VMs. This supports repeatability and compliance across deployments.
✗A temporary public IP address.Wrong answer — click to see why▾
Why this is wrong here
A temporary public IP address is a networking resource, not a VM source image. It cannot provide an operating system image for VM deployment.
★ When this WOULD be the correct answer
When the question asks for a method to allow inbound RDP or SSH access to a VM during initial setup, a temporary public IP address assigned to the VM's NIC would be correct.
Why candidates choose this
Candidates may confuse the need for a quick deployment with the need for network connectivity, thinking a public IP is required to access the VM after creation.
✗A network security group rule.Wrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) rule controls inbound/outbound traffic to a VM, not the source image used to create the VM. The question asks for a source image, not a network configuration.
★ When this WOULD be the correct answer
When a question asks how to restrict inbound traffic to a VM (e.g., allow only HTTPS from a specific IP), creating an NSG rule would be the correct answer.
Why candidates choose this
Candidates may confuse the steps in VM creation, thinking that an NSG rule is needed to secure the VM from the start, but the question specifically asks for the source image, not security settings.
✗An Azure Monitor alert rule.Wrong answer — click to see why▾
Why this is wrong here
An Azure Monitor alert rule is used to monitor metrics or logs and trigger actions, not to provide a source image for VM creation.
★ When this WOULD be the correct answer
When the question asks for a method to automatically notify an administrator when a VM's CPU usage exceeds a threshold, an Azure Monitor alert rule would be the correct answer.
Why candidates choose this
Candidates may confuse monitoring and alerting components with deployment sources, thinking that an alert rule could be used to trigger a deployment from a hardened image.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Replication
Replication is the process of copying and synchronizing data across multiple servers or storage devices to ensure availability, reliability, and fault tolerance.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.