AZ-104 Deploy and Manage Azure Compute Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Policy because it enforces the deployment automatically.

  Why it's wrong here

  Azure Policy is a governance service that enforces compliance rules (e.g., allowed regions, required tags) on resources at creation or during evaluation; it does not provision or define any resource itself. A policy definition only contains the rule and effect, with no capacity to describe virtual networks, compute, or storage configurations. It cannot replace an Infrastructure as Code template because it never produces a deployable artifact; instead, it complements deployment by auditing and restricting what can be created.

  When this WOULD be correct

  When the question asks for a mechanism to automatically enforce tagging or location restrictions across all subscriptions, ensuring resources comply with organizational standards without manual intervention.

• ✓

  Bicep because it provides a concise declarative syntax for Azure deployments.

  Why this is correct

  Bicep is the best choice because it is a declarative Azure language that is easier to read and maintain than raw ARM JSON. It works well in source control, supports code review, and is commonly used to define repeatable infrastructure deployments.

• ✗

  A runbook in Azure Automation because it is always easier to read than templates.

  Why it's wrong here

  Runbooks are procedural automation scripts (PowerShell or Python) executed by Azure Automation for operational tasks such as patching or incident response. They do not declare an end-state infrastructure topology, so they lack the idempotent reconciliation and built-in dependency validation that Bicep provides. For repeatable deployments, a runbook would require custom error handling and state management, making it less readable and maintainable than a declarative template.

  When this WOULD be correct

  When the question asks for automating a recurring operational task, such as starting/stopping VMs on a schedule or responding to alerts, and the solution must be scripted in PowerShell or Python.

• ✗

  A resource lock because it prevents unauthorized changes to the deployment.

  Why it's wrong here

  Resource locks are administrative safeguards applied to existing resources to prevent deletion or modification (using the ReadOnly or CanNotDelete scopes), but they contain zero information about how a resource should be configured or deployed. You cannot create a virtual machine or App Service by applying a lock; it only protects a resource that already exists. Locks are typically added to a deployed environment as a final guardrail, making them an operational control rather than a repeatable definition mechanism.

  When this WOULD be correct

  When the question asks for a mechanism to prevent accidental deletion or modification of critical Azure resources, such as production databases or key vaults, a resource lock (e.g., CanNotDelete or ReadOnly) would be the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”