AZ-104 Deploy and Manage Azure Compute Practice Question
A team needs to deploy 25 identical Ubuntu VMs every month from source control. The deployment must be repeatable, and each VM must include a system-assigned managed identity at creation time. Which approach should be used?
⚠ Common exam trap
Candidates often confuse Azure Policy (which enforces compliance) with Azure Resource Manager templates (which deploy resources), leading candidates to select Policy thinking it can create VMs, when it only audits or remediates existing ones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Bicep template deployment.
A Bicep template is an Infrastructure as Code (IaC) solution that declaratively defines Azure resources, including VMs with system-assigned managed identities. It ensures repeatable, version-controlled deployments of 25 identical Ubuntu VMs every month, meeting the requirements for automation and identity assignment at creation time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure portal manual creation of each VM.
Why it's wrong here
Manually creating each VM in the Azure portal is inherently non-repeatable and error-prone because every click is a separate action that cannot be version-controlled or reviewed. With 25 identical VMs each month, the chance of inconsistency or configuration drift is high, and there is no audit trail linking the deployed resources to a source-controlled definition. Portal creation also cannot be automated or parameterized, so any change to the VM configuration must be repeated manually 25 times. This method does not meet the requirement of deploying from source control, making it unsuitable for a weekly or monthly repeatable process.
When this WOULD be correct
For a one-time deployment of a single VM where the administrator needs to visually configure settings and verify each step, manual portal creation is appropriate.
- ✓
A Bicep template deployment.
Why this is correct
A Bicep template is declarative infrastructure as code that can be stored in source control, versioned, and reviewed like application code. It uses a file with resource definitions, and with a simple loop (for i in range(25)) you can deploy 25 identical Ubuntu VMs with consistent identity settings, OS configuration, and networking in an idempotent way. Bicep modules and parameters also let you reuse the same template month after month, with changes tracked in Git history. Since Bicep deployments are deterministic and auditable, it is the correct approach for a recurring, code-driven VM deployment.
- ✗
An Azure Policy assignment at the subscription level.
Why it's wrong here
Azure Policy at the subscription level is a governance and compliance tool that can audit or enforce rules on resources, such as allowed VM sizes or locations, but it does not create resources from source control. While certain policy effects like DeployIfNotExists can trigger remediation tasks, these are designed to enforce compliance on non-compliant resources, not to provision a fleet of VMs on a schedule. A policy assignment cannot define the full VM identity, storage, or network settings required for a reproducible deployment, nor does it integrate with a version-controlled deployment workflow. Thus, it does not fulfill the requirement to deploy identical VMs each month from code.
When this WOULD be correct
An exam question requiring automatic enforcement of a system-assigned managed identity on all new VMs across a subscription, without manual template deployment, would make Azure Policy the correct answer.
- ✗
An Azure Monitor alert rule that triggers VM creation.
Why it's wrong here
Azure Monitor alert rules respond to telemetry conditions (for instance, metric thresholds or activity log events) by firing notifications or automatic actions, not by procuring infrastructure. While you could theoretically configure an alert action to invoke a runbook or webhook that creates VMs, that is an indirect and fragile mechanism fraught with latency, error handling, and state management issues. Alerts are not designed for scheduled, deterministic deployment from source control, and they offer no built-in support for Bicep templates or parameterized resource definitions. Relying on an alert rule for monthly VM creation would be a misuse of the service and would fail to provide a consistent, auditable infrastructure-as-code deployment path.
When this WOULD be correct
An Azure Monitor alert rule would be correct if the question asked for an automated response to scale out VMs when CPU usage exceeds a threshold, using a runbook or webhook to trigger VM creation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Bicep template deployment.Correct answer▾
Why this is correct
A Bicep template is declarative infrastructure as code that can be stored in source control, versioned, and reviewed like application code. It uses a file with resource definitions, and with a simple loop (for i in range(25)) you can deploy 25 identical Ubuntu VMs with consistent identity settings, OS configuration, and networking in an idempotent way. Bicep modules and parameters also let you reuse the same template month after month, with changes tracked in Git history. Since Bicep deployments are deterministic and auditable, it is the correct approach for a recurring, code-driven VM deployment.
✗Azure portal manual creation of each VM.Wrong answer — click to see why▾
Why this is wrong here
Manual creation via Azure portal is not repeatable and cannot efficiently deploy 25 identical VMs every month, nor does it inherently enforce system-assigned managed identity at scale.
★ When this WOULD be the correct answer
For a one-time deployment of a single VM where the administrator needs to visually configure settings and verify each step, manual portal creation is appropriate.
Why candidates choose this
Candidates may default to the portal due to familiarity, underestimating the need for automation and repeatability in monthly deployments.
✗An Azure Policy assignment at the subscription level.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy can enforce compliance (e.g., require managed identity) but cannot deploy 25 identical VMs from source control; it is not a deployment tool.
★ When this WOULD be the correct answer
An exam question requiring automatic enforcement of a system-assigned managed identity on all new VMs across a subscription, without manual template deployment, would make Azure Policy the correct answer.
Why candidates choose this
Candidates may confuse Azure Policy's compliance enforcement capabilities with actual resource deployment, thinking it can create VMs automatically.
✗An Azure Monitor alert rule that triggers VM creation.Wrong answer — click to see why▾
Why this is wrong here
Azure Monitor alert rules trigger actions based on metrics or logs, not for provisioning resources like VMs. They cannot deploy VMs with specific configurations like managed identities.
★ When this WOULD be the correct answer
An Azure Monitor alert rule would be correct if the question asked for an automated response to scale out VMs when CPU usage exceeds a threshold, using a runbook or webhook to trigger VM creation.
Why candidates choose this
Candidates may think alert rules can automate VM creation for scaling, but they are designed for monitoring and alerting, not direct resource deployment.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
System-assigned managed identity
A system-assigned managed identity is an automatically created Azure Active Directory identity that is tied to a specific Azure resource and is used to securely authenticate to other Azure services without storing credentials.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.