AZ-104 Deploy and Manage Azure Compute Practice Question
An administrator needs to deploy a VM quickly using the same hardened operating system image that was approved by the security team. What should the administrator use as the source for the new VM?
⚠ Common exam trap
Many candidates confuse a managed image with a snapshot or a VHD, but a managed image is the correct source for deploying a new VM with a specific OS configuration, while a snapshot is used for backup or disk cloning, not direct VM creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A managed image
A managed image captures a fully configured, hardened OS disk (including installed software and settings) as a reusable snapshot. When deploying a new VM, specifying this managed image as the source ensures the VM boots with the exact, security-approved OS configuration, meeting the requirement for a quick, consistent deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A managed image
Why this is correct
A managed image captures the OS disk configuration of a prepared VM and can be used as the source for creating new VMs. It is a common way to standardize deployments when the organization has an approved build with hardening already applied. This supports quick and consistent provisioning.
- ✗
A network interface
Why it's wrong here
A network interface provides network connectivity for a VM, but it does not contain the operating system image. It cannot serve as the source for creating a new VM from a hardened build. It is only one component of the VM configuration.
When this WOULD be correct
When deploying a VM from an existing VM's network configuration, such as when you need to clone a VM's network settings (e.g., private IP, subnet) to ensure identical network connectivity in a new VM.
- ✗
A resource lock
Why it's wrong here
A resource lock prevents deletion or changes to an existing resource, but it does not provide a deployable operating system image. It is a governance control, not a source for provisioning a new virtual machine.
When this WOULD be correct
A resource lock would be the correct answer if the question asked: 'What should an administrator use to prevent a critical VM from being accidentally deleted by team members?' In that scenario, applying a resource lock (e.g., CanNotDelete) is the appropriate solution.
- ✗
A public IP address
Why it's wrong here
A public IP address is an Azure networking resource that maps a routable IPv4 or IPv6 address to a VM's network interface for inbound and outbound connectivity. It contains no disk data, no guest operating system, and no configuration state such as security policies or hardening baselines. When deploying a new VM, the operating system is supplied by the OS disk or a managed image reference, while the public IP is simply attached afterward. Therefore, it cannot serve as the source or template for replicating a hardened OS build.
When this WOULD be correct
When deploying a VM that needs to be directly accessible from the internet, you would assign a public IP address to the VM's network interface. For example, a web server requiring inbound traffic from the internet would need a public IP address.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A managed imageCorrect answer▾
Why this is correct
A managed image captures the OS disk configuration of a prepared VM and can be used as the source for creating new VMs. It is a common way to standardize deployments when the organization has an approved build with hardening already applied. This supports quick and consistent provisioning.
✗A network interfaceWrong answer — click to see why▾
Why this is wrong here
A network interface is a virtual network adapter that provides connectivity, not a source for deploying a VM's operating system image. It cannot serve as a hardened OS image.
★ When this WOULD be the correct answer
When deploying a VM from an existing VM's network configuration, such as when you need to clone a VM's network settings (e.g., private IP, subnet) to ensure identical network connectivity in a new VM.
Why candidates choose this
Candidates may confuse the network interface with the VM's disk or image, thinking it contains the OS, or they may believe that attaching a network interface from an existing VM will replicate the entire VM.
✗A resource lockWrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of a resource, but it cannot serve as a source image for deploying a VM. The question requires a source for the VM's operating system, which a resource lock does not provide.
★ When this WOULD be the correct answer
A resource lock would be the correct answer if the question asked: 'What should an administrator use to prevent a critical VM from being accidentally deleted by team members?' In that scenario, applying a resource lock (e.g., CanNotDelete) is the appropriate solution.
Why candidates choose this
Candidates might confuse resource locks with general protection mechanisms and think they can be used to secure the deployment source, or they may misinterpret the question as asking for a way to protect the VM after deployment rather than the source for creation.
✗A public IP addressWrong answer — click to see why▾
Why this is wrong here
A public IP address is a network resource that provides internet connectivity to a VM, not an operating system image. It cannot be used as a source to deploy a VM with a specific hardened OS image.
★ When this WOULD be the correct answer
When deploying a VM that needs to be directly accessible from the internet, you would assign a public IP address to the VM's network interface. For example, a web server requiring inbound traffic from the internet would need a public IP address.
Why candidates choose this
Candidates may confuse the need for a public IP address with the source image, thinking that the IP address is part of the VM configuration that includes the OS, or they may misinterpret 'source' as the network endpoint for accessing the VM.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.