AZ-104 Deploy and Manage Azure Compute Practice Question
You need to ensure that a virtual machine is protected by Azure Backup and can be restored from centralized backup data if the VM is deleted. Which Azure resource should you configure first?
⚠ Common exam trap
It's easy for candidates to confuse high-availability resources (like availability sets) with backup/recovery resources, failing to recognize that a Recovery Services vault is the prerequisite for any Azure Backup operation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Recovery Services vault
A Recovery Services vault is the foundational Azure resource for Azure Backup. It stores backup data and recovery points, enabling centralized backup management and restoration even if the original VM is deleted. Without first configuring a Recovery Services vault, you cannot define backup policies or initiate backups for the VM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Recovery Services vault
Why this is correct
A Recovery Services vault is the mandatory Azure resource that stores backup data and houses backup policies for Azure VM protection. When you enable Azure Backup, you must associate the VM with a vault; the service then orchestrates snapshot creation and retention settings defined by that vault's policy, without which no recovery point can be stored or restored.
- ✗
An availability set
Why it's wrong here
An availability set is a logical grouping that spreads virtual machines across fault domains and update domains to provide resiliency against hardware failures and planned maintenance downtime. It improves the service-level agreement availability of the VMs, but it does not generate, store, or manage any recovery points, so it cannot protect a VM's data or configuration from accidental deletion, corruption, or ransomware.
When this WOULD be correct
You need to ensure that your application remains available during planned or unplanned maintenance. Which Azure resource should you configure for two or more VMs running the same workload?
- ✗
A network security group
Why it's wrong here
A network security group is a filtering component that uses priority-based allow/deny rules to control inbound and outbound traffic to a VM's network interface or subnet. NSGs are purely traffic-centric and have no integration with the Azure Backup control plane; they neither snapshot the VM's disks nor interact with backup schedules or recovery point retention, so they offer zero data-recovery protection.
When this WOULD be correct
A question asking: 'You need to restrict inbound traffic to a virtual machine. Which Azure resource should you configure first?' would make an NSG the correct answer, as it is the primary tool for network traffic filtering.
- ✗
A public IP address
Why it's wrong here
A public IP address is used only for external internet-facing communication with the VM and is assigned to a NIC or a load balancer, if needed. Azure Backup operates entirely on the Azure storage fabric and control plane, using the VM's guest agent and backup extension; a VM with no public IP address can be fully backed up, because the backup service never relies on an internet-facing endpoint to capture snapshots or transfer data to the vault.
When this WOULD be correct
In a scenario where you need to ensure a VM can be accessed from the internet after a failover or migration, configuring a public IP address would be the correct first step. For example, when setting up a load-balanced web server with a public endpoint.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Recovery Services vaultCorrect answer▾
Why this is correct
A Recovery Services vault is the mandatory Azure resource that stores backup data and houses backup policies for Azure VM protection. When you enable Azure Backup, you must associate the VM with a vault; the service then orchestrates snapshot creation and retention settings defined by that vault's policy, without which no recovery point can be stored or restored.
✗An availability setWrong answer — click to see why▾
Why this is wrong here
An availability set is used to distribute VMs across fault and update domains for high availability, not for backup or restore operations. It does not provide centralized backup data or protect against VM deletion.
★ When this WOULD be the correct answer
You need to ensure that your application remains available during planned or unplanned maintenance. Which Azure resource should you configure for two or more VMs running the same workload?
Why candidates choose this
Candidates may confuse high availability with backup/disaster recovery, thinking that an availability set provides data protection or restore capabilities.
✗A network security groupWrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) filters traffic to and from Azure resources but does not provide backup or restore capabilities. It cannot protect VM data or enable centralized backup restoration.
★ When this WOULD be the correct answer
A question asking: 'You need to restrict inbound traffic to a virtual machine. Which Azure resource should you configure first?' would make an NSG the correct answer, as it is the primary tool for network traffic filtering.
Why candidates choose this
Candidates may confuse network security with data protection, thinking that securing network access is a prerequisite for backup, or they may misread the question as about protecting the VM from network threats rather than data loss.
✗A public IP addressWrong answer — click to see why▾
Why this is wrong here
A public IP address is a networking resource that provides internet connectivity to a VM, not a backup or recovery resource. It cannot store backup data or enable VM restoration after deletion.
★ When this WOULD be the correct answer
In a scenario where you need to ensure a VM can be accessed from the internet after a failover or migration, configuring a public IP address would be the correct first step. For example, when setting up a load-balanced web server with a public endpoint.
Why candidates choose this
Candidates may confuse the need for a public IP to access the backup service or think that a public IP is required for Azure Backup to function, but Azure Backup uses internal Azure infrastructure and does not require a public IP on the VM.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Azure Backup
Azure Backup is a cloud-based service from Microsoft that protects your data by creating and storing backups of files, folders, virtual machines, databases, and entire servers in the Azure cloud.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.