AZ-104 Deploy and Manage Azure Compute Practice Question
You deploy a Windows Server VM and need to run several PowerShell commands after deployment without signing in to the VM. Which Azure feature should you use?
⚠ Common exam trap
Many exam-takers confuse post-deployment script execution with other VM management features like availability zones or managed identities, which serve entirely different purposes (high availability and authentication, respectively).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Custom Script Extension on the VM.
The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run PowerShell or Bash scripts on a VM after deployment without requiring interactive sign-in. It executes the script via the Azure VM Agent, which runs as a local system process, making it ideal for post-deployment configuration tasks like installing software or running commands.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the Custom Script Extension on the VM.
Why this is correct
The Custom Script Extension downloads and executes PowerShell scripts on the Windows VM via the Azure VM Agent. It is specifically designed for post-deployment configuration tasks such as installing roles, configuring settings, or applying updates, without requiring an interactive RDP or PowerShell session. You can deploy it through the Azure portal, CLI, PowerShell, or Azure Resource Manager templates.
- ✗
Put the VM in an availability zone.
Why it's wrong here
Deploying a VM into an availability zone places it in a physically separate datacenter within a region, providing fault isolation and redundancy against rack or datacenter failures. However, this placement action only affects infrastructure resilience; it has no capability to start a script, install software, or perform any guest-OS configuration at deployment time.
When this WOULD be correct
When the question asks for a method to protect a VM from a regional outage by placing it in a physically separate zone within an Azure region, availability zones are the correct answer.
- ✗
Attach a managed identity and rely on Azure Policy.
Why it's wrong here
A managed identity grants the VM a secure Azure AD identity for authenticating to Azure resources like Key Vault or Storage without storing credentials. Azure Policy evaluates and enforces organizational rules (e.g., requiring specific tags or approved VM sizes) but it does not run arbitrary scripts inside a VM; both are governance and access-control mechanisms, not script execution engines.
When this WOULD be correct
When the question asks how to grant a VM permissions to access Azure resources (e.g., Key Vault, storage) without storing credentials, and the solution must use Azure AD authentication without manual key management.
- ✗
Create a snapshot before startup.
Why it's wrong here
Creating a snapshot captures the exact disk state of the VM, which you can later use to roll back changes or create new disks. While this is useful for backup and recovery workflows, snapshots are passive artifacts and do not trigger any process inside the running VM, so they cannot automate application setup or Windows configuration.
When this WOULD be correct
You need to preserve the VM's disk state before applying a critical update or configuration change, so you can revert if the update fails. The question would ask: 'Which feature should you use to create a point-in-time backup of a VM's disk?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use the Custom Script Extension on the VM.Correct answer▾
Why this is correct
The Custom Script Extension downloads and executes PowerShell scripts on the Windows VM via the Azure VM Agent. It is specifically designed for post-deployment configuration tasks such as installing roles, configuring settings, or applying updates, without requiring an interactive RDP or PowerShell session. You can deploy it through the Azure portal, CLI, PowerShell, or Azure Resource Manager templates.
✗Put the VM in an availability zone.Wrong answer — click to see why▾
Why this is wrong here
Availability zones provide high availability by protecting VMs from datacenter failures, but they do not execute PowerShell commands after deployment.
★ When this WOULD be the correct answer
When the question asks for a method to protect a VM from a regional outage by placing it in a physically separate zone within an Azure region, availability zones are the correct answer.
Why candidates choose this
Candidates may confuse availability zones with automation features, thinking that 'zones' imply some form of automated action or configuration.
✗Attach a managed identity and rely on Azure Policy.Wrong answer — click to see why▾
Why this is wrong here
Attaching a managed identity and relying on Azure Policy does not execute PowerShell commands on the VM; it assigns permissions and enforces compliance rules, not post-deployment scripts.
★ When this WOULD be the correct answer
When the question asks how to grant a VM permissions to access Azure resources (e.g., Key Vault, storage) without storing credentials, and the solution must use Azure AD authentication without manual key management.
Why candidates choose this
Candidates may confuse Azure Policy (which can deploy extensions via DeployIfNotExists) with direct script execution, or think managed identity can trigger scripts, but neither runs custom commands automatically.
✗Create a snapshot before startup.Wrong answer — click to see why▾
Why this is wrong here
Creating a snapshot before startup captures the disk state but does not execute any commands after deployment. Snapshots are for backup or recovery, not for running scripts.
★ When this WOULD be the correct answer
You need to preserve the VM's disk state before applying a critical update or configuration change, so you can revert if the update fails. The question would ask: 'Which feature should you use to create a point-in-time backup of a VM's disk?'
Why candidates choose this
Candidates may confuse snapshots with automation features, thinking a pre-boot snapshot can somehow trigger scripts, or they may overestimate the snapshot's capabilities.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.