AZ-104 Deploy and Manage Azure Compute Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  An NSG application security group.

  Why it's wrong here

  Application security groups within a network security group are a way to group VM NICs logically and then reference those groups in allow/deny rules, making security rules easier to maintain across distributed application tiers. However, an ASG is merely a metadata construct for the network security layer; it does not run processes, mount the guest file system, or provide a channel for command execution. For installing software, you need an in-guest automation mechanism, which ASGs do not offer.

  When this WOULD be correct

  When the question asks how to control inbound/outbound traffic to a group of VMs based on application workloads, an NSG application security group would be the correct answer.

• ✓

  A VM extension.

  Why this is correct

  A VM extension is the Azure resource-managed mechanism that delivers post-deployment configuration and automation tasks directly inside a Windows guest OS, such as running scripts via Custom Script Extension or applying Desired State Configuration. When you deploy Windows VMs and need to install software or make server-level changes, a VM extension is a supported, idempotent option that Azure tracks in the VM model. Unlike network constructs, extensions execute in the guest and are the correct answer.

• ✗

  A route table.

  Why it's wrong here

  A route table holds user-defined routes that change the next hop for subnet or NIC traffic—pointing it to a firewall, network virtual appliance, or to the internet—so it controls only Layer-3 path selection. The resource has no mechanism to execute guest OS commands; it lives in the Azure networking plane and is never surfaced inside Windows. As a result, route tables are irrelevant to installing software after VM deployment.

  When this WOULD be correct

  An exam question asks: 'You need to force all internet-bound traffic from a subnet to go through a network virtual appliance for inspection. What should you configure?' In that scenario, a route table with a user-defined route (UDR) pointing to the appliance would be correct.

• ✗

  A blob lifecycle rule.

  Why it's wrong here

  Blob lifecycle rules are Azure Storage policies that tier or delete blobs automatically based on age, last modification, or blob index tags, which is useful for cost optimization and retention. These rules are evaluated by storage service infrastructure and have no agent or connectivity into the VM's OS, so they cannot launch an installer or modify guest configuration. Consequently, they manage data files, not Windows VM workloads.

  When this WOULD be correct

  A question asks how to automatically move blobs to cool storage after 30 days or delete them after 90 days to optimize costs.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question