hardMultiple ChoiceObjective-mapped
AZ-400 Practice Question: Refer to the exhibit
Network Topology
Refer to the exhibit. An engineer tries to add a custom script extension to a VMSS but gets a ResourceNotFound error. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VMSS does not exist in the specified resource group.
When you add a Virtual Machine Scale Set extension via Azure Resource Manager, the request is essentially a PUT on a child resource whose path includes the VMSS as the parent. ARM resolves the parent resource before dispatching to the compute resource provider. If the parent cannot be found, the operation fails with ResourceNotFound because the request URI references a non-existent resource. This differs from runtime errors: once the extension resource is created, the VM agent applies it and downloads the script locally. Therefore, a script URL failure would never surface as a resource-not-found error; it would appear in the extension status as a provisioning failure or download error. Another common trap is mixing up the resource group or subscription in PowerShell/CLI—commands like New-AzResourceGroupDeployment or az vmss extension set must point to the correct subscription and group. Also worth noting: the ResourceNotFound code can also indicate an invalid resource type, not just a missing name, so double-check the resource provider namespace and type. Finally, in scenarios where the VMSS is behind Azure Policy or a delegating resource, ARM still requires the parent resource to exist in the specified group, so isolation and RBAC do not affect the lookup semantics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The script URL is inaccessible due to network restrictions.
Why it's wrong here
The ResourceNotFound error code indicates that the Azure Resource Manager (ARM) control plane could not locate the target virtual machine scale set (VMSS) before any extension logic ran. If the script URL were truly inaccessible, the failure would surface during the extension provisioning phase—after the VMSS was found—with errors such as VMExtensionProvisioningError, 'Failed to download script', or a timeout. Network restrictions to the script URL would not cause ARM to return a top-level ResourceNotFound for the VMSS resource itself.
- ✗
The CustomScript extension is not supported on this VMSS SKU.
Why it's wrong here
The CustomScript extension is supported on virtually all standard VMSS SKUs, including both Windows and Linux image families. Azure would return a validation error such as 'InvalidTemplateDeployment' or 'BadRequest' with a clear SKU-related message if the extension were incompatible, not a ResourceNotFound error. The ResourceNotFound code is generated during the ARM resource lookup for the VMSS parent resource, long before any SKU compatibility validation for the extension is performed.
- ✓
The VMSS does not exist in the specified resource group.
Why this is correct
The ResourceNotFound error is produced by the Azure Resource Manager control plane when the referenced VMSS resource cannot be found in the specified subscription and resource group. When deploying an extension via the ARM route /subscriptions/{subId}/resourceGroups/{rg}/providers/Microsoft.Compute/virtualMachineScaleSets/{vmssName}/extensions/{name}, ARM first resolves the parent VMSS resource by name and type. If the VMSS name is mistyped, the resource group is incorrect, or the VMSS has not been created, ARM immediately returns ResourceNotFound for the parent resource.
- ✗
The VMSS is in a different region than the resource group.
Why it's wrong here
The region attribute of a resource group is only a metadata setting and does not constrain the regions in which resources inside that group can be deployed. A VMSS can exist in a different Azure region than its resource group without any issue; ARM locates resources by subscription, resource group, name, and type, not by region. A region mismatch would never cause ResourceNotFound—at worst, it might produce a location-related validation error during an initial deployment, but not when trying to add an extension to an existing VMSS.
Go deeper
Related to this question
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.