Microsoft AZ-104 Exam Dumps, Practice Test Questions

Outputs affect returned deployment values, not the creation of underlying resources. The diagnostic VM would still be provisioned and billed in test.

Parameters can customize names, but without conditional resource creation the VM still exists in both environments, violating the explicit no-VM test requirement.

Blocking connectivity does not remove VM compute charges. The stated requirement is to omit the optional resource, not merely hide its network access.

Outputs describe values produced by a deployment. They do not constrain the values accepted for an input parameter before resource creation.

A default provides a fallback but does not prohibit the caller from supplying an unapproved value. The required validation needs an explicit accepted set.

Description metadata helps operators understand expected values, but it does not enforce the permitted set when a pipeline supplies an unsupported string.

A default meets the minimum only when omitted. An explicitly supplied shorter identifier would remain valid unless a length constraint is declared.

The secure decorator helps prevent sensitive input exposure in deployment history but does not enforce string length. The security property and input constraint are separate.

MaxLength enforces an upper bound, so it would reject long identifiers rather than those shorter than twelve. The business requirement needs a minimum-length constraint.

minLength is for strings and arrays, not upper-bounding an integer. It cannot implement the count constraint as requested.

The secure decorator protects sensitive strings or objects from logging; it is not a maximum-value validator for an integer count.

A description documents intended usage but does not enforce a deployment-time upper-bound constraint on an integer parameter.

Securing the source password does not protect a second parameter that receives its value by interpolation. The derived connectionString parameter must also be marked @secure(), or the insecure transfer must be avoided, so deployment history does not expose the secret.

A linter rule can detect the insecure flow but does not change the parameter's protection or redact its deployment-history value. Mark the target secure or eliminate the insecure interpolation before deploying.

Protecting an output does not retroactively secure an input parameter recorded in deployment history. The receiving connectionString parameter itself requires confidential handling, regardless of output configuration.

A symbolic identifier is not a loop and cannot independently create an account for each item in a list.

The existing keyword references a separately provisioned resource. It does not iterate through a list to create the remaining accounts.

Dependency ordering cannot multiply one uniquely named Azure resource into several requested account instances.

Secure affects sensitive parameter disclosure, not the compiler's warning level for incorrect property names.

@secure() suppresses exposure of sensitive values; it does not promote unknown-property-name warnings into type-checking errors. @sealed() on the relevant user-defined object type raises possible property typos to an error.

Descriptions document intent but do not elevate likely misspelled user-defined object properties to compilation errors.

maxLength applies to strings and arrays, not the lower bound for a numeric instance count.

Secure decorates supported sensitive parameter types and does not impose a minimum number of instances.

A textual description documents the minimum but does not reject zero or one during Bicep parameter validation.

An access key is not the account resource ID or an endpoint reference. Introducing a secret also expands exposure without satisfying the property lookup.

A normal resource declaration participates in deployment. It is not a read-only reference and could produce unwanted changes or fail because of resource scope.

The default current-group scope would search rg-web for the account, not rg-data. The target can be reported missing despite existing elsewhere.

The `@batchSize(1)` decorator serializes resource loop deployment but does not change which array element is read inside each iteration. Leaving `subnetIds[0]` means all three NICs still point to the first subnet, just deployed sequentially.

`first(subnetIds)` is equivalent to selecting the first array entry, so it retains the broken constant subnet assignment for every NIC. The template needs the iteration index, not another spelling of the same first-element selection.

`dependsOn` can order resource provisioning, but it does not rewrite the subnet `id` expression. All NICs would still use `subnetIds[0]` after the virtual network is ready. Select the corresponding array element with the loop index instead.

The decorator controls the number of instances that may deploy in the same batch, not the total iteration count. A batch size of eight permits all eight requested resources to start together, preserving the provider collision risk. For a provider requiring serial operations, the appropriate batch size is one.

Unique resource names prevent name conflicts but do not change concurrent scheduling of operations that the provider serializes internally. The scenario explicitly says the provider rejects parallel operations for its logical service, so merely renaming the eight deployments leaves the temporal collision unresolved. Control loop concurrency rather than only resource identifiers.

Incremental and Complete deployment modes concern how resources not in a template are handled, not whether items inside a Bicep loop execute in sequence. Using Complete mode can create deletion risk for unspecified resources and is not a provider-concurrency control. The desired behavior comes from the loop batching decorator.