100% Latest & Updated Microsoft AZ-104 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 410
A reviewer runs ARM what-if and sees only a harmless tag update. They conclude that a VM extension script can never alter data inside the guest during deployment. Which limitation should be highlighted?
- What-if fully executes VM extensions in a disposable environment and validates their application side effects
- What-if compares infrastructure resource changes but does not prove all guest-level script or runtime side effects
- Treat a successful template schema validation as proof of extension script safety
- Assume what-if checks application data inside VM disks because the template declares an extension
Explanation
Correct Answer
B:The what-if result is valuable for ARM configuration changes, yet guest execution and workload behavior require separate review or controlled testing. A small template diff is not a guarantee about scripts.
Incorrect Answers
A:What-if previews ARM resource changes rather than running guest code in a complete test VM. It cannot prove that arbitrary extension scripts are harmless.
C:Schema validation checks resource declaration shapes, not every guest action a script may perform. A deployment can have valid JSON and still run destructive guest commands.
D:What-if inspects ARM changes but cannot evaluate arbitrary workload files and database effects inside a running guest. The extension requires separate safety review.
Question 411
An infrastructure template runs at one resource group but must also configure a precreated resource group in the same subscription. The main deployment should remain at its current scope. Which Bicep technique can target the second group?
- Make the network security group a globally scoped resource by deleting its group ID
- Set all parameters to type any and assume Azure discovers the intended group
- Use a module with its scope set to the other resource group
- Rename the current resource group to the other group’s name
Explanation
Correct Answer
C:Bicep modules permit scoped deployments to eligible target groups while keeping the orchestrating entrypoint at its original deployment scope. This avoids migrating unrelated resources.
Incorrect Answers
A:Most Azure resources still require valid scope. Removing identifiers is not a deployment strategy for targeting an existing distinct resource group.
B:Loose typing does not choose a deployment target or authorize it. An explicit module scope supplies the necessary placement.
D:Renaming does not target a second group, and resource groups cannot be repurposed this way to deploy across scopes.
Question 412
An ARM template has already been parameterized for deployment across subscriptions, but its checked-in parameters file still contains an administrator password as plaintext. The deployment pipeline must supply the password without embedding it in source control or storing the value in deployment history. Which supported ARM-template parameter design should the team use?
- Declare a secureString password parameter and reference an authorized Key Vault secret from the deployment parameters file
- Set the plaintext password as defaultValue of a secureString parameter inside the checked-in template and assume the declared type makes the source text confidential
- Base64-encode the password in an ordinary string parameter in the checked-in parameters file and decode it in the deployment expression
- Emit the administrator password through a template output so the pipeline can retrieve it after deployment without using a secure parameter
Explanation
Correct Answer
A:A secureString parameter avoids recording the sensitive parameter value in deployment history. The parameters file can reference the Key Vault and secret name instead of embedding the password, provided the deployment has authorized Key Vault retrieval. Do not later expose the value through nonsecure tags or outputs.
Incorrect Answers
B:The secureString declaration protects values supplied to the deployment, but a literal defaultValue written into a source-controlled template remains readable in that source. Store the actual secret in a secure system rather than hard-coding it in a template default.
C:Base64 is reversible encoding, not secrecy. A plain string in a parameter file can be read by anyone with source access and can appear in deployment artifacts. Use a secureString parameter with an authorized secret reference instead.
D:Normal deployment outputs can expose sensitive information or create unnecessary secret propagation. Publishing a password as an output is not a substitute for secureString parameter handling and retrieval from Key Vault during deployment.
Question 413
An organization wants a centrally managed, explicitly versioned, reusable ARM template that deployment pipelines in multiple subscriptions can reference without keeping separate code copies in every repository. An existing version may be hotfixed or a new version published when needed. Which Azure Resource Manager feature is intended for that?
- Publish the same ARM JSON file in a Blob container with a version number in its filename and assume that establishes a managed Template Spec version
- Publish the ARM template as a Template Spec with an explicit version and access scope
- Keep the deployment template only in per-subscription ARM deployment history and treat each history entry as a globally reusable versioned Template Spec
- Copy the same JSON into every repository and rely on filenames for version control
Explanation
Correct Answer
B:Template Specs are Azure resources that store versioned deployment templates. A deployment can reference a controlled version, simplifying reuse and central access governance.
Incorrect Answers
A:A Blob naming convention can distribute a linked template but is not an Azure Resource Manager Template Spec with its own versioned ARM resource and access control. Publish the template as a Template Spec for that contract.
C:Deployment history records ARM operations at a specific deployment scope; it is not a centrally managed Template Spec resource with managed versions and Azure RBAC. Unlike a deployment-history record, an existing Template Spec version can be updated for a hotfix or a new version published.
D:Repeated independent copies can drift and do not provide one managed, versioned Azure template resource. The goal is centralized reuse.
Question 414
A subscription-scope deployment uses the name quarterly-platform and was first recorded with the deployment-history location eastus. A second deployment uses the same name but explicitly sets the history location to westus, producing InvalidDeploymentLocation. The resource declarations are otherwise valid. Which change addresses the deployment-history constraint?
- Use a different deployment name or the original eastus deployment location for that same name
- Set the target subscription's resource-group tags to westus and rerun the unchanged request
- Give every Bicep resource a new symbolic name but keep the same deployment name and location mismatch
- Run ARM what-if repeatedly until the control plane accepts the changed deployment location
Explanation
Correct Answer
A:Subscription deployments store deployment-history metadata in a chosen region. Azure does not permit one deployment name to be reused with a different history location. Keep the original location or choose a distinct deployment name; this does not require moving resources defined by the Bicep template.
Incorrect Answers
B:Resource-group tags are independent management metadata and do not change the deployment record's immutable location. The deployment is at subscription scope, so changing a group's label cannot resolve a conflict between the selected historical locations for the same deployment name.
C:Bicep symbolic names identify objects inside a template; they are not the subscription deployment-history record name. Changing the resource symbols while reusing the conflicting deployment name and location leaves InvalidDeploymentLocation unresolved.
D:What-if predicts resource changes without applying deployment modifications. Repeatedly previewing the same invalid name/location combination doesn't alter the immutable history location. The deployment request must be corrected before submission.
Question 415
An administrator wants to preview the effect of a Bicep file targeting subscription-level resources, including resource-group creation. They accidentally call the resource-group `what-if` command with a nonexistent resource group and get a scope error. Which validation command scope should match the template?
- Create an empty VM in a random group so the resource-group command will work
- Change every Bicep parameter name to `subscription`
- Run resource-group-scope what-if against a child resource group and assume it previews subscription-level Bicep resources
- Invoke what-if at subscription scope with the required deployment location and parameters
Explanation
Correct Answer
D:Deployment tooling distinguishes resource-group, subscription and management-group targets. A subscription-scoped Bicep file should be evaluated through the matching deployment command, not as if it targets a child resource group.
Incorrect Answers
A:A placeholder VM does not change the template's targetScope. It adds an unrelated resource while the deployment scope mismatch remains.
B:Parameter labels do not change the CLI command's deployment scope. The scope must be selected at invocation and match the file's declarations.
C:ARM what-if must be invoked at the same deployment scope as the template. A resource-group-scoped evaluation cannot faithfully preview subscription-scoped resource declarations and location/parameter behavior.
Question 416
An organization uses an exported ARM template that contains a managed identity reference from the source subscription. After deployment into the destination subscription, the new application cannot authenticate because the referenced identity does not exist there. Which template adaptation is necessary?
- Parameterize or create the appropriate managed identity in the destination and wire its actual resource ID
- Copy the original identity's display name into every new resource and expect authentication to work
- Disable managed identity on the destination app so it can fall back to anonymous storage writes
- Keep the source subscription's managed identity resource ID literal in the exported template and assume the destination tenant automatically maps it
Explanation
Correct Answer
A:Managed identities and their principals are scoped to specific Azure resources and tenants. An exported hard-coded source identity cannot be assumed to exist or authorize the new deployment.
Incorrect Answers
B:Display names do not recreate the service principal or grant RBAC. Authentication uses real resource and principal identifiers, not similar text labels.
C:Removing identity does not establish secure data authorization. The application would lose its intended credential mechanism rather than gain the required scope.
D:Managed identity resource IDs and associated principals are scoped to their actual Azure resources and identity authorities. Copying a source identifier does not create or authorize that identity in the destination; parameterize and provision/reference a valid destination identity.
Question 417
A company manages infrastructure through an Azure deployment stack and wants to prevent ordinary authorized operators from deleting stack-managed production resources while still allowing them to read and modify those resources. It does not want an unrestricted write-and-delete block. Which deny setting directly fits?
- Use denyWriteAndDelete for the stack so modifications and deletions are both blocked
- Set the deployment stack's deny setting mode to denyDelete for its managed resources
- Change the deployment from incremental to complete mode and assume complete mode creates a preventive denyDelete assignment
- Use ARM incremental mode alone and assume it enforces an Azure deny assignment on every resource
Explanation
Correct Answer
B:Deployment stacks can apply deny settings to explicitly managed control-plane resources. denyDelete prevents deletion while allowing authorized reads and writes, aligning with the requested safety boundary. Validate the stack's scope, excluded principals/actions and resource-type support before enabling it; it is not a data-plane permission mechanism.
Incorrect Answers
A:denyWriteAndDelete is intentionally broader: it restricts modifications as well as deletions of protected managed resources. The scenario explicitly allows approved configuration changes, so this setting would block legitimate work that a narrower deletion-only setting permits.
C:Deployment modes govern which declared resources are deployed or removed; they do not establish the deployment stack's deletion deny settings. Use denyDelete for managed resources when updates should remain possible.
D:Incremental deployment mode changes how absent resources are treated during a deployment, but it does not grant an ongoing deny-delete guard for resources managed outside that deployment. A stack deny setting is the requested persistent protective control.
Question 418
An administrator deploys a Linux Azure virtual machine through an automated build pipeline. The security policy forbids direct root password sign-in and requires key-based remote administration. Which sign-in configuration should be selected at VM creation?
- Use SSH public-key authentication for the specified administrator account
- Enable a shared root password and publish the secret in deployment output
- Disable password sign-in but create no SSH public key or other authorized administrator sign-in path
- Use a password-authenticated SSH account and change the SSH port number to conceal it
Explanation
Correct Answer
A:An administrator SSH key authenticates to the Linux VM without exposing a reusable password as the primary remote credential. It fits a secured automated deployment with controlled key ownership.
Incorrect Answers
B:A shared root password violates the prohibition and unnecessarily creates a secret that can leak through scripts or deployment logs.
C:Disabling a weak authentication method without establishing the required key leaves no defined administrator sign-in route. The VM must be deployed with a trusted SSH public key.
D:Moving SSH away from port 22 does not meet the prohibition on reusable passwords or create public-key authentication. The credential type remains wrong.
Question 419
A production Windows VM holds an attached data disk with application files. The team must redeploy the VM operating system because the OS disk is damaged but preserve the existing data disk contents. Which disk operation is most directly relevant?
- Detach and retain the data disk as a managed disk, then attach it to a compatible replacement VM
- Delete every managed disk together with the broken VM so storage is reclaimed
- Move the data into the current VM temporary disk immediately before VM deletion
- Recreate a blank VM with a new empty data disk and discard the existing managed disk attachment
Explanation
Correct Answer
A:An Azure managed data disk can be retained independently and attached to another compatible VM. Preserving the disk resource allows the replacement operating system to access the existing application data.
Incorrect Answers
B:Deleting disks destroys the data that the team explicitly wants to preserve. A safe replacement procedure must account for disk delete options.
C:Temporary VM disks are not persistent storage and are unsuitable as the only recovery copy. Data can be lost when a VM is deallocated or redeployed.
D:A new empty data disk does not contain application files from the damaged VM. The existing managed disk must be retained and reattached for that data to survive.
Question 420
A service running on an Azure VM needs to request a secret from Key Vault. The security team prohibits hard-coded service principal secrets in VM startup scripts and wants permissions tied to the VM identity. Which design is suitable?
- Embed a Key Vault administrator password directly into custom data
- Grant a Key Vault access policy to the VM resource's ARM ID without enabling any Microsoft Entra identity for the workload
- Assign the VM only the Azure resource group Reader role and assume secrets are returned
- Enable a managed identity on the VM and grant it the necessary Key Vault access
Explanation
Correct Answer
D:A VM managed identity receives Entra tokens without storing a long-lived application secret in the script. Scope the Key Vault data permission to the required secret operations.
Incorrect Answers
A:Custom data and scripts can be exposed to privileged operators. Hardcoding credentials violates the no-secrets requirement and broadens compromise impact.
B:Key Vault authorizes principal identities, not an unauthenticated VM ARM resource ID treated as a credential. The service needs a token-bearing identity. Enabling the VM's managed identity and granting that principal appropriate secret data permissions avoids long-lived client secrets.
C:Control-plane Reader does not authorize Key Vault secret data-plane retrieval. An appropriately privileged identity and vault access permission are still required.
Microsoft Azure Administrator (AZ-104) Practice Tests
