Microsoft AZ-104 Exam Dumps, Practice Test Questions

Custom data and scripts can be exposed to privileged operators. Hardcoding credentials violates the no-secrets requirement and broadens compromise impact.

Key Vault authorizes principal identities, not an unauthenticated VM ARM resource ID treated as a credential. The service needs a token-bearing identity. Enabling the VM's managed identity and granting that principal appropriate secret data permissions avoids long-lived client secrets.

Control-plane Reader does not authorize Key Vault secret data-plane retrieval. An appropriately privileged identity and vault access permission are still required.

Blob tiers are unrelated to guest initialization lifecycle. The existing VM has no reason to rerun cloud-init because of storage changes.

An Audit effect records compliance conditions; it does not invoke Linux guest bootstrap scripts on existing VMs.

Cloud-init can run provisioning actions such as package installation on supported images. The problem concerns repeated application to an already initialized VM.

Storing a script makes bytes available but does not execute them on the VM, so the remediation would not actually run.

RDP may permit interactive work but exposes a broad inbound attack surface that the case seeks to avoid given a working agent-based operation.

A VM extension can execute scripts but is a declarative lifecycle mechanism; Run Command is the direct targeted operational action for this short remedial script.

A network connectivity test can identify an RDP reachability failure but cannot display the guest recovery screen or boot console when the OS is stuck before login.

Resource Health can report platform-level availability, but it is not a substitute for a screenshot or console messages revealing the guest recovery state.

Azure instance-view state can show platform and guest-agent status but does not supply the graphical Windows boot screen the administrator needs. Boot diagnostics is designed to capture boot screenshots and serial output even when ordinary RDP cannot connect.

An ARM deployment can succeed while the guest script extension fails afterward. The extension instance view and execution logs are required to identify a command-resolution error.

Replacing an otherwise provisioned VM adds disruption and can reproduce the same extension failure if the command environment has not been fixed.

The VM resource deployment state does not expose the guest shell's command resolution. Read the Custom Script Extension instance view and execution logs and inspect the command/PATH rather than treating infrastructure provisioning as a script success test.

Disk encryption protects stored bytes but does not verify OS boot component signatures or produce the measured-boot attestation demanded by the scenario.

Bastion secures administrative connectivity but disabling Secure Boot removes one of the protections specifically requested.

Recommendations may flag missing controls but do not replace configuration of the VM boot-integrity mechanisms themselves.

Automatic platform orchestration focuses on Security and Critical patch classifications. Optional and other updates are not automatically included without a separate strategy.

The Windows OS-managed mode has different orchestration behavior and is not a promise that Azure AutomaticByPlatform installs optional classifications. It does not explain the stated selection.

Assessments report applicable patches but automatic platform installation remains focused on Critical and Security classes. Assessing more frequently does not broaden the install policy.

Scheduling changes do not make an image combination supported for automatic guest patching. Image eligibility is an independent prerequisite.

The scenario uses a Linux custom image; enabling a Windows component is inapplicable and would not bypass Microsoft’s supported platform-image requirement.

An appropriate guest agent is necessary for patching services, but it cannot make an unsupported custom publisher/offer/SKU combination eligible.

A gallery definition's region is not a substitute for replicating an image version to the target region. A VM deployment from that image needs supported image-version replication and availability in its destination region.

An image reference alone cannot compensate for missing or incomplete regional image replication needed for deployment in that location.

More copies in the primary do not satisfy placement of an image version replica in the distinct secondary deployment region.

Public settings are inspectable management-plane configuration. Renaming the field does not make its value protected.

Tags are broadly visible metadata, not secret storage. Putting a bearer token in tags would create accidental credential disclosure.

A resource name is visible, long-lived metadata and cannot safely hold authentication secrets. It does not implement extension secret handling.

DNS TXT records do not provide an out-of-band VM serial terminal or repair the boot path.

A public address changes packet reachability but cannot repair a guest that fails during startup. It also adds avoidable exposure.

Boot diagnostics is useful for seeing startup output or a screenshot, but it does not provide an interactive shell in which to repair a guest boot problem. Where supported, Azure Serial Console is the appropriate interactive console access mechanism.