Microsoft AZ-104 Exam Dumps, Practice Test Questions

A scale-in policy establishes the scale set's general ordering for selecting removal candidates; it does not guarantee protection for a named instance. An instance's age relative to other members can change, so a Newest ordering cannot enforce the explicit temporary exclusion needed for export instance 7.

Protect from scale-set actions is an instance-level feature with broader effects on scale-set operations, not a single switch on the whole scale-set model. It could block legitimate scale-set initiated upgrades or reimages of the protected instance and is unnecessary for the narrower scale-in-only requirement.

Cooldown controls how quickly autoscale repeats scaling actions after a rule fires; it cannot express an exception for a particular instance. Eventually the scale set can still choose instance 7 if the workload contracts, because no instance-level removal protection was configured.

Replace destroys the unhealthy instance and creates a new instance from the current scale set model. The replacement does not preserve the old instance ID, private IP or managed OS and data disks, directly violating the state-retention requirement.

Reimage preserves the instance ID, private IP and managed data disk, but not the managed OS disk. The requirement expressly includes preserving the existing OS disk, so reimage is not safe for this workload.

Scale-in cooldown governs autoscale pacing, not the operation automatic repairs perform on an unhealthy instance. It neither changes the default Replace action nor guarantees preservation of the machine identity and disks during repair.

A fixed capacity may overprovision during quiet periods and would not validate the predictive algorithm against the changing time of the surge. Disabling standard metric rules also removes fallback protection against an unforeseen spike. This is an instance-capacity design issue, not a simple VM sizing constant.

Immediate forecast-driven scaling bypasses the requested validation period. Forecast-only mode permits comparison of projected and observed demand before applying automatic preemptive scale-out.

Standard reactive autoscale is a prerequisite and safety fallback for predictive autoscale. Removing it makes the proposed configuration invalid or removes protection from unexpected load spikes; retain it during forecast-only evaluation.

AcrPush includes push capabilities, which the runtime has no business need to possess. It expands the attack surface if the VM credential is compromised.

Subscription Owner would grant extensive Azure resource management and delegation authority. It is unnecessary to read an image and far broader than a registry-scoped role.

Virtual Machine Contributor manages VM resources but does not automatically authorize OCI image pulls from a protected registry. Registry-specific data permissions are still required.

Subscription Reader allows viewing Azure management-plane metadata, not reading OCI artifact content in an ABAC-enabled registry. A legacy AcrPull assignment is not recognized in this registry permissions mode, so adding a management role would leave the data-plane authorization gap untouched.

Anonymous pull would bypass per-identity repository authorization and potentially expose content beyond the intended payments workload. The goal is authenticated least-privilege access to one repository. Changing a repository to a public or unauthenticated access mode is neither necessary nor a safe substitute for the ABAC repository role.

Changing the scope of a legacy AcrPull role does not convert it into an ABAC-enabled repository role. Microsoft explicitly states that AcrPull and AcrPush are not honored in the ABAC-enabled mode. A wider ineffective assignment still cannot authorize the requested repository image data operation.

A deployment timestamp alone does not pin or identify the OCI image digest that the registry returned at deployment time. Because latest can be repointed, rollback should use a retained unique version tag or immutable digest reference.

A branch annotation describes build context but is not a unique, immutable reference to the exact container image bytes. Leaving deployment manifests tied to a mutable tag does not provide the requested reproducible rollback target.

Rebuilding a commit can yield different dependency or base-image bytes, and overwriting latest again conceals the image deployed previously. Preserve the deployed immutable digest or unique version tag instead of relying on reconstruction.

Image naming is relevant after an authenticated registry session; it cannot fix DNS that routes the client to an inaccessible endpoint.

AcrPush grants image write operations, but the existing pull attempt fails at network resolution rather than authorization.

Firewall public allow rules do not give clients a path when public registry access is disabled and they resolve to a public address.

A schedule could rebuild images periodically, but it does not directly react to base-image updates as requested and may miss intervening changes.

A notification alone does not rebuild dependent application images without further orchestration, unlike a configured base-image trigger.

Pulling newer tags on deployment does not rebuild the application image layers against a changed base image.

Moving the same high-privilege credential into app settings might reduce accidental display but preserves broad shared admin access and rotation risk across systems.

AcrPush allows write operations beyond pull requirements. It broadens registry modification risk rather than implementing least-privilege pull-only identity authorization.

A continuously shared admin credential remains available for misuse, bypassing workload-specific access traceability. The security goal is to eliminate routine reliance on it.

A separate registry has its own identity/endpoint, and the original hostname does not automatically replicate images to it. Eligible ACR geo-replication supplies regional replicas under one logical registry.

Premium capability can enable geo-replication, but upgrading a single-region registry without adding replicas does not place image content near Asia deployments.

Removing access controls would create image supply-chain exposure and would not provide regional data replication.

Read permission does not define a Task or register a repository update trigger.

A base-image update trigger rebuilds images on parent-image changes, not necessarily on commits to the application's repository. The task must be connected to a source-code update trigger for the stated commit-driven behavior.

A scheduled task can rebuild on its clock, but does not react when a Git commit occurs and can delay changes until the next scheduled run. The requirement is repository-change-driven invocation, so configure the ACR Task source trigger.