Microsoft AZ-104 Exam Dumps, Practice Test Questions

Read permission does not define a Task or register a repository update trigger.

A base-image update trigger rebuilds images on parent-image changes, not necessarily on commits to the application's repository. The task must be connected to a source-code update trigger for the stated commit-driven behavior.

A scheduled task can rebuild on its clock, but does not react when a Git commit occurs and can delay changes until the next scheduled run. The requirement is repository-change-driven invocation, so configure the ACR Task source trigger.

Local export may work but adds data movement, disk requirements and operational steps the question explicitly seeks to avoid.

Azure Container Registry geo-replication replicates one Premium registry across multiple regions; it does not import an image into an independent production registry. Use explicit ACR import with suitable permission and image references for cross-registry promotion.

A registry network setting controls reachability; it does not copy OCI layers or publish image manifests from another registry. ACR import performs the required image transfer while security settings can remain appropriately restricted.

Admin credentials often confer broad access and reduce individual attribution. They do not satisfy the requested repository-specific access boundary.

Management-plane Reader does not supply the required image pull data permission. Repository-scoped tokens/scope maps or another supported repository-level authorization model are needed.

AcrPull at registry scope can allow pulling images beyond the requested subset. Use repository-scoped authorization when the business must constrain which repositories the external consumer can pull.

A scheduled ACR Task is a time-triggered build/execution mechanism, not the registry's push-event notification to an external secured receiver. Use an ACR webhook subscribed to the appropriate push events to avoid polling.

Azure Container Registry exposes its own push-event integration; the registry's underlying storage objects are not a supported customer-managed BlobCreated event source for registry manifests. A blob-event subscription therefore cannot replace the documented ACR webhook trigger.

Public access is unnecessary and potentially unsafe. Registry push authentication and event notifications are separate features.

App Service deployment slots stage and swap versions of an existing web app. They are not a general container-execution service for an isolated one-off batch job.

A VM scale set supplies and manages sets of virtual machines. It would require substantial host administration for a task that only needs one container execution.

A VM can execute containers, but it requires host capacity, patching, and lifecycle administration for a one-off job. ACI avoids that unnecessary overhead.

OnFailure explicitly configures ACI to retry a process that exits with a nonzero status. That conflicts with the stated choice to leave job-level retry decisions to the external scheduler, even though OnFailure appropriately stops after a zero exit in a different scenario. The important distinction is the desired failure-retry behavior, not whether the container runs for a finite period.

Always is the default ACI policy, and a process exiting with code 0 still restarts. A finished import would be run again unnecessarily, risking duplicate processing. Exit-code success does not override the configured Always policy; a task-oriented restart policy must be chosen explicitly.

A liveness probe checks whether a running container is healthy; success of the probe does not disable the container group restartPolicy. If the process exits with code 0 while Always remains configured, ACI restarts it. This setting addresses monitoring during execution rather than the batch-job restart decision after completion.

A resource group is an ARM management container rather than a shared container runtime. Separate ACI groups have different network namespaces and lifecycles, so 127.0.0.1 on one group does not refer to a process in the other. Both containers must be defined in the same ACI group for the requested local sidecar relationship.

A shared subnet makes separately deployed ACI groups routable under the supported VNet model, but it does not give them a common loopback interface. Each group still has its own container networking boundary and can be created or deleted independently. The requirement is for shared localhost and lifecycle, not merely private IP reachability.

Sharing a persistent Azure Files volume between separate groups is about filesystem access, not loopback networking or a single shared deployment lifecycle. Mounting the same files does not make 127.0.0.1 refer to the other group's container. A true ACI sidecar should be a sibling container inside the same container group.

A template default committed to version control exposes the reusable credential and does not satisfy the confidentiality goal.

Command-line arguments may be visible through deployment configuration or diagnostic surfaces, moving rather than reducing credential exposure.

Ordinary environment variables may be visible in ACI configuration responses and are inappropriate for the sensitive value the team wants protected.

Always is the default and can restart a completed job, causing successful work to repeat indefinitely.

Never is not the retry-on-failure behavior being requested; platform nuances may exist for nonzero exits but it is not the explicit failure-restart policy.

An external recreation schedule may launch new groups but does not express the desired retry-on-failed-exit and stop-on-success semantics inside this container group.

Restart policy changes process lifecycle but does not preserve ephemeral container filesystem state when the group is deleted and recreated.

A separate share is durable, but the application still writes to its ephemeral filesystem until the persistent share is mounted at the intended output path.

Environment variables carry configuration values, not durable report files. They are not an external volume usable after container replacement.

The Failed container-group state signals an unsuccessful run or provisioning/runtime failure, not the ordinary successful end of a one-shot task. A process that exits with code 0 has met the job completion condition. Interpreting every Terminated container as a failed group would trigger unnecessary incident response and duplicate exports.

Running describes a container group currently operating. The Never restart policy is designed to allow a one-off workload to stop after a successful exit, so Azure does not keep an empty application process running forever merely because completion was successful. An operator should inspect exit code and the group state rather than infer work from the old resource existence.

Pending applies while a container group is waiting to initialize or complete launch prerequisites, not after a process has finished successfully with exit code 0. A finished Never-policy job can reach Succeeded. Treating completed work as an image-pull or scheduling wait misdirects troubleshooting and may cause the operator to start the workload twice.