Microsoft AZ-104 Practice Test 66
Question 650
A load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected?
- Include required dependent resources and validate move restrictions before executing.
- Use an application health extension or load-balancer health probe with an appropriate endpoint.
- Ensure application state and load balancing support failover, not merely VM placement.
- Direct new connections to healthy backend instances rather than the failed VM.
Explanation
Correct Answer
D:Load balancer health probing can remove unhealthy backend targets. A single healthy VM may still be a capacity limitation. This matters here because a load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected.
Incorrect Answers
A:Azure resource moves have dependency and provider constraints. Omitting related network assets can invalidate the move. This matters here because a load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected.
B:Power-on state is not proof of application readiness. Health integration should observe the workload rather than only VM provisioning state. This matters here because a load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected.
C:Infrastructure placement increases availability but cannot automatically make a single-host stateful app stateless. Health routing and data continuity are separate needs. This matters here because a load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected.
Question 651
An infrastructure plan needs Windows Server licensing included in VM image pricing rather than custom bring-your-own-image licensing. What should be validated?
- Select an approved Windows Server marketplace image and review licensing or Azure Hybrid Benefit eligibility.
- Bastion connects through the VNet to the VM's private IP rather than requiring a VM public address.
- Inspect cloud-init configuration and logs for the guest image's custom-data processing.
- Enable application health reporting and automatic instance repairs for the VM scale set.
Explanation
Correct Answer
A:Windows Azure VM billing depends on image license and eligible Hybrid Benefit configurations. A Linux image's economics cannot be assumed identical.
Incorrect Answers
B:A VNet-hosted Bastion host brokers approved sessions to private VM addresses. A public IP on each guest is not necessary. This matters here because an infrastructure plan needs Windows Server licensing included in VM image pricing rather than custom….
C:Passing user data to a VM is not identical to executing it. A compatible image and initialization configuration are required. This matters here because an infrastructure plan needs Windows Server licensing included in VM image pricing rather than custom….
D:Health probes or extensions provide a signal for repair actions. Repair policy can restart, reimage or replace unhealthy instances. This matters here because an infrastructure plan needs Windows Server licensing included in VM image pricing rather than custom….
Question 652
A migrated Windows VM is configured for Azure Hybrid Benefit without eligible licenses. What should be corrected?
- Review encryption-at-host support and configuration separately from managed disk encryption.
- Review the organization's license entitlement before enabling Azure Hybrid Benefit.
- Include required dependent resources and validate move restrictions before executing.
- Install a supported VM extension such as Custom Script Extension for configuration.
Explanation
Correct Answer
B:Azure Hybrid Benefit requires qualifying licenses and compliance with benefit rules. Checking a box alone does not create an eligible entitlement.
Incorrect Answers
A:Managed disk server-side encryption and encryption at the host operate at different layers. Configuring one does not imply the other. This matters here because a migrated Windows VM is configured for Azure Hybrid Benefit without eligible licenses.
C:Azure resource moves have dependency and provider constraints. Omitting related network assets can invalidate the move. This matters here because a migrated Windows VM is configured for Azure Hybrid Benefit without eligible licenses.
D:VM extensions execute platform-managed post-deployment tasks through the guest agent. Automation is more repeatable than per-VM manual sessions. This matters here because a migrated Windows VM is configured for Azure Hybrid Benefit without eligible licenses.
Question 653
A VM is expected to execute a script during first boot using Azure custom data. What implementation detail matters?
- Configure exactly one boot OS disk per Azure VM and use data disks for extra volumes.
- Inspect the Azure VM Agent service health and the extension execution logs in the guest.
- Supply supported custom data and configure the guest initialization service to consume it.
- Use a supported VM extension or configuration-management mechanism with the required script.
Explanation
Correct Answer
C:VM custom data makes bootstrap content available, but whether scripts execute depends on the guest image and cloud-init or other handlers. This matters here because a VM is expected to execute a script during first boot using Azure custom data. What implementation detail matters.
Incorrect Answers
A:A VM boots from its OS disk. Additional persistent storage should be attached as data disks, not competing boot volumes.
B:Extension delivery depends on a functioning VM agent and compatible guest environment. A healthy VM network path does not prove extension readiness. This matters here because a VM is expected to execute a script during first boot using Azure custom data. What implementation detail matters.
D:Post-deployment automation is repeatable and can report success or failure. RDPing into each instance is operationally fragile. This matters here because a VM is expected to execute a script during first boot using Azure custom data. What implementation detail matters.
Question 654
Custom data is present but no Linux initialization command ran. What should be checked?
- Inspect the Azure VM Agent service health and the extension execution logs in the guest.
- Increase managed-disk capacity without checking the cloud-init service, user-data format or initialization logs.
- Choose an appropriate compute-optimized VM size that satisfies CPU and region capacity needs.
- Inspect cloud-init configuration and logs for the guest image's custom-data processing.
Explanation
Correct Answer
D:Passing user data to a VM is not identical to executing it. A compatible image and initialization configuration are required. This matters here because custom data is present but no Linux initialization command ran.
Incorrect Answers
A:Extension delivery depends on a functioning VM agent and compatible guest environment. A healthy VM network path does not prove extension readiness. This matters here because custom data is present but no Linux initialization command ran.
B:A custom-data initialization failure is not necessarily caused by disk size. Check cloud-init status, the distribution's supported data format and instance logs to find why commands did not run.
C:Azure VM families trade off CPU, memory, disk and price. A general-purpose or memory-optimized shape may cost more for the required CPU workload. This matters here because custom data is present but no Linux initialization command ran.
Question 655
A fleet needs coordinated image rollout without all VM instances rebooting simultaneously. Which scale-set setting is relevant?
- Use a suitable VM scale set upgrade policy with health-aware rollout controls.
- Enable application health reporting and automatic instance repairs for the VM scale set.
- Use manual instance upgrades while forcing all instances to restart simultaneously without health checks.
- Disable password authentication under approved access policy and limit SSH ingress through NSG or Bastion.
Explanation
Correct Answer
A:Scale-set upgrade policies determine how instance model changes are applied. Health gates and batch sizes reduce rollout risk. This matters here because a fleet needs coordinated image rollout without all VM instances rebooting simultaneously. Which scale-set setting….
Incorrect Answers
B:Health probes or extensions provide a signal for repair actions. Repair policy can restart, reimage or replace unhealthy instances. This matters here because a fleet needs coordinated image rollout without all VM instances rebooting simultaneously. Which scale-set setting….
C:An uncontrolled simultaneous restart can disrupt the entire fleet and does not provide a health-aware image rollout. Use a supported upgrade policy and health monitoring appropriate to the scale set.
D:Key authentication alone does not prohibit password guessing if the daemon still accepts passwords. Network exposure should also be narrowed. This matters here because a fleet needs coordinated image rollout without all VM instances rebooting simultaneously. Which scale-set setting….
Question 656
A manual-upgrade scale set's instances remain on the old model after configuration changes. Why?
- Verify image-version reference and scale-set upgrade policy before expecting rollout.
- Enable application health reporting and automatic instance repairs for the VM scale set.
- Apply the updated scale-set model explicitly to selected instances under the manual upgrade policy.
- Bastion connects through the VNet to the VM's private IP rather than requiring a VM public address.
Explanation
Correct Answer
C:Manual upgrade mode does not automatically update all existing instances. The model and instance state can diverge until updates are requested. This matters here because a manual-upgrade scale set's instances remain on the old model after configuration changes. Why.
Incorrect Answers
A:A pinned image reference remains on its specified version until intentionally updated. Publishing a newer gallery version does not rewrite running instances. This matters here because a manual-upgrade scale set's instances remain on the old model after configuration changes. Why.
B:Health probes or extensions provide a signal for repair actions. Repair policy can restart, reimage or replace unhealthy instances. This matters here because a manual-upgrade scale set's instances remain on the old model after configuration changes. Why.
D:A VNet-hosted Bastion host brokers approved sessions to private VM addresses. A public IP on each guest is not necessary. This matters here because a manual-upgrade scale set's instances remain on the old model after configuration changes. Why.
Question 657
A Container App needs a database credential that must not be embedded in its image. Which configuration is suitable?
- Validate the cron expression and time-zone interpretation of Container Apps job scheduling.
- Configure a Container Apps readiness probe to reflect application startup readiness.
- Store the connection value as a Container Apps secret and reference it from runtime configuration.
- Expose an internal HTTP endpoint but hard-code the database password into the container image.
Explanation
Correct Answer
C:Secrets avoid baking credentials into immutable image layers. Permissions, rotation and secret version handling still matter. This matters here because a Container App needs a database credential that must not be embedded in its image. Which configuration is suitable.
Incorrect Answers
A:Schedules are evaluated according to the service's documented clock semantics. A local-time assumption can shift an execution window. This matters here because a Container App needs a database credential that must not be embedded in its image. Which configuration is suitable.
B:Readiness indicates whether a replica should serve requests. Liveness targets failed processes that require restart. This matters here because a Container App needs a database credential that must not be embedded in its image. Which configuration is suitable.
D:Private ingress does not remove secrets baked into an image. Use a protected Container Apps secret and runtime secret reference.
Question 658
A credential was rotated in app secrets but existing replicas continue using the old environment value. What should be considered?
- Restart or deploy a revision that consumes the updated secret reference as required.
- Deploy a container group using Azure Container Instances.
- Use reviewed registry retention or purge policies with exclusions for deployed and rollback versions.
- Inspect active revision traffic weights and the app's revision mode.
Explanation
Correct Answer
A:Container environment variables can be initialized at replica startup. Updating a secret does not always refresh an already running process. This matters here because a credential was rotated in app secrets but existing replicas continue using the old environment value.
Incorrect Answers
B:ACI runs isolated container workloads without maintaining a cluster control plane. It is suitable for simple short-duration tasks. This matters here because a credential was rotated in app secrets but existing replicas continue using the old environment value.
C:Automated artifact cleanup must avoid removing references required by active deployments or disaster recovery. Blind tag deletion can cause pull failures. This matters here because a credential was rotated in app secrets but existing replicas continue using the old environment value.
D:Revision activation and ingress routing are distinct. A healthy revision can receive no traffic if its weight is zero. This matters here because a credential was rotated in app secrets but existing replicas continue using the old environment value.
Question 659
An HTTP container reports healthy process status but should not receive traffic before dependency initialization. Which probe is suitable?
- Configure a Container Apps readiness probe to reflect application startup readiness.
- Deploy a container group using Azure Container Instances.
- Configure HTTP ingress scaling on Azure Container Apps.
- Store the connection value as a Container Apps secret and reference it from runtime configuration.
Explanation
Correct Answer
A:Readiness indicates whether a replica should serve requests. Liveness targets failed processes that require restart. This matters here because an HTTP container reports healthy process status but should not receive traffic before dependency initialization.….
Incorrect Answers
B:ACI runs isolated container workloads without maintaining a cluster control plane. It is suitable for simple short-duration tasks. This matters here because an HTTP container reports healthy process status but should not receive traffic before dependency initialization.….
C:Container Apps supports HTTP concurrency-based scaling with managed replicas. VMSS CPU autoscale addresses a different hosting model. This matters here because an HTTP container reports healthy process status but should not receive traffic before dependency initialization.….
D:Secrets avoid baking credentials into immutable image layers. Permissions, rotation and secret version handling still matter. This matters here because an HTTP container reports healthy process status but should not receive traffic before dependency initialization.….
Question 660
A startup-heavy app is repeatedly restarted by an aggressive liveness check. Which probe design should be reviewed?
- Inspect the build principal's ACR write permissions and repository scope.
- Pin the deployed container to a verified immutable image digest.
- Tune startup and liveness probe timing to allow legitimate initialization.
- Understand that digest references remain bound to the previously specified image content.
Explanation
Correct Answer
C:Probe thresholds and initial delays must reflect realistic startup duration. An aggressive liveness check can kill replicas before they are ready.
Incorrect Answers
A:Read-only registry credentials cannot publish new manifests. Scope and role assignment must allow writes. This matters here because a startup-heavy app is repeatedly restarted by an aggressive liveness check. Which probe design should be reviewed.
B:Digests identify exact content independent of mutable tags. This reduces accidental deployment of an unreviewed artifact. This matters here because a startup-heavy app is repeatedly restarted by an aggressive liveness check. Which probe design should be reviewed.
D:A tag can move to another manifest while a digest identifies one immutable artifact. Update the deployment reference to roll out new bytes. This matters here because a startup-heavy app is repeatedly restarted by an aggressive liveness check. Which probe design should be reviewed.
