Pass Your Microsoft AZ-104 Exam Easy!

Blob versioning can retain older object versions after modifications but does not by itself impose an immutable retention commitment on those versions. Privileged deletion or purge paths may remain available depending on account settings and lifecycle. The compliance officer needs an appropriate immutable retention or legal hold design in addition to versioning, with supported policy scope and authorized deletion governance. Versioning alone cannot satisfy the stated anti-purge objective.

The nearby action 'Restore the applicable previous blob version after identifying its timestamp' is associated with this separate need: a developer overwrote a blob yesterday and needs its old bytes. That is because Blob versioning tracks overwrite history distinctly from manually created blob snapshots. Here a compliance officer assumes blob versioning alone will prevent all deliberate deletions and purge activity, so 'Restore the applicable previous blob version after identifying its timestamp' misses the fact that versioning is history management, not a blanket immutability or authorization policy. 'Use suitable delete protection and retention policy in addition to versioning' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Recognize that soft-delete expiry may make recovery impossible without another backup' solves another task because retention policy is finite; do not promise restore of data past its expiry. For the situation where a compliance officer assumes blob versioning alone will prevent all deliberate deletions and purge activity, this distractor misses the requirement that versioning is history management, not a blanket immutability or authorization policy. Unlike 'Recognize that soft-delete expiry may make recovery impossible without another backup', 'Use suitable delete protection and retention policy in addition to versioning' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Hard-coding production inside the reusable Bicep removes the means to deploy the same unchanged file into eastus test. It also makes environment differences look like source-code changes rather than reviewed configuration. The question explicitly states that a location parameter already exists and both regions are approved. Preserve that parameter and pass different checked values from environment-specific parameter files instead of editing resource declarations.

Resource-group location is metadata for the group and can differ from locations of deployed resources. Assuming that location is automatically the intended service region for both test and production ignores the explicit eastus/westus targets. It also bypasses the existing parameter that controls regional resource placement. Bind that parameter to reviewed, region-specific values at deployment rather than silently inferring the desired region from group metadata.

Bicep deployment scope determines which Azure scope receives the deployment request; it is not a substitute for supplying a resource location. Changing scope does not reliably choose westus, and could require different permissions or resource declarations. Both environments use the same approved template and need different region values, so the proper boundary is input parameters, not the management hierarchy where the deployment is submitted.

Repeatedly changing the source template creates unnecessary code differences and risks leaving a production location in the next test deployment. It also contradicts the requirement to keep one unchanged approved main.bicep under version control. The design already exposes a location parameter; pipeline-specific .bicepparam inputs meet the task without mutable source rewrites. Reverts are not a reliable configuration contract for parallel deployments.

'Use a Bicep resource loop over validated subnet definitions' solves another task because loops generate multiple resources from a collection while retaining unique names and address prefixes. For the situation where a Bicep file declares `resource storage 'Microsoft.Storage/storageAccounts@...'` and uses a different actual account name, this distractor misses the requirement that Bicep symbolic identifiers connect expressions; actual Azure resource names are deployed values. Unlike 'Use a Bicep resource loop over validated subnet definitions', 'Reference the declared Bicep symbolic name for dependencies and the resource name for deployment identity' directly targets that requirement; its success must be confirmed at the authorized resource scope.

An explicit dependency can establish ordering for deployment operations, but it does not replace a resource identifier that still contains the wrong account name. In Bicep, the symbolic resource declaration identifies the deployed object and can supply the correct name or ID to dependent resources. Leaving the existing incorrect account-name expression means the referenced resource remains different from the account actually declared. This option might eliminate a timing error but cannot repair the identifier mismatch specified in the stem; inspect the emitted ID.

The nearby action 'Decompile or convert the template to Bicep and validate references and behavior' is associated with this separate need: a team wants Bicep syntax while retaining an existing JSON ARM deployment's dependencies. That is because syntax conversion can require manual correction; preserving semantics matters more than textual appearance. Here a Bicep file declares `resource storage 'Microsoft.Storage/storageAccounts@...'` and uses a different actual account name, so 'Decompile or convert the template to Bicep and validate references and behavior' misses the fact that Bicep symbolic identifiers connect expressions; actual Azure resource names are deployed values. 'Reference the declared Bicep symbolic name for dependencies and the resource name for deployment identity' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Hard-coding an unrelated production subnet ID would attach the NIC to the wrong network or fail if the other VNet is inaccessible, in a different region, or otherwise incompatible. It does not create or reference the subnet that this Bicep file is supposed to deploy. The correct model first declares the required subnet as a child of the intended new virtual network, with its supported address range. The NIC then references that declared subnet symbolically, giving Resource Manager both the actual target ID and an inferred dependency.

A subnet and NIC can only be deployed with compatible Azure region, resource ownership and target scope relationships. Introducing conflicting deployment locations or scopes is not an ordering solution: Resource Manager dependency evaluation does not authorize a NIC to attach to an invalid subnet. The question's two correct choices are to define a valid child subnet under the intended VNet and reference its symbolic ID in the NIC IP configuration. These choices express the relationship directly, allowing the deployment engine to determine order without an unnecessary manual dependsOn.

A missing or invalid subnet reference is a declarative infrastructure problem, not a reason to retry the same dependent NIC resource indefinitely. Without the correct subnet resource declaration, the network interface has no valid target to attach to; without a symbolic reference, its dependency may not be inferred as intended. Fix the Bicep model before redeployment: represent the subnet with its VNet parent and supported prefix, and use the subnet resource ID in NIC ipConfigurations. Validation and what-if should expose faulty scope or resource references early.

A subscription name is not a subnet resource identifier, and deploying the NIC first without a real subnet resource does not create a functioning network interface. Bicep deployments use declared resources, correct scopes and references, rather than guesses derived from names. In the stated new-VNet scenario, define the subnet under the new parent VNet, then point the NIC ipConfiguration at its declared symbolic resource ID. That reference supplies the necessary implicit deployment dependency; manual retries or fabricated subnet identifiers do not fix an invalid resource relationship.

A resource ID can sometimes be formed from known subscription, resource group, resource type and name parameters, but that method does not retrieve the dynamically allocated private IP that this earlier network deployment produced. The scenario explicitly states that the first deployment has completed and published the actual IP as an output. Constructing another resource identifier from guessed parameters cannot prove the assigned address, particularly if the NIC uses dynamic allocation or if the later deployment runs in a different scope. Read the named deployment output and pass the returned value into the later Bicep deployment's declared parameter instead of estimating it from resource names.

A Bicep resource reference or dependency can order resources declared within one deployment or refer to existing resources under supported scope rules. The question instead has two separate completed/dependent deployment stages and requires the *actual* dynamically allocated private IP from an earlier run. Merely declaring a NIC dependency inside the second template would not fetch the prior deployment's published output or transmit its assigned address. Use the pipeline's deployment-output read operation and provide that result as a strongly typed deployment parameter. This makes the data handoff explicit and testable, rather than assuming the syntax of a resource reference performs cross-run output retrieval.

An output that repeats an original subnet name is not a dynamically allocated NIC private IP. The consuming deployment needs the address that Azure actually assigned during the earlier network deployment; that value is available as a named result of that completed deployment. If the pipeline instead declares a new output that just echoes a configuration name, the later deployment can receive a syntactically valid but semantically wrong value. Fetch the existing output and pass it into the downstream parameter, then compare the resulting resource configuration with the actual network deployment value before declaring the integration successful.

The nearby action 'Reference the declared Bicep symbolic name for dependencies and the resource name for deployment identity' is associated with this separate need: a Bicep file declares `resource storage 'Microsoft.Storage/storageAccounts@...'` and uses a different actual account name. That is because Bicep symbolic identifiers connect expressions; actual Azure resource names are deployed values. Here a team deploys six subnet resources with similar settings but distinct prefixes, so 'Reference the declared Bicep symbolic name for dependencies and the resource name for deployment identity' misses the fact that loops generate multiple resources from a collection while retaining unique names and address prefixes. 'Use a Bicep resource loop over validated subnet definitions' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When an application team deploys a VNet and VMs into an existing resource group, the action 'Use a resource-group-scoped ARM/Bicep deployment' can be relevant: ordinary application resources are targeted to the group that will own their lifecycle. For the different problem of a team deploys six subnet resources with similar settings but distinct prefixes, 'Use a resource-group-scoped ARM/Bicep deployment' misses the mechanism that loops generate multiple resources from a collection while retaining unique names and address prefixes. Choosing 'Use a resource-group-scoped ARM/Bicep deployment' would address that other need, whereas 'Use a Bicep resource loop over validated subnet definitions' is intended to solve the stated condition.

'Pass region-specific values through deployment parameters rather than editing hard-coded resources' applies to a different feature boundary because parameters separate environment choices from reusable infrastructure definitions. In the stated scenario where a team deploys six subnet resources with similar settings but distinct prefixes, 'Pass region-specific values through deployment parameters rather than editing hard-coded resources' does not satisfy the mechanism that loops generate multiple resources from a collection while retaining unique names and address prefixes. The necessary action is 'Use a Bicep resource loop over validated subnet definitions', which should be checked against this Azure resource's actual permissions and state.

When a Bicep deployment moves from a test region to an approved production region, the action 'Pass region-specific values through deployment parameters rather than editing hard-coded resources' can be relevant: parameters separate environment choices from reusable infrastructure definitions. For the different problem of a template contains a subscription-specific absolute resource ID but must work in a second subscription, 'Pass region-specific values through deployment parameters rather than editing hard-coded resources' misses the mechanism that hard-coded subscription IDs can direct dependencies to the wrong tenant or fail when deployed elsewhere. Choosing 'Pass region-specific values through deployment parameters rather than editing hard-coded resources' would address that other need, whereas 'Derive the resource ID from parameters and target deployment scope' is intended to solve the stated condition.

'Declare and consume an appropriately typed deployment output' applies to a different feature boundary because outputs carry known values to later steps; guessing runtime IDs defeats reproducibility. In the stated scenario where a template contains a subscription-specific absolute resource ID but must work in a second subscription, 'Declare and consume an appropriately typed deployment output' does not satisfy the mechanism that hard-coded subscription IDs can direct dependencies to the wrong tenant or fail when deployed elsewhere. The necessary action is 'Derive the resource ID from parameters and target deployment scope', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use a subscription-level deployment for the subscription-scoped resources' is associated with this separate need: a deployment provisions a resource group and a subscription-level policy in the same administrative workflow. That is because creating governance at subscription scope differs from deploying an ordinary resource group child. Here a template contains a subscription-specific absolute resource ID but must work in a second subscription, so 'Use a subscription-level deployment for the subscription-scoped resources' misses the fact that hard-coded subscription IDs can direct dependencies to the wrong tenant or fail when deployed elsewhere. 'Derive the resource ID from parameters and target deployment scope' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When production needs a larger service SKU while keeping tags and network identity unchanged, the action 'Change only the supported SKU property or parameter and preview effects' can be relevant: a targeted template update avoids replacing unrelated resources accidentally. For the different problem of a template sets the region to one developer's location and blocks use elsewhere, 'Change only the supported SKU property or parameter and preview effects' misses the mechanism that location should be selected at deployment for region-specific resources instead of copied blindly. Choosing 'Change only the supported SKU property or parameter and preview effects' would address that other need, whereas 'Introduce a location parameter with approved defaults and validation' is intended to solve the stated condition.

Changing the resource-group target does not modify a fixed resource location embedded in a template. The problem is that a developer-specific region is hard-coded and prevents reuse. Introduce a validated Bicep location parameter and pass supported values for each deployment environment. Relying on the group target alone leaves the hard-coded resource definition unchanged, so deployments may still attempt to use the original region.

The nearby action 'Declare an output exposing the required resource property or identifier' is associated with this separate need: an automated validation script needs a created public IP value after deployment. That is because outputs provide verifiable deployment results instead of guessing naming patterns. Here a template sets the region to one developer's location and blocks use elsewhere, so 'Declare an output exposing the required resource property or identifier' misses the fact that location should be selected at deployment for region-specific resources instead of copied blindly. 'Introduce a location parameter with approved defaults and validation' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a developer wants to place a database password as an ordinary template default for convenience, the action 'Use secure parameter handling and a secret store without plaintext source defaults' can be relevant: secrets in template files or default parameter values can leak through source control and deployment history. For the different problem of a template sets the region to one developer's location and blocks use elsewhere, 'Use secure parameter handling and a secret store without plaintext source defaults' misses the mechanism that location should be selected at deployment for region-specific resources instead of copied blindly. Choosing 'Use secure parameter handling and a secret store without plaintext source defaults' would address that other need, whereas 'Introduce a location parameter with approved defaults and validation' is intended to solve the stated condition.

A hard-coded identifier from another subscription can point to a resource that does not exist in the target deployment, so it cannot reliably establish ordering or valid configuration for the web application. Resource Manager needs a valid reference to the intended resource and appropriate dependencies; Bicep symbolic references can generate implicit dependencies, while ARM JSON may require a deliberate dependsOn when ordering cannot be inferred. A stale ID may pass superficial string validation but lead to a broken or unauthorized reference at deployment. Repair the actual dependency and target resource identity instead.

'Declare an output exposing the required resource property or identifier' solves another task because outputs provide verifiable deployment results instead of guessing naming patterns. For the situation where an ARM deployment fails because a web app config references a resource not yet created, this distractor misses the requirement that resource creation order must respect actual dependencies; repeating deployment without fixing references is unreliable. Unlike 'Declare an output exposing the required resource property or identifier', 'Declare the correct dependency or valid resource ID reference in the template' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When one deployment needs the actual private address or resource ID created in an earlier deployment, the action 'Declare and consume an appropriately typed deployment output' can be relevant: outputs carry known values to later steps; guessing runtime IDs defeats reproducibility. For the different problem of an ARM deployment fails because a web app config references a resource not yet created, 'Declare and consume an appropriately typed deployment output' misses the mechanism that resource creation order must respect actual dependencies; repeating deployment without fixing references is unreliable. Choosing 'Declare and consume an appropriately typed deployment output' would address that other need, whereas 'Declare the correct dependency or valid resource ID reference in the template' is intended to solve the stated condition.

The nearby action 'Introduce a location parameter with approved defaults and validation' is associated with this separate need: a template sets the region to one developer's location and blocks use elsewhere. That is because location should be selected at deployment for region-specific resources instead of copied blindly. Here diagnostics infrastructure is optional in test but required in production, so 'Introduce a location parameter with approved defaults and validation' misses the fact that conditional deployments keep one source while creating only resources required by that environment. 'Use a guarded conditional resource controlled by an explicit parameter' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Change only the supported SKU property or parameter and preview effects' solves another task because a targeted template update avoids replacing unrelated resources accidentally. For the situation where diagnostics infrastructure is optional in test but required in production, this distractor misses the requirement that conditional deployments keep one source while creating only resources required by that environment. Unlike 'Change only the supported SKU property or parameter and preview effects', 'Use a guarded conditional resource controlled by an explicit parameter' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Pass region-specific values through deployment parameters rather than editing hard-coded resources' applies to a different feature boundary because parameters separate environment choices from reusable infrastructure definitions. In the stated scenario where diagnostics infrastructure is optional in test but required in production, 'Pass region-specific values through deployment parameters rather than editing hard-coded resources' does not satisfy the mechanism that conditional deployments keep one source while creating only resources required by that environment. The necessary action is 'Use a guarded conditional resource controlled by an explicit parameter', which should be checked against this Azure resource's actual permissions and state.

When a template sets the region to one developer's location and blocks use elsewhere, the action 'Introduce a location parameter with approved defaults and validation' can be relevant: location should be selected at deployment for region-specific resources instead of copied blindly. For the different problem of production needs a larger service SKU while keeping tags and network identity unchanged, 'Introduce a location parameter with approved defaults and validation' misses the mechanism that a targeted template update avoids replacing unrelated resources accidentally. Choosing 'Introduce a location parameter with approved defaults and validation' would address that other need, whereas 'Change only the supported SKU property or parameter and preview effects' is intended to solve the stated condition.

'Declare an output exposing the required resource property or identifier' applies to a different feature boundary because outputs provide verifiable deployment results instead of guessing naming patterns. In the stated scenario where production needs a larger service SKU while keeping tags and network identity unchanged, 'Declare an output exposing the required resource property or identifier' does not satisfy the mechanism that a targeted template update avoids replacing unrelated resources accidentally. The necessary action is 'Change only the supported SKU property or parameter and preview effects', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use a guarded conditional resource controlled by an explicit parameter' is associated with this separate need: diagnostics infrastructure is optional in test but required in production. That is because conditional deployments keep one source while creating only resources required by that environment. Here production needs a larger service SKU while keeping tags and network identity unchanged, so 'Use a guarded conditional resource controlled by an explicit parameter' misses the fact that a targeted template update avoids replacing unrelated resources accidentally. 'Change only the supported SKU property or parameter and preview effects' is the more defensible action; confirm its behavior in the target service before calling the task complete.