Pass Your Microsoft AZ-104 Exam Easy!

'Treat a green what-if summary as a guarantee no application outage can occur' fails the stated scenario where a planned Bicep update will remove or replace several production resources because what-if describes resource changes but cannot certify runtime dependency behavior. The required multi-part resolution instead needs what-if previews intended resource differences; it is not proof that runtime behavior will be safe, which 'Treat a green what-if summary as a guarantee no application outage can occur' does not establish. Do not count 'Treat a green what-if summary as a guarantee no application outage can occur' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Use an old resource-group export without comparing it to current deployment state' fails the stated scenario where a planned Bicep update will remove or replace several production resources because a historical export can miss changes made since the snapshot. The required multi-part resolution instead needs what-if previews intended resource differences; it is not proof that runtime behavior will be safe, which 'Use an old resource-group export without comparing it to current deployment state' does not establish. Do not count 'Use an old resource-group export without comparing it to current deployment state' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Deploy immediately and use what-if only after production changes' fails the stated scenario where a planned Bicep update will remove or replace several production resources because a retrospective preview cannot prevent an unapproved destructive change. The required multi-part resolution instead needs what-if previews intended resource differences; it is not proof that runtime behavior will be safe, which 'Deploy immediately and use what-if only after production changes' does not establish. Do not count 'Deploy immediately and use what-if only after production changes' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Delete every resource mentioned in the preview to force clean deployment' fails the stated scenario where a planned Bicep update will remove or replace several production resources because that makes the suspected destructive scope broader rather than safer. The required multi-part resolution instead needs what-if previews intended resource differences; it is not proof that runtime behavior will be safe, which 'Delete every resource mentioned in the preview to force clean deployment' does not establish. Do not count 'Delete every resource mentioned in the preview to force clean deployment' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

Changing this Bicep deployment to resource-group scope changes the intended governance boundary: a policy assignment in rg-app would not necessarily govern resources in other resource groups in the subscription. The stem explicitly requires a subscription-root assignment and states that the subscription targetScope is valid. Contributor on a single resource group does not extend authority to the subscription root or create policy assignments there. Repairing the source scope would solve a different error, not the named Microsoft.Authorization/policyAssignments/write denial. Preserve the intended subscription deployment and obtain only the approved subscription-scope assignment action.

Examining deployment operations is useful diagnostics, and the question already supplies the decisive result: AuthorizationFailed for the subscription-level policyAssignments/write action. Retrying with the same identity and unchanged permissions will reproduce that denial rather than create a policy assignment. A deployment record itself was permitted, so neither syntactic validation nor inspecting output values supplies the missing authorization. Only an appropriately scoped role whose Actions include the provider’s policy-assignment write operation can enable the approved change. The pipeline should be revalidated after the authorized grant and any RBAC propagation interval.

Bicep compiles to Azure Resource Manager deployments, so switching to ARM JSON does not bypass Azure authorization. The Microsoft.Authorization resource provider checks the same principal and effective scope regardless of which supported template language produced the request. Here the code and targetScope are explicitly valid, while the denied operation is creating a subscription-level policy assignment. A template conversion might improve maintainability in another case, but it cannot substitute for a role that provides the required Microsoft.Authorization/policyAssignments/write action at the subscription.

'Use a resource-group-scoped ARM/Bicep deployment' solves another task because ordinary application resources are targeted to the group that will own their lifecycle. For the situation where a CI job reports that an ARM deployment was accepted, but operations cannot find the expected resource, this distractor misses the requirement that submission and successful resource provisioning are different outcomes; ARM history identifies failures. Unlike 'Use a resource-group-scoped ARM/Bicep deployment', 'Inspect deployment operation status, output values and actual resources' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Grant only the required deployment actions at the target scope' applies to a different feature boundary because template syntax cannot override RBAC; deployment operation rights must exist where resources are created. In the stated scenario where a CI job reports that an ARM deployment was accepted, but operations cannot find the expected resource, 'Grant only the required deployment actions at the target scope' does not satisfy the mechanism that submission and successful resource provisioning are different outcomes; ARM history identifies failures. The necessary action is 'Inspect deployment operation status, output values and actual resources', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Declare the correct dependency or valid resource ID reference in the template' is associated with this separate need: an ARM deployment fails because a web app config references a resource not yet created. That is because resource creation order must respect actual dependencies; repeating deployment without fixing references is unreliable. Here a CI job reports that an ARM deployment was accepted, but operations cannot find the expected resource, so 'Declare the correct dependency or valid resource ID reference in the template' misses the fact that submission and successful resource provisioning are different outcomes; ARM history identifies failures. 'Inspect deployment operation status, output values and actual resources' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When an application team deploys a VNet and VMs into an existing resource group, the action 'Use a resource-group-scoped ARM/Bicep deployment' can be relevant: ordinary application resources are targeted to the group that will own their lifecycle. For the different problem of a declarative template must update an existing VM configuration safely, 'Use a resource-group-scoped ARM/Bicep deployment' misses the mechanism that idempotent declarative update targets a stable resource ID; destructive changes still require review. Choosing 'Use a resource-group-scoped ARM/Bicep deployment' would address that other need, whereas 'Redeploy the existing resource definition at its intended identity after what-if review' is intended to solve the stated condition.

'Run ARM what-if and inspect the proposed change set' applies to a different feature boundary because what-if previews intended resource differences; it is not proof that runtime behavior will be safe. In the stated scenario where a declarative template must update an existing VM configuration safely, 'Run ARM what-if and inspect the proposed change set' does not satisfy the mechanism that idempotent declarative update targets a stable resource ID; destructive changes still require review. The necessary action is 'Redeploy the existing resource definition at its intended identity after what-if review', which should be checked against this Azure resource's actual permissions and state.

'Export an ARM template of the deployed resource configuration' solves another task because template export is a starting point for engineering review, not a complete guaranteed reconstruction. For the situation where a declarative template must update an existing VM configuration safely, this distractor misses the requirement that idempotent declarative update targets a stable resource ID; destructive changes still require review. Unlike 'Export an ARM template of the deployed resource configuration', 'Redeploy the existing resource definition at its intended identity after what-if review' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Exporting captures observed resources, including concrete environment-specific property values, but Resource Manager cannot automatically distinguish every old staging identifier from an intended production reference. An unchanged export may recreate dependencies on staging or fail at the target subscription. Replace fixed references with correctly scoped expressions and deployment parameters, and validate expected changes rather than treating a captured snapshot as inherently reusable production infrastructure.

A description update improves documentation but does not alter resource references or runtime service endpoints. The scenario identifies staging-only resource IDs and hostnames that are unsuitable for production. Those concrete values can route deployments or application traffic to the wrong subscription or environment. Review and parameterize environment-dependent values and derive valid target IDs where supported; a cosmetic metadata update cannot satisfy that requirement.

A second export may reproduce the same hard-coded staging resource IDs, property values and service endpoints. Matching exports show consistency of a source snapshot, not portability into a new subscription. Microsoft explicitly cautions that exports require review and may not be production-ready. An approved IaC baseline needs intentionally authored parameters and reference expressions, then a validated production what-if or equivalent plan.

Source control makes changes traceable but does not prove that an ARM export contains safe production values. Keeping stage-specific IDs and DNS hostnames under version control can still deploy incorrect dependencies into the new subscription. The requested transformation is technical: parameterize and derive the target environment references, and inspect a planned deployment. Repository history is a complementary governance control, not a replacement for converting hard-coded staging values.

The nearby action 'Redeploy the existing resource definition at its intended identity after what-if review' is associated with this separate need: a declarative template must update an existing VM configuration safely. That is because idempotent declarative update targets a stable resource ID; destructive changes still require review. Here a resource group is configured manually and needs a starting declarative description, so 'Redeploy the existing resource definition at its intended identity after what-if review' misses the fact that template export is a starting point for engineering review, not a complete guaranteed reconstruction. 'Export an ARM template of the deployed resource configuration' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When an exported ARM template contains environment-specific defaults and generated values, the action 'Review exported values and replace inappropriate fixed settings with parameters' can be relevant: export captures a snapshot, not automatically reusable, approved source of truth. For the different problem of a resource group is configured manually and needs a starting declarative description, 'Review exported values and replace inappropriate fixed settings with parameters' misses the mechanism that template export is a starting point for engineering review, not a complete guaranteed reconstruction. Choosing 'Review exported values and replace inappropriate fixed settings with parameters' would address that other need, whereas 'Export an ARM template of the deployed resource configuration' is intended to solve the stated condition.

'Treat export as observed infrastructure and review it before adopting as controlled IaC' applies to a different feature boundary because running resources can contain drift or generated defaults that should not become immutable source. In the stated scenario where a resource group is configured manually and needs a starting declarative description, 'Treat export as observed infrastructure and review it before adopting as controlled IaC' does not satisfy the mechanism that template export is a starting point for engineering review, not a complete guaranteed reconstruction. The necessary action is 'Export an ARM template of the deployed resource configuration', which should be checked against this Azure resource's actual permissions and state.

'Set the correct Bicep or ARM deployment scope and target resource scope' solves another task because policy/governance objects can require a higher scope than ordinary application resources. For the situation where a team wants Bicep syntax while retaining an existing JSON ARM deployment's dependencies, this distractor misses the requirement that syntax conversion can require manual correction; preserving semantics matters more than textual appearance. Unlike 'Set the correct Bicep or ARM deployment scope and target resource scope', 'Decompile or convert the template to Bicep and validate references and behavior' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a Bicep file declares `resource storage 'Microsoft.Storage/storageAccounts@...'` and uses a different actual account name, the action 'Reference the declared Bicep symbolic name for dependencies and the resource name for deployment identity' can be relevant: Bicep symbolic identifiers connect expressions; actual Azure resource names are deployed values. For the different problem of a team wants Bicep syntax while retaining an existing JSON ARM deployment's dependencies, 'Reference the declared Bicep symbolic name for dependencies and the resource name for deployment identity' misses the mechanism that syntax conversion can require manual correction; preserving semantics matters more than textual appearance. Choosing 'Reference the declared Bicep symbolic name for dependencies and the resource name for deployment identity' would address that other need, whereas 'Decompile or convert the template to Bicep and validate references and behavior' is intended to solve the stated condition.

The nearby action 'Declare the correct dependency or valid resource ID reference in the template' is associated with this separate need: an ARM deployment fails because a web app config references a resource not yet created. That is because resource creation order must respect actual dependencies; repeating deployment without fixing references is unreliable. Here a team wants Bicep syntax while retaining an existing JSON ARM deployment's dependencies, so 'Declare the correct dependency or valid resource ID reference in the template' misses the fact that syntax conversion can require manual correction; preserving semantics matters more than textual appearance. 'Decompile or convert the template to Bicep and validate references and behavior' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a resource group is configured manually and needs a starting declarative description, the action 'Export an ARM template of the deployed resource configuration' can be relevant: template export is a starting point for engineering review, not a complete guaranteed reconstruction. For the different problem of a colleague treats exported resource-group state as a vetted infrastructure-as-code repository, 'Export an ARM template of the deployed resource configuration' misses the mechanism that running resources can contain drift or generated defaults that should not become immutable source. Choosing 'Export an ARM template of the deployed resource configuration' would address that other need, whereas 'Treat export as observed infrastructure and review it before adopting as controlled IaC' is intended to solve the stated condition.

Exported ARM templates reflect a snapshot of deployed state; they are not automatically approved, portable, or safe infrastructure source. Hard-coded subscription or resource IDs and sensitive values can leak details or cause deployment against an unintended environment. Committing those exported values unchanged reverses the validation requirement in this question. Treat the export as an observed starting point, parameterize environment-specific settings, check provider API versions and resource dependencies, and review privileged or secret values before adopting a controlled infrastructure-as-code repository.

'Use a guarded conditional resource controlled by an explicit parameter' solves another task because conditional deployments keep one source while creating only resources required by that environment. For the situation where a colleague treats exported resource-group state as a vetted infrastructure-as-code repository, this distractor misses the requirement that running resources can contain drift or generated defaults that should not become immutable source. Unlike 'Use a guarded conditional resource controlled by an explicit parameter', 'Treat export as observed infrastructure and review it before adopting as controlled IaC' directly targets that requirement; its success must be confirmed at the authorized resource scope.

The nearby action 'Decompile or convert the template to Bicep and validate references and behavior' is associated with this separate need: a team wants Bicep syntax while retaining an existing JSON ARM deployment's dependencies. That is because syntax conversion can require manual correction; preserving semantics matters more than textual appearance. Here a converted template emits unsupported properties for the selected current API version, so 'Decompile or convert the template to Bicep and validate references and behavior' misses the fact that automated conversion cannot ensure every property remains valid across API versions. 'Review resource-provider API schema and revise unsupported fields before deployment' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Declare an output exposing the required resource property or identifier' solves another task because outputs provide verifiable deployment results instead of guessing naming patterns. For the situation where a converted template emits unsupported properties for the selected current API version, this distractor misses the requirement that automated conversion cannot ensure every property remains valid across API versions. Unlike 'Declare an output exposing the required resource property or identifier', 'Review resource-provider API schema and revise unsupported fields before deployment' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a resource group is configured manually and needs a starting declarative description, the action 'Export an ARM template of the deployed resource configuration' can be relevant: template export is a starting point for engineering review, not a complete guaranteed reconstruction. For the different problem of a converted template emits unsupported properties for the selected current API version, 'Export an ARM template of the deployed resource configuration' misses the mechanism that automated conversion cannot ensure every property remains valid across API versions. Choosing 'Export an ARM template of the deployed resource configuration' would address that other need, whereas 'Review resource-provider API schema and revise unsupported fields before deployment' is intended to solve the stated condition.

An image can be useful across deployments only subject to its supported version, distribution, licensing, replication and regional availability. A resource or image copied into another region does not automatically prove the Windows Server licensing terms, architecture or Trusted Launch compatibility required for this VM. The question is about choosing a bootable, licensed Secure Boot-capable image source, not moving a workload between regions. The design must choose an approved image and verify the actual supported Gen2/Trusted Launch and VM-size matrix rather than infer it from geographic copying.

Boot diagnostics are valuable when a VM has already failed during boot: they provide console or screenshot evidence that can narrow guest startup problems. Reading diagnostics from an unrelated VM does not establish that a candidate Windows Server image is licensed, Gen2-compatible or eligible for Trusted Launch and vTPM. Those are image-version and platform-support prerequisites to deployment. The team needs a vetted supported image source and a target security profile, then can use boot diagnostics only if the deployed candidate later fails. This answer reverses the intended selection workflow.

VM size compatibility is one necessary condition for Trusted Launch, but merely choosing a Generation 2 disk or VHD is not enough. The image must be supported and approved for that deployment and its licensing and security profile must be established. A local custom VHD might lack supported OS configuration or a suitable Trusted Launch path even when a size supports Secure Boot. This proposed criterion ignores two explicit requirements in the stem: the licensed image source and compatibility of that actual image with Trusted Launch. A properly vetted Marketplace or Gallery image and security setting covers them together.

A safe rolling VM scale-set upgrade is a valid tactic when replacing images for an existing set of instances, but this is initial selection for one new regulated Windows Server VM. Rolling an unvalidated image through a fleet would extend the risk rather than determine whether its licensing, generation, Trusted Launch and VM-size combination is acceptable. The appropriate order is to vet the source image and target support matrix, test a deployment, and only then consider controlled rollout to scale sets if required. This option performs deployment orchestration before the core image qualification.

Boot diagnostics can help analyze guest startup failures after a VM is created, including serial output and screenshots where supported. They cannot assign a NIC to the approved subnet or enforce ingress restrictions. This deployment has not reached the troubleshooting stage and no boot failure is described. Network placement must be declared in the VM NIC's VNet/subnet IP configuration, and traffic must be controlled through the applicable NSG rules and public-IP design. A diagnostic feature is observational, not a substitute for the actual network attachment and security configuration.

A managed identity gives software on a VM an identity for access to authorized Azure APIs without keeping a human password. It does not attach the VM to the application's subnet, set an IP address, prevent a public IP assignment, or configure NSG traffic controls. Azure RBAC applies to resource or data authorization rather than governing the flow of every TCP packet through the NIC. The specific requirement is private network placement plus inbound network filtering. A managed identity may be added for a separate application service need, but it does not fulfill either stated network deployment requirement.

Azure Bastion can broker secure RDP or SSH access to private VMs and may be useful after network placement is completed. However, it does not determine which subnet the application VM NIC joins and does not replace the NIC/subnet NSG associations that govern packet flow. Deploying Bastion alone while leaving the VM's own network attachment and rules unconfigured leaves the two explicit design requirements unsatisfied. For this item, first configure the private NIC and NSG rules; decide separately whether an administrative bastion is required. Do not confuse management-access infrastructure with the VM's required application network configuration.