Pass Your Microsoft AZ-104 Exam Easy!

Placement across availability zones or fault domains protects against infrastructure failures and helps distribute scale-set instances. It does not determine whether a busy VM is safe to terminate during autoscale scale-in. Here the failures occur while long-running worker jobs are active, so changing placement alone leaves the application-level data-loss risk unchanged. Use workload-aware scale-in design, instance protection when required, and termination notifications with an application drain or checkpoint procedure. Then verify that a chosen scale-in target stops accepting jobs before the instance is actually removed.

Azure Virtual Machine Scale Sets already manage the pool of virtual machines and support autoscale rules. Choosing the same service again does not address the observed loss of in-progress jobs as instances are deleted. The missing controls are termination awareness and workload coordination: use scheduled-event termination notification where supported, a bounded delay to drain or checkpoint work, and scale-in policy or instance protection to avoid selecting critical workers. Application health probes can inform other orchestration features but do not independently guarantee that a busy job has finished before deletion.

Adding compute replicas is horizontal scale-out and can help a system process more jobs during peaks, whereas increasing a single VM disk is a storage-capacity change. Neither action fixes the current hazard: the scale set already scales down, and the jobs are interrupted before their state is safely completed. A correct response needs termination-notification handling and application-level draining or idempotent checkpoint/retry behavior, with suitable scale-in policy and protection. A scale-out decision might reduce queue depth temporarily but would not guarantee safe deletion when the subsequent scale-in occurs.

When a service requires hundreds of interchangeable web-processing VMs with common image and lifecycle, the action 'Use an Azure Virtual Machine Scale Set for managed fleets of uniform instances' can be relevant: scale sets orchestrate instance pools and scaling; individual VM handcrafting is harder to manage. For the different problem of a VMSS model changed, but existing instances still use an older configuration under manual upgrade policy, 'Use an Azure Virtual Machine Scale Set for managed fleets of uniform instances' misses the mechanism that updating the scale-set model doesn't force every instance to adopt changes immediately under all policies. Choosing 'Use an Azure Virtual Machine Scale Set for managed fleets of uniform instances' would address that other need, whereas 'Apply the configured instance upgrade/rolling policy to existing instances' is intended to solve the stated condition.

The nearby action 'Use health checks, workload draining and safe scale-in policies' is associated with this separate need: a scale set reduces instances aggressively and drops long-running jobs. That is because removing busy replicas without coordination can interrupt sessions and lose in-flight work. Here a VMSS model changed, but existing instances still use an older configuration under manual upgrade policy, so 'Use health checks, workload draining and safe scale-in policies' misses the fact that updating the scale-set model doesn't force every instance to adopt changes immediately under all policies. 'Apply the configured instance upgrade/rolling policy to existing instances' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Configure supported zone or fault-domain distribution for scale-set instances' solves another task because capacity planning should align placement and upgrade boundaries with the desired fault isolation. For the situation where a VMSS model changed, but existing instances still use an older configuration under manual upgrade policy, this distractor misses the requirement that updating the scale-set model doesn't force every instance to adopt changes immediately under all policies. Unlike 'Configure supported zone or fault-domain distribution for scale-set instances', 'Apply the configured instance upgrade/rolling policy to existing instances' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Keeping a record of the new scale-set model or staging a possible rollout is useful change management, but those preparatory activities do not modify running VM instances under a Manual upgrade policy. Azure VM Scale Sets explicitly require the administrator to select and upgrade existing instances, or deliberately change the supported upgrade policy and execute it. In this scenario, the old configuration persists precisely because the instances have not received a model upgrade. Verify instance model compliance after performing the authorized upgrade instead of treating a plan as applied.

'Apply the configured instance upgrade/rolling policy to existing instances' applies to a different feature boundary because updating the scale-set model doesn't force every instance to adopt changes immediately under all policies. In the stated scenario where a VM scale set must tolerate a host-level failure instead of all replicas sharing one fault group, 'Apply the configured instance upgrade/rolling policy to existing instances' does not satisfy the mechanism that capacity planning should align placement and upgrade boundaries with the desired fault isolation. The necessary action is 'Configure supported zone or fault-domain distribution for scale-set instances', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use health checks, workload draining and safe scale-in policies' is associated with this separate need: a scale set reduces instances aggressively and drops long-running jobs. That is because removing busy replicas without coordination can interrupt sessions and lose in-flight work. Here a VM scale set must tolerate a host-level failure instead of all replicas sharing one fault group, so 'Use health checks, workload draining and safe scale-in policies' misses the fact that capacity planning should align placement and upgrade boundaries with the desired fault isolation. 'Configure supported zone or fault-domain distribution for scale-set instances' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A probe detects backend availability but cannot prevent correlated loss when all virtual machine instances share the same fault isolation boundary. If that host or fault domain fails, all replicas can become unavailable together and there is no healthy instance for a probe to select. The scenario specifically requires resilience against a host-level failure, which depends on configuring supported instance distribution across separate fault domains or availability zones. Monitoring and traffic steering are complementary controls, not replacements for physical fault isolation.

Replacing all scale-set instances simultaneously without checking application health creates a correlated outage risk, especially because every replacement receives the same new operating-system image. An infrastructure deployment success does not guarantee that the service process will start, respond to its readiness checks or handle production requests. Test the image under realistic workloads, use a supported rolling or controlled upgrade policy, and preserve previous working image versions. A simultaneous forced replacement would defeat the stated desire for a safe path back if the new image fails.

Overwriting a mutable tag or pointing 'latest' at a new version without retaining the former version discards a reliable recovery reference. Azure Compute Gallery supports individually numbered image versions, allowing teams to identify the exact previously working version instead of guessing which image a label meant yesterday. Keeping the old image available does not, by itself, complete a rollback, but it provides the necessary artifact for a controlled return. Retain that artifact and separately choose a health-checked, supported rollout to avoid broad failures.

Disabling application-health collection can conceal an image rollout that provisions VMs successfully but fails the service readiness checks after boot. Scale-set rolling and automatic image-upgrade mechanisms use health signals to protect availability and make decisions about advancing or stopping upgrade batches where supported. Hiding unhealthy instances would make the upgrade less observable, not safer. Keep the health probe or Application Health extension configured, verify that it represents actual application behavior, and test the upgrade on a small cohort before proceeding to the rest of the scale set.

Publishing a new image to a registry or gallery is not the same as applying it to an existing Virtual Machine Scale Set. The scale-set model, its referenced image version and the supported upgrade policy govern when instances actually receive the new OS image. Simply uploading an image artifact does not update running instances or prove that their application started correctly. The team must deliberately initiate or configure the applicable model and instance upgrade, monitor health and retain a known-good version. A registry push alone also offers no tested rollback plan.

'Grant the runtime identity AcrPull access to the correct registry scope' solves another task because registry authentication to retrieve images differs from container app compute permissions. For the situation where a container service pulls approved application images from a company registry, this distractor misses the requirement that ACR holds OCI container images; repository access and pull authorization are separate concerns. Unlike 'Grant the runtime identity AcrPull access to the correct registry scope', 'Create Azure Container Registry with appropriate authentication and network controls' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Provide valid registry pull credentials or identity permissions for the image' applies to a different feature boundary because container group startup requires image authorization; increasing CPU won't fix a registry rejection. In the stated scenario where a container service pulls approved application images from a company registry, 'Provide valid registry pull credentials or identity permissions for the image' does not satisfy the mechanism that ACR holds OCI container images; repository access and pull authorization are separate concerns. The necessary action is 'Create Azure Container Registry with appropriate authentication and network controls', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Validate approved registry network path and runtime outbound reachability' is associated with this separate need: a registry is private and network restricted; a container service can authenticate but still cannot pull images. That is because ACR role assignment does not by itself open a blocked firewall or private endpoint path. Here a container service pulls approved application images from a company registry, so 'Validate approved registry network path and runtime outbound reachability' misses the fact that ACR holds OCI container images; repository access and pull authorization are separate concerns. 'Create Azure Container Registry with appropriate authentication and network controls' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Creating a new registry does not automatically issue the identities the data-plane permissions they need to publish or consume OCI images. In the stated case, an existing registry and its network path are functioning. The required distinction is between the CI service principal, which must upload release image manifests and layers, and the production identity, which only downloads them. Changing the registry itself would introduce additional resources without fixing the authorization assignments. In this RBAC-only permissions mode, the correct action is separate scoped publisher and reader rights, followed by a controlled push and pull verification.

Retaining a known-good image digest matters for rollback, especially before cleanup jobs delete old manifests or layers. However, image-retention policy does not grant a principal the permission to push an image or pull an authorized image from Azure Container Registry. Here the CI pipeline must publish, and the production managed identity must consume, under different access boundaries. Leaving their current roles unchanged does not answer that requirement. After assigning appropriate CI and runtime roles, retention remains a separate release-process control that can be verified with an image rollback exercise.

Registry networking can block image pushes or pulls even when a principal has a valid Azure role assignment. That is a different failure category, involving the firewall, approved private endpoint, name resolution and client egress. The question explicitly says the existing registry network route and both workload identities have already been verified. Repeating those connectivity checks does not supply the missing differentiation between publisher and consumer permissions. The CI service principal must have image-write authority, while the production identity must have pull-only authority. Verify this by attempting an authorized CI push and a permitted runtime pull.

AcrPull grants the production identity the needed image-read rights in a registry configured for the legacy RBAC Registry Permissions authorization mode. It does not grant the separate CI service principal permission to upload release images, so this single assignment leaves half of the stated deployment requirement unsatisfied. The scenario asks for a complete split between the CI publisher and the production consumer, not only a remedy for an isolated runtime ImagePullBackOff error. For an ABAC-enabled registry, even this role would be invalid; supported Container Registry Repository Reader/Writer permissions must be evaluated instead.

Azure Reader permits inspection of management-plane settings, not necessarily the image-manifest and layer downloads that authenticate a container runtime to Azure Container Registry. The failure is not inability to view the registry resource in ARM; diagnostics show that the managed identity lacks the registry data-plane pull role. Since the registry is explicitly in the legacy RBAC Registry Permissions mode, assign AcrPull to the identity at the proper registry scope. Reader alone does not confer those pull operations. For an ABAC-enabled registry the role choice would differ, but that is ruled out here.

The nearby action 'Validate approved registry network path and runtime outbound reachability' is associated with this separate need: a registry is private and network restricted; a container service can authenticate but still cannot pull images. That is because ACR role assignment does not by itself open a blocked firewall or private endpoint path. Here a deployment fails with ImagePullBackOff because its managed identity lacks registry pull permission, so 'Validate approved registry network path and runtime outbound reachability' misses the fact that registry authentication to retrieve images differs from container app compute permissions. 'Grant the runtime identity AcrPull access to the correct registry scope' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Create Azure Container Registry with appropriate authentication and network controls' solves another task because ACR holds OCI container images; repository access and pull authorization are separate concerns. For the situation where a deployment fails with ImagePullBackOff because its managed identity lacks registry pull permission, this distractor misses the requirement that registry authentication to retrieve images differs from container app compute permissions. Unlike 'Create Azure Container Registry with appropriate authentication and network controls', 'Grant the runtime identity AcrPull access to the correct registry scope' directly targets that requirement; its success must be confirmed at the authorized resource scope.

An Azure Container Registry provides repositories, image manifests and authentication controls, but simply creating the registry does not identify which of several image builds should run in production. Even a secured registry can contain a `latest` tag that later points to a different manifest after another push. The requirement is an exact, reproducible image selection months after the original release. Pin the deployment to the manifest's SHA-256 digest and ensure the referenced manifest remains retained. Registry network policies and repository authorization remain important, but they answer who can pull images rather than which content is pinned.

ACR pull authentication controls whether a container runtime or workload identity may download an authorized repository. Without the correct permissions, a perfectly pinned image can still fail to start, so the permission is an operational prerequisite. But a successful authorized pull by a mutable tag such as `latest` may still fetch a different manifest after someone republishes the tag. The situation asks how to bind a deployment to exactly the same image content despite tag movement, not how to fix a 401 Unauthorized registry error. Use the manifest digest as the deployment reference, with least-privilege pull rights handled separately.

Secrets and managed-identity references are appropriate for authenticating Azure Container Apps or other workloads to their configured services. They avoid embedding credentials in image layers or source repositories, but they do not constrain which ACR manifest a tag resolves to. An application could have perfect secret hygiene and still be redeployed with a different build because `latest` was repointed. The reproducible-content requirement needs an immutable digest reference. Identity and secret controls should accompany the deployment, not be mistaken for the artifact-identity mechanism that pins a particular set of image layers.

Retaining old registry manifests is necessary for rollback availability: a digest cannot be pulled if the registry policy already purged its image. However, retention alone does not specify the manifest that the deployment should choose. If the deployment points to a mutable tag, it may select the new build even while the old manifest remains stored. Pin the manifest digest at deployment time and protect that artifact from unintended cleanup through appropriate lifecycle policies. The first action establishes exact content identity; retention is a separate condition for whether that identity remains retrievable later.

'Create Azure Container Registry with appropriate authentication and network controls' solves another task because ACR holds OCI container images; repository access and pull authorization are separate concerns. For the situation where a registry is private and network restricted; a container service can authenticate but still cannot pull images, this distractor misses the requirement that ACR role assignment does not by itself open a blocked firewall or private endpoint path. Unlike 'Create Azure Container Registry with appropriate authentication and network controls', 'Validate approved registry network path and runtime outbound reachability' directly targets that requirement; its success must be confirmed at the authorized resource scope.

AcrPull is needed for image reading under the compatible Azure Container Registry permission model, but the scenario states the workload identity already has that permission. A TCP timeout and registry DNS resolving to an unreachable public address indicate a path or name-resolution problem before successful image transfer. Repeating the same role cannot create private endpoint routing, a valid private DNS zone link or approved egress to the registry endpoints. Verify the actual endpoint resolution and network path, using ACR health diagnostics where supported, before changing permissions.

The nearby action 'Assign push/write authority to CI and pull-only authority to production identities' is associated with this separate need: a CI publisher must push images, while production containers only pull. That is because acrPush and AcrPull capabilities are distinct; runtime does not need publication privileges. Here a registry is private and network restricted; a container service can authenticate but still cannot pull images, so 'Assign push/write authority to CI and pull-only authority to production identities' misses the fact that ACR role assignment does not by itself open a blocked firewall or private endpoint path. 'Validate approved registry network path and runtime outbound reachability' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a production deployment should be reproducible even if the `latest` tag is repointed, the action 'Deploy using an immutable image digest or controlled version tag' can be relevant: a mutable tag can resolve to different image content over time, obscuring rollback identity. For the different problem of a cleanup task deletes old container images while the rollback plan still references them, 'Deploy using an immutable image digest or controlled version tag' misses the mechanism that removing a referenced digest can prevent redeployment of a known-good build. Choosing 'Deploy using an immutable image digest or controlled version tag' would address that other need, whereas 'Retain image versions needed for tested rollback before applying registry cleanup' is intended to solve the stated condition.

'Create Azure Container Registry with appropriate authentication and network controls' applies to a different feature boundary because ACR holds OCI container images; repository access and pull authorization are separate concerns. In the stated scenario where a cleanup task deletes old container images while the rollback plan still references them, 'Create Azure Container Registry with appropriate authentication and network controls' does not satisfy the mechanism that removing a referenced digest can prevent redeployment of a known-good build. The necessary action is 'Retain image versions needed for tested rollback before applying registry cleanup', which should be checked against this Azure resource's actual permissions and state.

'Grant the runtime identity AcrPull access to the correct registry scope' solves another task because registry authentication to retrieve images differs from container app compute permissions. For the situation where a cleanup task deletes old container images while the rollback plan still references them, this distractor misses the requirement that removing a referenced digest can prevent redeployment of a known-good build. Unlike 'Grant the runtime identity AcrPull access to the correct registry scope', 'Retain image versions needed for tested rollback before applying registry cleanup' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Inspect container termination status, logs and expected output artifacts' applies to a different feature boundary because scheduling a container is not evidence its batch logic completed or wrote the intended result. In the stated scenario where a nightly batch job processes one file, then exits; the team wants no long-lived app hosting platform, 'Inspect container termination status, logs and expected output artifacts' does not satisfy the mechanism that ACI provisions a container group directly without requiring full managed microservice revision features. The necessary action is 'Run the isolated task in Azure Container Instances where appropriate', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Evaluate Container Apps replica scaling versus fixed ACI group sizing' is associated with this separate need: a team proposes a single large ACI container for intermittent unpredictable HTTP demand rather than using managed autoscaling. That is because ACI sizes a container group; Container Apps can add replicas based on configured triggers. Here a nightly batch job processes one file, then exits; the team wants no long-lived app hosting platform, so 'Evaluate Container Apps replica scaling versus fixed ACI group sizing' misses the fact that ACI provisions a container group directly without requiring full managed microservice revision features. 'Run the isolated task in Azure Container Instances where appropriate' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When an ACI container group repeatedly fails to start with unauthorized image errors, the action 'Provide valid registry pull credentials or identity permissions for the image' can be relevant: container group startup requires image authorization; increasing CPU won't fix a registry rejection. For the different problem of a nightly batch job processes one file, then exits; the team wants no long-lived app hosting platform, 'Provide valid registry pull credentials or identity permissions for the image' misses the mechanism that ACI provisions a container group directly without requiring full managed microservice revision features. Choosing 'Provide valid registry pull credentials or identity permissions for the image' would address that other need, whereas 'Run the isolated task in Azure Container Instances where appropriate' is intended to solve the stated condition.

'Restrict ingress and expose only required ports through approved network configuration' applies to a different feature boundary because container group endpoint design should not publish unrelated debugging services. In the stated scenario where a nightly batch job processes one file, then exits; the team wants no long-lived app hosting platform, 'Restrict ingress and expose only required ports through approved network configuration' does not satisfy the mechanism that ACI provisions a container group directly without requiring full managed microservice revision features. The necessary action is 'Run the isolated task in Azure Container Instances where appropriate', which should be checked against this Azure resource's actual permissions and state.