Pass Your Microsoft AZ-104 Exam Easy!

'Recognize that the App Service plan provisions shared compute capacity for its apps' applies to a different feature boundary because plan CPU/memory and instance count can affect all apps sharing the same plan. In the stated scenario where a developer increases App Service plan size but calls it instance scale-out, 'Recognize that the App Service plan provisions shared compute capacity for its apps' does not satisfy the mechanism that vertical and horizontal scaling solve different capacity limits and may have different costs. The necessary action is 'Use scale-up to change worker SKU and scale-out to change instance count', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Check plan-tier instance limits and move to a supported tier if justified' is associated with this separate need: an App Service application cannot scale to the requested number of instances on its current tier. That is because autoscale rules cannot bypass platform limits of the selected compute plan. Here a developer increases App Service plan size but calls it instance scale-out, so 'Check plan-tier instance limits and move to a supported tier if justified' misses the fact that vertical and horizontal scaling solve different capacity limits and may have different costs. 'Use scale-up to change worker SKU and scale-out to change instance count' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a Linux web app is added to an existing Windows App Service plan in a different region, the action 'Use a compatible operating-system and regional App Service plan' can be relevant: apps on a plan must satisfy the plan's platform and region constraints. For the different problem of a developer increases App Service plan size but calls it instance scale-out, 'Use a compatible operating-system and regional App Service plan' misses the mechanism that vertical and horizontal scaling solve different capacity limits and may have different costs. Choosing 'Use a compatible operating-system and regional App Service plan' would address that other need, whereas 'Use scale-up to change worker SKU and scale-out to change instance count' is intended to solve the stated condition.

App Service automatic scaling and Azure Monitor autoscale are distinct capabilities. Automatic scaling reacts to incoming HTTP traffic and supports per-app limits on eligible Premium tiers; it does not implement the requested rule that average CPU exceed a threshold for a defined ten-minute interval. This example uses a Standard-tier plan and requires a CPU-based metric decision. The administrator should configure Azure Monitor autoscale for the plan with the appropriate time aggregation, eligible min/max worker limits and cooldown. Avoid interpreting any platform-driven scaling feature as interchangeable with CPU-triggered autoscale.

A CPU metric alert can tell an operator that a threshold has been reached, but notifications alone do not add an App Service worker. The stated requirement is an automatic capacity change when sustained measured CPU exceeds 70%, not merely visibility into performance. Azure Monitor autoscale uses profiles, metric rules, time windows and actions that can increase instance count. The team can retain a metric alert for observability, but must independently configure an autoscale rule tied to the App Service plan to meet the capacity requirement.

Increasing the App Service plan's pricing tier or worker size is scale-up: each worker gets greater CPU, memory or features. It leaves the number of instances at two and does not automatically add a third worker when the specified sustained CPU condition occurs. Vertical scaling might be justified for per-instance memory pressure or unsupported scale-out limits, but that is a separate decision. The request expressly asks for a conditional increase in worker count, so choose metric-based autoscale with a valid scale-out action and appropriate bounds.

A fixed daily change to three workers can provide additional capacity at predictable times, but it is not conditioned on average CPU exceeding 70% for ten minutes. It can waste cost on quiet days and still arrive too late during unexpected load. Scheduled autoscale is useful for a documented periodic workload, while metric-based autoscale responds to observed utilization. Here the owner specified an operational metric and an evaluation window, so attach the autoscale rule to the App Service plan and verify its min/max and cooldown settings.

When a Linux web app is added to an existing Windows App Service plan in a different region, the action 'Use a compatible operating-system and regional App Service plan' can be relevant: apps on a plan must satisfy the plan's platform and region constraints. For the different problem of an App Service application cannot scale to the requested number of instances on its current tier, 'Use a compatible operating-system and regional App Service plan' misses the mechanism that autoscale rules cannot bypass platform limits of the selected compute plan. Choosing 'Use a compatible operating-system and regional App Service plan' would address that other need, whereas 'Check plan-tier instance limits and move to a supported tier if justified' is intended to solve the stated condition.

'Use scale-up to change worker SKU and scale-out to change instance count' applies to a different feature boundary because vertical and horizontal scaling solve different capacity limits and may have different costs. In the stated scenario where an App Service application cannot scale to the requested number of instances on its current tier, 'Use scale-up to change worker SKU and scale-out to change instance count' does not satisfy the mechanism that autoscale rules cannot bypass platform limits of the selected compute plan. The necessary action is 'Check plan-tier instance limits and move to a supported tier if justified', which should be checked against this Azure resource's actual permissions and state.

Deployment slots facilitate staging and controlled swaps, but they do not automatically raise an App Service plan’s maximum scale-out capacity. The symptom is an instance-count limit on the current tier. Check the plan’s supported scale and regional SKU quotas, then select a suitable tier if approved. Changing a deployment workflow feature cannot by itself authorize the requested number of worker instances.

App Service plans can support different pricing tiers and runtime environments, but a Windows-hosted web app cannot be converted to a Linux web app merely by moving that existing app to a Linux plan. Microsoft documents that changing the operating-system type in that manner is unsupported. The release explicitly requires a Linux-only native dependency, so preserving the Windows application resource would retain the mismatch. Provision a new compatible Linux app, validate the dependencies and runtime stack, replicate needed configuration safely, and switch traffic or custom domains through a controlled deployment. This preserves a supported runtime boundary rather than assuming an OS migration is an in-place plan adjustment.

Secret rotation is important when credentials have leaked or when access controls require an update, but there is no secret-exposure problem in the question. The package depends on a Linux-only native library while the running App Service resource uses Windows. Changing a password or Key Vault reference does not supply the Linux system ABI or filesystem/runtime libraries required by that release. The needed correction is to deploy to an App Service resource created for a compatible Linux runtime and verify actual application startup. Configuration and managed-identity permissions should be migrated appropriately but do not replace a compatible operating system.

Runtime logs are helpful for identifying the failed native library load and for validating a corrected deployment, but reading them is a diagnostic action rather than the necessary fix. The scenario already identifies the unsupported Windows-versus-Linux platform requirement and grants a controlled cutover. Leaving the existing Windows app unchanged would still prevent the Linux-only dependency from loading, even if errors were recorded in greater detail. The administrator should prepare a new Linux App Service deployment with the supported runtime, test application behavior end to end, and switch client routing only after the new environment meets operational requirements.

'Use a compatible operating-system and regional App Service plan' applies to a different feature boundary because apps on a plan must satisfy the plan's platform and region constraints. In the stated scenario where a new web app includes sample credentials in app settings and public build logs, 'Use a compatible operating-system and regional App Service plan' does not satisfy the mechanism that application configuration must keep credentials out of public deployment artifacts. The necessary action is 'Remove leaked values and use secure App Service settings, secret references and managed identity', which should be checked against this Azure resource's actual permissions and state.

'Configure App Service access restrictions for the permitted client ranges' solves another task because DNS mapping and certificates do not independently filter the client origins allowed to access the app. For the situation where a new web app includes sample credentials in app settings and public build logs, this distractor misses the requirement that application configuration must keep credentials out of public deployment artifacts. Unlike 'Configure App Service access restrictions for the permitted client ranges', 'Remove leaked values and use secure App Service settings, secret references and managed identity' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a developer proposes Azure VM backup for a PaaS Web App that runs on App Service, the action 'Use supported App Service backup/restore capabilities rather than VM disk backup' can be relevant: App Service does not give the tenant an ordinary VM disk to protect with VM Recovery Services policy. For the different problem of a new web app includes sample credentials in app settings and public build logs, 'Use supported App Service backup/restore capabilities rather than VM disk backup' misses the mechanism that application configuration must keep credentials out of public deployment artifacts. Choosing 'Use supported App Service backup/restore capabilities rather than VM disk backup' would address that other need, whereas 'Remove leaked values and use secure App Service settings, secret references and managed identity' is intended to solve the stated condition.

'Remove leaked values and use secure App Service settings, secret references and managed identity' solves another task because application configuration must keep credentials out of public deployment artifacts. For the situation where an App Service resource shows Provisioned, but its default hostname returns HTTP 500, this distractor misses the requirement that ARM provisioning success is not proof that application code starts correctly. Unlike 'Remove leaked values and use secure App Service settings, secret references and managed identity', 'Check application runtime logs, health endpoint and hostname behavior' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a company maps `portal.example.test` to an App Service default hostname, the action 'Configure the supported CNAME mapping and required ownership verification' can be relevant: CNAME commonly maps a subdomain to the app hostname; apex domains have different constraints. For the different problem of an App Service resource shows Provisioned, but its default hostname returns HTTP 500, 'Configure the supported CNAME mapping and required ownership verification' misses the mechanism that ARM provisioning success is not proof that application code starts correctly. Choosing 'Configure the supported CNAME mapping and required ownership verification' would address that other need, whereas 'Check application runtime logs, health endpoint and hostname behavior' is intended to solve the stated condition.

'Select a supported runtime stack and operating system matching the deployed package' applies to a different feature boundary because a correctly uploaded artifact can still fail startup on an incompatible hosting environment. In the stated scenario where an App Service resource shows Provisioned, but its default hostname returns HTTP 500, 'Select a supported runtime stack and operating system matching the deployed package' does not satisfy the mechanism that ARM provisioning success is not proof that application code starts correctly. The necessary action is 'Check application runtime logs, health endpoint and hostname behavior', which should be checked against this Azure resource's actual permissions and state.

'Verify required DNS ownership TXT/CNAME records and successful domain verification' solves another task because domain proof and DNS routing must align; a copied hostname alone is not adequate authorization. For the situation where a site uses a custom domain and requires a valid certificate for visitors, this distractor misses the requirement that a valid certificate must match the requested domain and be associated with the app binding. Unlike 'Verify required DNS ownership TXT/CNAME records and successful domain verification', 'Bind a supported TLS certificate to the custom hostname in App Service' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a production website certificate expires next month, the action 'Renew and validate the certificate binding ahead of expiry' can be relevant: certificate rotation is independent of an application runtime upgrade; test real HTTPS access. For the different problem of a site uses a custom domain and requires a valid certificate for visitors, 'Renew and validate the certificate binding ahead of expiry' misses the mechanism that a valid certificate must match the requested domain and be associated with the app binding. Choosing 'Renew and validate the certificate binding ahead of expiry' would address that other need, whereas 'Bind a supported TLS certificate to the custom hostname in App Service' is intended to solve the stated condition.

The nearby action 'Correct the DNS verification record and retry domain validation' is associated with this separate need: a custom hostname refuses to bind because App Service cannot verify ownership. That is because changing TLS cipher settings cannot repair missing DNS proof of control. Here a site uses a custom domain and requires a valid certificate for visitors, so 'Correct the DNS verification record and retry domain validation' misses the fact that a valid certificate must match the requested domain and be associated with the app binding. 'Bind a supported TLS certificate to the custom hostname in App Service' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use supported App Service backup/restore capabilities rather than VM disk backup' solves another task because App Service does not give the tenant an ordinary VM disk to protect with VM Recovery Services policy. For the situation where a site uses a custom domain and requires a valid certificate for visitors, this distractor misses the requirement that a valid certificate must match the requested domain and be associated with the app binding. Unlike 'Use supported App Service backup/restore capabilities rather than VM disk backup', 'Bind a supported TLS certificate to the custom hostname in App Service' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a custom hostname refuses to bind because App Service cannot verify ownership, the action 'Correct the DNS verification record and retry domain validation' can be relevant: changing TLS cipher settings cannot repair missing DNS proof of control. For the different problem of users reach the right site name but receive a certificate hostname mismatch, 'Correct the DNS verification record and retry domain validation' misses the mechanism that correct DNS routing alone does not establish a certificate valid for that requested name. Choosing 'Correct the DNS verification record and retry domain validation' would address that other need, whereas 'Check the custom hostname binding and TLS certificate subject/SAN coverage' is intended to solve the stated condition.

The nearby action 'Renew and validate the certificate binding ahead of expiry' is associated with this separate need: a production website certificate expires next month. That is because certificate rotation is independent of an application runtime upgrade; test real HTTPS access. Here users reach the right site name but receive a certificate hostname mismatch, so 'Renew and validate the certificate binding ahead of expiry' misses the fact that correct DNS routing alone does not establish a certificate valid for that requested name. 'Check the custom hostname binding and TLS certificate subject/SAN coverage' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Verify required DNS ownership TXT/CNAME records and successful domain verification' solves another task because domain proof and DNS routing must align; a copied hostname alone is not adequate authorization. For the situation where users reach the right site name but receive a certificate hostname mismatch, this distractor misses the requirement that correct DNS routing alone does not establish a certificate valid for that requested name. Unlike 'Verify required DNS ownership TXT/CNAME records and successful domain verification', 'Check the custom hostname binding and TLS certificate subject/SAN coverage' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Check the custom hostname binding and TLS certificate subject/SAN coverage' applies to a different feature boundary because correct DNS routing alone does not establish a certificate valid for that requested name. In the stated scenario where a production website certificate expires next month, 'Check the custom hostname binding and TLS certificate subject/SAN coverage' does not satisfy the mechanism that certificate rotation is independent of an application runtime upgrade; test real HTTPS access. The necessary action is 'Renew and validate the certificate binding ahead of expiry', which should be checked against this Azure resource's actual permissions and state.

A TLS binding associates a certificate with the custom hostname, but rebinding the same certificate cannot extend its validity period. The deployment would still present a certificate that expires next month, leaving the site's renewal outage risk unchanged. Maintenance should obtain a renewed or replacement supported certificate covering the hostname, install and bind the new certificate, and validate actual HTTPS traffic before the old credential expires. A successful portal binding operation alone is not evidence that the newly served certificate has a later expiration date.

When an App Service resource shows Provisioned, but its default hostname returns HTTP 500, the action 'Check application runtime logs, health endpoint and hostname behavior' can be relevant: ARM provisioning success is not proof that application code starts correctly. For the different problem of a production website certificate expires next month, 'Check application runtime logs, health endpoint and hostname behavior' misses the mechanism that certificate rotation is independent of an application runtime upgrade; test real HTTPS access. Choosing 'Check application runtime logs, health endpoint and hostname behavior' would address that other need, whereas 'Renew and validate the certificate binding ahead of expiry' is intended to solve the stated condition.

The nearby action 'Configure App Service access restrictions for the permitted client ranges' is associated with this separate need: only three partner office IPs should reach a public App Service endpoint. That is because DNS mapping and certificates do not independently filter the client origins allowed to access the app. Here a company maps `portal.example.test` to an App Service default hostname, so 'Configure App Service access restrictions for the permitted client ranges' misses the fact that CNAME commonly maps a subdomain to the app hostname; apex domains have different constraints. 'Create the supported CNAME from portal.example.test to the App Service default hostname, retaining the already verified ownership record' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use a compatible operating-system and regional App Service plan' solves another task because apps on a plan must satisfy the plan's platform and region constraints. For the situation where a company maps `portal.example.test` to an App Service default hostname, this distractor misses the requirement that CNAME commonly maps a subdomain to the app hostname; apex domains have different constraints. Unlike 'Use a compatible operating-system and regional App Service plan', 'Create the supported CNAME from portal.example.test to the App Service default hostname, retaining the already verified ownership record' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an App Service resource shows Provisioned, but its default hostname returns HTTP 500, the action 'Check application runtime logs, health endpoint and hostname behavior' can be relevant: ARM provisioning success is not proof that application code starts correctly. For the different problem of a company maps `portal.example.test` to an App Service default hostname, 'Check application runtime logs, health endpoint and hostname behavior' misses the mechanism that CNAME commonly maps a subdomain to the app hostname; apex domains have different constraints. Choosing 'Check application runtime logs, health endpoint and hostname behavior' would address that other need, whereas 'Create the supported CNAME from portal.example.test to the App Service default hostname, retaining the already verified ownership record' is intended to solve the stated condition.

Correcting a DNS ownership-verification record can solve an App Service domain validation failure, but this case explicitly says ownership verification already passed. The reported defect is the absence of the subdomain's routing CNAME. Altering the existing valid asuid verification token will not create the required alias record and can even break a future ownership check. Configure the CNAME target to the application's default hostname, verify that clients resolve it and then test the custom-hostname binding.

Possessing a certificate with a related name is not a substitute for the supported App Service custom-domain ownership-validation process. A certificate may be valid for an unrelated hostname or obtained independently of the exact DNS records Azure requests. The scenario says the records have not yet been verified, so skip-assumption would leave domain control unproved. Check the specific host mapping and ownership verification ID or appropriate DNS record as required for this domain type before completing the App Service binding.

A healthy application at its platform-provided hostname demonstrates runtime reachability, not control over a separate external DNS name. An unrelated tenant could have a working app while lacking ownership of the custom hostname it is attempting to bind. The administrator must inspect authoritative public DNS and the appropriate verification record, wait for propagation if necessary, and confirm App Service accepts the custom domain. A default hostname HTTP 200 response does not establish the requested domain's identity.

A certificate binding protects TLS for a hostname after that hostname is properly configured, but installing an arbitrary certificate cannot bypass Azure's supported domain verification. The problem is not a missing HTTPS listener or expiring certificate; it is the outstanding requirement to prove control of the proposed custom hostname. Determine the correct DNS record type and validation token for the apex or subdomain and confirm Azure recognizes it before performing security-sensitive hostname and certificate binding work.