Azure AZ-104: Deploy and manage Azure compute resources Practice Questions

Metric-based autoscaling in VMSS supports custom metrics from Azure resources, including Service Bus queue message count (an Azure Monitor metric). You can define scale-out rules (queue depth > 500) and scale-in rules (queue depth < 100), making this a direct and native solution. — Schedule-based autoscaling scales on a time schedule regardless of actual queue depth, so it cannot react to the dynamic fluctuations described. — Manual scaling with an Automation runbook could technically work but is not the 'configure' approach asked for — it introduces operational complexity and polling latency versus native autoscale. — CPU percentage measures compute utilization on the VMs themselves, not the backlog in the queue; if queue depth grows but processors are idle (e.g., workers waiting on I/O), CPU-based scaling would not trigger scale-out.

Azure Bastion is a fully managed PaaS service deployed in a virtual network that provides secure, browser-based RDP and SSH connectivity to VMs directly through the Azure portal over TLS port 443, requiring no public IP on the VM and no inbound NSG rule for port 3389. — Azure VPN Gateway point-to-site allows remote clients to connect via a VPN tunnel but requires client software installation and doesn't provide browser-based access; it also doesn't eliminate the need for RDP being reachable inside the network. — JIT VM access temporarily opens NSG rules on a specific port (e.g., 3389) for an approved source IP — this actually modifies the NSG, which violates the scenario constraint. — Azure Application Gateway is a Layer 7 load balancer for HTTP/HTTPS web traffic, not a solution for RDP access to VMs.

The 'Deny' effect in Azure Policy actively blocks non-compliant resource deployments at the time of the ARM request. This is the correct effect to prevent new VMs from being created with unapproved SKU sizes — existing VMs are not affected because 'Deny' only applies at create/update time. 'Audit' logs non-compliant resources but does not block deployment — an administrator would be informed but the non-approved VM SKU would still be created. 'DeployIfNotExists' triggers a remediation deployment when a resource doesn't have a related resource (e.g., enabling diagnostics) — it's not used to block VM SKU deployments. 'Modify' is used to add, update, or remove properties or tags on resources during creation or update, but it cannot block a deployment or change the VM SKU that was requested.

The 'az deployment group what-if' command performs a what-if analysis that shows exactly which resources would be created, modified, or deleted without making any actual changes — this is the pre-deployment preview capability. — 'az deployment group create --mode Incremental' actually executes the deployment and creates/modifies real resources; Incremental mode means existing resources not in the template are left alone, but it still makes changes. — 'az deployment group validate' checks the template for syntactic and semantic correctness (schema validation, parameter types, etc.) but does not predict resource-level changes or show what would be created/modified. — 'az bicep build' transpiles the Bicep file into an ARM JSON template for inspection or other use, but does not interact with Azure or validate against existing resources.

Access restrictions in App Service networking settings allow you to define allow/deny rules based on IP address ranges, effectively functioning as a built-in firewall for the app. This is the simplest, most direct way to restrict inbound traffic to a specific IP range for an App Service app. NSGs cannot be applied directly to App Service in a non-VNet-integrated deployment — App Service is a PaaS service and its inbound traffic does not flow through a customer-managed subnet unless the app is behind an App Service Environment (ASE). Azure DDoS Protection Standard protects against volumetric DDoS attacks and does not provide IP allowlist/blocklist functionality. An Application Gateway WAF can achieve this, but it adds significant cost and complexity compared to the native access restrictions feature, making it an over-engineered solution for this specific requirement.