secure parameter handling reduces accidental secret exposure during declarative deployments. In this case, a template has an unrecognized API version for a resource type. “Use a supported secure parameter and protected secret source” would not satisfy that requirement; the supported action is “Use a supported resource-provider API version in the declaration”. Resource API versions determine available properties and validation for the provider type.

declarative infrastructure code makes configuration changes reviewable and reproducible. In this case, a template has an unrecognized API version for a resource type. “Version-controlled ARM templates or Bicep definitions” would not satisfy that requirement; the supported action is “Use a supported resource-provider API version in the declaration”. Resource API versions determine available properties and validation for the provider type.

declarative updates must respect immutable properties and current-state constraints. In this case, a template has an unrecognized API version for a resource type. “The desired resource properties and actual resource state for that name” would not satisfy that requirement; the supported action is “Use a supported resource-provider API version in the declaration”. Resource API versions determine available properties and validation for the provider type.

resource API versions determine available properties and validation for the provider type. In this case, a deployment reports a conflict because a target name already exists with incompatible settings. “Use a supported resource-provider API version in the declaration” would not satisfy that requirement; the supported action is “The desired resource properties and actual resource state for that name”. Declarative updates must respect immutable properties and current-state constraints.

secure parameter handling reduces accidental secret exposure during declarative deployments. In this case, a deployment reports a conflict because a target name already exists with incompatible settings. “Use a supported secure parameter and protected secret source” would not satisfy that requirement; the supported action is “The desired resource properties and actual resource state for that name”. Declarative updates must respect immutable properties and current-state constraints.

template export provides a starting declaration but may require cleanup before repeatable deployment. In this case, a deployment reports a conflict because a target name already exists with incompatible settings. “Export its ARM template and review it before reuse” would not satisfy that requirement; the supported action is “The desired resource properties and actual resource state for that name”. Declarative updates must respect immutable properties and current-state constraints.

bicep decompilation helps migrate templates but generated code still requires inspection. In this case, an organization wants repeatable resource provisioning with code review and version history. “Decompile or convert ARM JSON to Bicep and review the result” would not satisfy that requirement; the supported action is “Version-controlled ARM templates or Bicep definitions”. Declarative infrastructure code makes configuration changes reviewable and reproducible.

resource API versions determine available properties and validation for the provider type. In this case, an organization wants repeatable resource provisioning with code review and version history. “Use a supported resource-provider API version in the declaration” would not satisfy that requirement; the supported action is “Version-controlled ARM templates or Bicep definitions”. Declarative infrastructure code makes configuration changes reviewable and reproducible.

infrastructure definitions should not store sensitive credentials in version-controlled text. In this case, an organization wants repeatable resource provisioning with code review and version history. “Embedding secrets as cleartext parameter defaults or source literals” would not satisfy that requirement; the supported action is “Version-controlled ARM templates or Bicep definitions”. Declarative infrastructure code makes configuration changes reviewable and reproducible.

vM network egress depends on applicable routes, security rules and a valid outbound path. In this case, a new Linux VM must be provisioned in one specified virtual network subnet. “Subnet routing, NSG and outbound connectivity design” would not satisfy that requirement; the supported action is “A network interface attached to the intended subnet”. The VM's NIC provides connectivity through its selected VNet subnet.

oS updates normally occur within the existing Azure VM resource rather than through uncontrolled replacement. In this case, a new Linux VM must be provisioned in one specified virtual network subnet. “The existing VM resource and its management identity” would not satisfy that requirement; the supported action is “A network interface attached to the intended subnet”. The VM's NIC provides connectivity through its selected VNet subnet.

a managed jump pathway avoids exposing the VM's inbound RDP service publicly. In this case, a new Linux VM must be provisioned in one specified virtual network subnet. “Use Azure Bastion or an approved private administration path” would not satisfy that requirement; the supported action is “A network interface attached to the intended subnet”. The VM's NIC provides connectivity through its selected VNet subnet.

the VM's NIC provides connectivity through its selected VNet subnet. In this case, a Windows VM needs remote administrative access but should not expose an RDP port on a public IP. “A network interface attached to the intended subnet” would not satisfy that requirement; the supported action is “Use Azure Bastion or an approved private administration path”. A managed jump pathway avoids exposing the VM's inbound RDP service publicly.

managed identities provide service authentication without placing long-lived credentials in the application. In this case, a Windows VM needs remote administrative access but should not expose an RDP port on a public IP. “A managed identity on the VM” would not satisfy that requirement; the supported action is “Use Azure Bastion or an approved private administration path”. A managed jump pathway avoids exposing the VM's inbound RDP service publicly.

a VM extension can execute configured tasks after the VM resource is provisioned. In this case, a Windows VM needs remote administrative access but should not expose an RDP port on a public IP. “The Custom Script Extension with an idempotent script” would not satisfy that requirement; the supported action is “Use Azure Bastion or an approved private administration path”. A managed jump pathway avoids exposing the VM's inbound RDP service publicly.

oS updates normally occur within the existing Azure VM resource rather than through uncontrolled replacement. In this case, a VM needs to authenticate to Azure services without a stored password. “The existing VM resource and its management identity” would not satisfy that requirement; the supported action is “A managed identity on the VM”. Managed identities provide service authentication without placing long-lived credentials in the application.

a VM extension can execute configured tasks after the VM resource is provisioned. In this case, a VM needs to authenticate to Azure services without a stored password. “The Custom Script Extension with an idempotent script” would not satisfy that requirement; the supported action is “A managed identity on the VM”. Managed identities provide service authentication without placing long-lived credentials in the application.

resizing changes compute allocation and may require deallocation depending on hardware placement. In this case, a VM needs to authenticate to Azure services without a stored password. “Resize the VM to a compatible SKU” would not satisfy that requirement; the supported action is “A managed identity on the VM”. Managed identities provide service authentication without placing long-lived credentials in the application.

managed identities provide service authentication without placing long-lived credentials in the application. In this case, a VM must run a post-deployment configuration script once Azure provisioning completes. “A managed identity on the VM” would not satisfy that requirement; the supported action is “The Custom Script Extension with an idempotent script”. A VM extension can execute configured tasks after the VM resource is provisioned.

oS updates normally occur within the existing Azure VM resource rather than through uncontrolled replacement. In this case, a VM must run a post-deployment configuration script once Azure provisioning completes. “The existing VM resource and its management identity” would not satisfy that requirement; the supported action is “The Custom Script Extension with an idempotent script”. A VM extension can execute configured tasks after the VM resource is provisioned.

the VM's NIC provides connectivity through its selected VNet subnet. In this case, a VM must run a post-deployment configuration script once Azure provisioning completes. “A network interface attached to the intended subnet” would not satisfy that requirement; the supported action is “The Custom Script Extension with an idempotent script”. A VM extension can execute configured tasks after the VM resource is provisioned.

oS updates normally occur within the existing Azure VM resource rather than through uncontrolled replacement. In this case, an administrator wants to change the VM's compute capacity without recreating its operating-system data. “The existing VM resource and its management identity” would not satisfy that requirement; the supported action is “Resize the VM to a compatible SKU”. Resizing changes compute allocation and may require deallocation depending on hardware placement.

deallocation releases allocated compute resources while attached storage continues to incur charges. In this case, an administrator wants to change the VM's compute capacity without recreating its operating-system data. “Stop (deallocate) the VM rather than merely shut down its guest OS” would not satisfy that requirement; the supported action is “Resize the VM to a compatible SKU”. Resizing changes compute allocation and may require deallocation depending on hardware placement.

managed identities provide service authentication without placing long-lived credentials in the application. In this case, an administrator wants to change the VM's compute capacity without recreating its operating-system data. “A managed identity on the VM” would not satisfy that requirement; the supported action is “Resize the VM to a compatible SKU”. Resizing changes compute allocation and may require deallocation depending on hardware placement.

the VM's NIC provides connectivity through its selected VNet subnet. In this case, a VM is deployed with no outbound Internet reachability after a subnet change. “A network interface attached to the intended subnet” would not satisfy that requirement; the supported action is “Subnet routing, NSG and outbound connectivity design”. VM network egress depends on applicable routes, security rules and a valid outbound path.

resizing changes compute allocation and may require deallocation depending on hardware placement. In this case, a VM is deployed with no outbound Internet reachability after a subnet change. “Resize the VM to a compatible SKU” would not satisfy that requirement; the supported action is “Subnet routing, NSG and outbound connectivity design”. VM network egress depends on applicable routes, security rules and a valid outbound path.

oS updates normally occur within the existing Azure VM resource rather than through uncontrolled replacement. In this case, a VM is deployed with no outbound Internet reachability after a subnet change. “The existing VM resource and its management identity” would not satisfy that requirement; the supported action is “Subnet routing, NSG and outbound connectivity design”. VM network egress depends on applicable routes, security rules and a valid outbound path.

managed identities provide service authentication without placing long-lived credentials in the application. In this case, an application requires a fixed VM identity in resource inventory even after guest operating-system updates. “A managed identity on the VM” would not satisfy that requirement; the supported action is “The existing VM resource and its management identity”. OS updates normally occur within the existing Azure VM resource rather than through uncontrolled replacement.

resizing changes compute allocation and may require deallocation depending on hardware placement. In this case, an application requires a fixed VM identity in resource inventory even after guest operating-system updates. “Resize the VM to a compatible SKU” would not satisfy that requirement; the supported action is “The existing VM resource and its management identity”. OS updates normally occur within the existing Azure VM resource rather than through uncontrolled replacement.

the VM's NIC provides connectivity through its selected VNet subnet. In this case, an application requires a fixed VM identity in resource inventory even after guest operating-system updates. “A network interface attached to the intended subnet” would not satisfy that requirement; the supported action is “The existing VM resource and its management identity”. OS updates normally occur within the existing Azure VM resource rather than through uncontrolled replacement.

resizing changes compute allocation and may require deallocation depending on hardware placement. In this case, an administrator must stop compute billing on a VM during an extended maintenance period. “Resize the VM to a compatible SKU” would not satisfy that requirement; the supported action is “Stop (deallocate) the VM rather than merely shut down its guest OS”. Deallocation releases allocated compute resources while attached storage continues to incur charges.

oS updates normally occur within the existing Azure VM resource rather than through uncontrolled replacement. In this case, an administrator must stop compute billing on a VM during an extended maintenance period. “The existing VM resource and its management identity” would not satisfy that requirement; the supported action is “Stop (deallocate) the VM rather than merely shut down its guest OS”. Deallocation releases allocated compute resources while attached storage continues to incur charges.

the VM's NIC provides connectivity through its selected VNet subnet. In this case, an administrator must stop compute billing on a VM during an extended maintenance period. “A network interface attached to the intended subnet” would not satisfy that requirement; the supported action is “Stop (deallocate) the VM rather than merely shut down its guest OS”. Deallocation releases allocated compute resources while attached storage continues to incur charges.