Multiple VMs within one zone remain vulnerable to zone-wide failure. In this case, a VM Scale Set is fixed at two instances during heavy traffic. “Distribute instances across separate supported zones” would not satisfy that requirement; the supported action is “Autoscale rules or a suitable scale-out policy”. Scale set provisioning and automatic scaling require separate scaling configuration.

Custom Script Extension can execute provisioning scripts on Azure VMs. In this case, a VM Scale Set is fixed at two instances during heavy traffic. “Custom Script Extension with repeat-safe configuration” would not satisfy that requirement; the supported action is “Autoscale rules or a suitable scale-out policy”. Scale set provisioning and automatic scaling require separate scaling configuration.

Extensions can be reapplied, so scripts should tolerate repetition. In this case, a VM Scale Set is fixed at two instances during heavy traffic. “Make the script idempotent and define safe rerun behavior” would not satisfy that requirement; the supported action is “Autoscale rules or a suitable scale-out policy”. Scale set provisioning and automatic scaling require separate scaling configuration.

Scale sets manage sets of VMs and can adjust instance counts according to policy. In this case, a VM needs to execute setup scripts after creation using Azure management. “Azure Virtual Machine Scale Sets with an autoscale configuration” would not satisfy that requirement; the supported action is “Custom Script Extension with repeat-safe configuration”. Custom Script Extension can execute provisioning scripts on Azure VMs.

Azure does not automatically retain the user's private SSH key for recovery. In this case, a VM needs to execute setup scripts after creation using Azure management. “Generate and manage a replacement key through approved recovery access” would not satisfy that requirement; the supported action is “Custom Script Extension with repeat-safe configuration”. Custom Script Extension can execute provisioning scripts on Azure VMs.

Scale set provisioning and automatic scaling require separate scaling configuration. In this case, a VM needs to execute setup scripts after creation using Azure management. “Autoscale rules or a suitable scale-out policy” would not satisfy that requirement; the supported action is “Custom Script Extension with repeat-safe configuration”. Custom Script Extension can execute provisioning scripts on Azure VMs.

Azure does not automatically retain the user's private SSH key for recovery. In this case, a Custom Script Extension runs twice and creates duplicate records. “Generate and manage a replacement key through approved recovery access” would not satisfy that requirement; the supported action is “Make the script idempotent and define safe rerun behavior”. Extensions can be reapplied, so scripts should tolerate repetition.

SSH key authentication avoids provisioning ordinary shared password secrets. In this case, a Custom Script Extension runs twice and creates duplicate records. “An SSH public key and an authorized admin username” would not satisfy that requirement; the supported action is “Make the script idempotent and define safe rerun behavior”. Extensions can be reapplied, so scripts should tolerate repetition.

Scale set provisioning and automatic scaling require separate scaling configuration. In this case, a Custom Script Extension runs twice and creates duplicate records. “Autoscale rules or a suitable scale-out policy” would not satisfy that requirement; the supported action is “Make the script idempotent and define safe rerun behavior”. Extensions can be reapplied, so scripts should tolerate repetition.

Data disks separate application data from OS disk lifecycle and image changes. In this case, a Linux VM must log in with SSH keys rather than a password. “A separate managed data disk” would not satisfy that requirement; the supported action is “An SSH public key and an authorized admin username”. SSH key authentication avoids provisioning ordinary shared password secrets.

Custom Script Extension can execute provisioning scripts on Azure VMs. In this case, a Linux VM must log in with SSH keys rather than a password. “Custom Script Extension with repeat-safe configuration” would not satisfy that requirement; the supported action is “An SSH public key and an authorized admin username”. SSH key authentication avoids provisioning ordinary shared password secrets.

Ephemeral local storage is not durable application data storage. In this case, a Linux VM must log in with SSH keys rather than a password. “Temporary disks can lose contents during host maintenance or reallocation” would not satisfy that requirement; the supported action is “An SSH public key and an authorized admin username”. SSH key authentication avoids provisioning ordinary shared password secrets.

Ephemeral local storage is not durable application data storage. In this case, an admin loses a local SSH private key and assumes Azure stores a copy. “Temporary disks can lose contents during host maintenance or reallocation” would not satisfy that requirement; the supported action is “Generate and manage a replacement key through approved recovery access”. Azure does not automatically retain the user's private SSH key for recovery.

Custom Script Extension can execute provisioning scripts on Azure VMs. In this case, an admin loses a local SSH private key and assumes Azure stores a copy. “Custom Script Extension with repeat-safe configuration” would not satisfy that requirement; the supported action is “Generate and manage a replacement key through approved recovery access”. Azure does not automatically retain the user's private SSH key for recovery.

Data disks separate application data from OS disk lifecycle and image changes. In this case, an admin loses a local SSH private key and assumes Azure stores a copy. “A separate managed data disk” would not satisfy that requirement; the supported action is “Generate and manage a replacement key through approved recovery access”. Azure does not automatically retain the user's private SSH key for recovery.

SSH key authentication avoids provisioning ordinary shared password secrets. In this case, a VM must mount application data independently of its operating-system disk. “An SSH public key and an authorized admin username” would not satisfy that requirement; the supported action is “A separate managed data disk”. Data disks separate application data from OS disk lifecycle and image changes.

Image versions provide controlled reusable artifacts for VM deployment. In this case, a VM must mount application data independently of its operating-system disk. “Publish versioned images through Azure Compute Gallery” would not satisfy that requirement; the supported action is “A separate managed data disk”. Data disks separate application data from OS disk lifecycle and image changes.

Compute Gallery distributes reusable VM image definitions and versions across regions. In this case, a VM must mount application data independently of its operating-system disk. “Azure Compute Gallery image versions with regional replication” would not satisfy that requirement; the supported action is “A separate managed data disk”. Data disks separate application data from OS disk lifecycle and image changes.

Azure does not automatically retain the user's private SSH key for recovery. In this case, a team stores an application database on the ephemeral temporary disk. “Generate and manage a replacement key through approved recovery access” would not satisfy that requirement; the supported action is “Temporary disks can lose contents during host maintenance or reallocation”. Ephemeral local storage is not durable application data storage.

Image versions provide controlled reusable artifacts for VM deployment. In this case, a team stores an application database on the ephemeral temporary disk. “Publish versioned images through Azure Compute Gallery” would not satisfy that requirement; the supported action is “Temporary disks can lose contents during host maintenance or reallocation”. Ephemeral local storage is not durable application data storage.

Compute Gallery distributes reusable VM image definitions and versions across regions. In this case, a team stores an application database on the ephemeral temporary disk. “Azure Compute Gallery image versions with regional replication” would not satisfy that requirement; the supported action is “Temporary disks can lose contents during host maintenance or reallocation”. Ephemeral local storage is not durable application data storage.

Managed identities provide Azure-hosted credential flows for supported services. In this case, an enterprise wants new VMs created from a standardized tested image in several regions. “A system-assigned or user-assigned managed identity” would not satisfy that requirement; the supported action is “Azure Compute Gallery image versions with regional replication”. Compute Gallery distributes reusable VM image definitions and versions across regions.

Managed identity issuance alone does not authorize secret access. In this case, an enterprise wants new VMs created from a standardized tested image in several regions. “Grant the identity the relevant Key Vault data-plane permission” would not satisfy that requirement; the supported action is “Azure Compute Gallery image versions with regional replication”. Compute Gallery distributes reusable VM image definitions and versions across regions.

Ephemeral local storage is not durable application data storage. In this case, an enterprise wants new VMs created from a standardized tested image in several regions. “Temporary disks can lose contents during host maintenance or reallocation” would not satisfy that requirement; the supported action is “Azure Compute Gallery image versions with regional replication”. Compute Gallery distributes reusable VM image definitions and versions across regions.

Managed identities provide Azure-hosted credential flows for supported services. In this case, a team manually copies VM images between regions after every patch. “A system-assigned or user-assigned managed identity” would not satisfy that requirement; the supported action is “Publish versioned images through Azure Compute Gallery”. Image versions provide controlled reusable artifacts for VM deployment.

Ephemeral local storage is not durable application data storage. In this case, a team manually copies VM images between regions after every patch. “Temporary disks can lose contents during host maintenance or reallocation” would not satisfy that requirement; the supported action is “Publish versioned images through Azure Compute Gallery”. Image versions provide controlled reusable artifacts for VM deployment.

Data disks separate application data from OS disk lifecycle and image changes. In this case, a team manually copies VM images between regions after every patch. “A separate managed data disk” would not satisfy that requirement; the supported action is “Publish versioned images through Azure Compute Gallery”. Image versions provide controlled reusable artifacts for VM deployment.

Compute Gallery distributes reusable VM image definitions and versions across regions. In this case, a new VM should connect to Azure Key Vault without saved service principal credentials. “Azure Compute Gallery image versions with regional replication” would not satisfy that requirement; the supported action is “A system-assigned or user-assigned managed identity”. Managed identities provide Azure-hosted credential flows for supported services.

Image versions provide controlled reusable artifacts for VM deployment. In this case, a new VM should connect to Azure Key Vault without saved service principal credentials. “Publish versioned images through Azure Compute Gallery” would not satisfy that requirement; the supported action is “A system-assigned or user-assigned managed identity”. Managed identities provide Azure-hosted credential flows for supported services.

Encryption at host protects data processed on the host according to Azure feature capabilities. In this case, a new VM should connect to Azure Key Vault without saved service principal credentials. “Enable encryption at host when supported by the VM and region” would not satisfy that requirement; the supported action is “A system-assigned or user-assigned managed identity”. Managed identities provide Azure-hosted credential flows for supported services.

Encryption at host protects data processed on the host according to Azure feature capabilities. In this case, a VM has managed identity enabled but cannot read a vault secret. “Enable encryption at host when supported by the VM and region” would not satisfy that requirement; the supported action is “Grant the identity the relevant Key Vault data-plane permission”. Managed identity issuance alone does not authorize secret access.

Different encryption mechanisms protect different parts of VM storage processing. In this case, a VM has managed identity enabled but cannot read a vault secret. “Encryption at host versus disk server-side encryption scope” would not satisfy that requirement; the supported action is “Grant the identity the relevant Key Vault data-plane permission”. Managed identity issuance alone does not authorize secret access.

Image versions provide controlled reusable artifacts for VM deployment. In this case, a VM has managed identity enabled but cannot read a vault secret. “Publish versioned images through Azure Compute Gallery” would not satisfy that requirement; the supported action is “Grant the identity the relevant Key Vault data-plane permission”. Managed identity issuance alone does not authorize secret access.