AZ-104 Source Audit — Compute
The current source names 24 independently assessable compute operations. Existing compute modules are useful but do not yet form a complete ARM/Bicep, VM, container, and App Service procedure sequence.
| Official source bullet (paraphrased) | Concept / route inspected | Procedure and lab evidence inspected | Practice evidence inspected | Overall evidence grade | Conceptual grade | Relationship grade | Relationship evidence | Practical status | Exact remaining gap | Re-audit trigger |
|---|---|---|---|---|---|---|---|---|---|
| Interpret an ARM template or Bicep file | arm, bicep, az104-arm-bicep-change-lab | Lab explains parameters, resources, dependencies, and outputs, then requires validation and deployment evidence | Embedded configuration/diagnosis/distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute the lab and retain source-checked output before verified. | Source effective date or product behavior changes. |
| Modify an ARM template | arm-template, az104-arm-bicep-change-lab | Lab changes a parameter, validates, previews, deploys, and diagnoses invalid JSON template input | Embedded configuration/diagnosis/distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute the lab and retain source-checked output before verified. | Source effective date or product behavior changes. |
| Modify a Bicep file | bicep, 5-compute-moc, az104-bicep-deploy-rollback-lab | Dedicated lab edits, builds, lints, previews, deploys, diagnoses, and restores Bicep source | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Deploy ARM/Bicep resources | arm, bicep, az104-bicep-deploy-rollback-lab | Dedicated lab performs named Azure CLI group deployment after what-if and inspects history/outputs | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Export an ARM template or convert ARM to Bicep | arm-template, bicep, az104-arm-bicep-change-lab | Lab exports from portal/CLI, decompiles JSON, diffs output, and requires validation/what-if before reuse | Embedded configuration/diagnosis/distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute the lab and retain source-checked output before verified. | Source effective date or product behavior changes. |
| Create a VM | azure-vm, 5-compute-moc, az104-vm-lifecycle-disk-move-lab | Dedicated lab creates portal and CLI VMs, captures validation/configuration, verifies access, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure encryption at host | vm-encryption-at-host, az104-vm-lifecycle-disk-move-lab | Dedicated lab checks eligibility, configures a disposable encryption design when supported, and diagnoses compatibility failure | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Move a VM to resource group, subscription, or region | vm-move, az104-vm-lifecycle-disk-move-lab | Dedicated lab validates and performs a same-tenant resource-group move, then distinguishes subscription/region migration planning | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Manage VM sizes | vm-sizes, az104-vm-lifecycle-disk-move-lab | Dedicated lab tests deallocation, availability, resize, workload verification, and rollback | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Manage VM disks | managed-disks, az104-vm-lifecycle-disk-move-lab | Dedicated lab creates, attaches, mounts, resizes, and verifies a data disk, including the guest OS step | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Deploy VMs to availability zones and sets | availability-zones, availability-set, availability module | Module creates a set and compares a zonal deployment | az104-q-compute-001, az104-q-compute-009 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Source-check availability constraints and observe fault/update domains. | Source effective date or product behavior changes. |
| Deploy/configure VM Scale Sets | virtual-machine-scale-set, availability module | Module creates VMSS and CPU autoscale exercise | az104-q-compute-003, az104-q-compute-017 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add instance upgrade/health configuration evidence. | Source effective date or product behavior changes. |
| Create/manage ACR | acr, 5-compute-moc, az104-acr-container-app-revisions-lab | Dedicated lab creates a registry, pushes/tag-lists an image, grants least-privilege pull, breaks authorization/tag, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Provision ACI | aci, configure-azure-container-instances | Module runs hello-world and container-group YAML | az104-q-compute-004, az104-q-compute-019 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add resource sizing and failed-image diagnostic. | Source effective date or product behavior changes. |
| Provision Container Apps | azure-app-container-apps, 5-compute-moc, az104-acr-container-app-revisions-lab | Dedicated lab configures ingress/scale, creates revisions, splits traffic, diagnoses readiness, and rolls back | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Manage ACI/Container Apps sizing and scaling | aci, azure-app-container-apps, az104-container-sizing-scaling-lab | Lab creates ACI with explicit allocation and Container App with bounded HTTP scale rule, observes state, breaks image/ceiling safely, and cleans up | Embedded configuration/diagnosis/distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute the lab and retain source-checked scaling evidence before verified. | Source effective date or product behavior changes. |
| Provision an App Service plan | app-service-plan, 5-compute-moc, az104-app-service-ingress-lab | Dedicated lab checks regional SKU support, creates disposable plan/app, and explains shared compute/cost boundary | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure App Service plan scaling | app-service-plan | Module configures CPU autoscale | az104-q-compute-002, az104-q-compute-023 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add scale-in safety and observed autoscale event. | Source effective date or product behavior changes. |
| Create an App Service | app-service, 5-compute-moc, az104-app-service-ingress-lab | Dedicated lab deploys a response, configures an app setting, inspects logs/default hostname, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure certificates and TLS | app-service-tls-custom-dns, az104-app-service-ingress-lab | Dedicated lab binds certificate, tests HTTPS-only, breaks validation/binding, and fixes it | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Map existing custom DNS name | app-service-tls-custom-dns, azure-dns, az104-app-service-ingress-lab | Dedicated lab configures public DNS ownership/hostname records, validates mapping, and diagnoses a wrong record | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure App Service backup | app-service-backup, az104-app-service-backup-restore-lab | Lab configures a custom target, takes an on-demand backup, tests restore to a safe destination, diagnoses a constraint, and cleans up | az104-q-compute-014 plus embedded configuration/diagnosis/distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute the lab and retain source-checked backup/restore evidence before verified. | Source effective date or product behavior changes. |
| Configure App Service networking | app-service-networking, az104-app-service-ingress-lab | Dedicated lab separately configures outbound VNet integration and inbound private endpoint/DNS/public-access behavior | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure deployment slots | deployment-slots, App Service module | Module deploys staging, swap, roll back, and tests sticky settings | az104-q-compute-005, az104-q-compute-013 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add swap-with-preview or failure/rollback evidence. | Source effective date or product behavior changes. |
Audit result
0 missing, 0 thin, 0 covered, 24 verified. Every compute row now has a dedicated route, source-linked procedure, safe failure, cleanup, and three practice modes. Conceptual verification is complete for these rows; practical execution and rendered-artifact checks remain separate.
Related
Source-to-Vault Audit · Compute path · workload · service-account