Implement Azure security →mediumMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

Exhibit

{
  "properties": {
    "mode": "Indexed",
    "parameters": {
      "allowedLocations": {
        "type": "array",
        "defaultValue": [
          "eastus",
          "westus"
        ]
      }
    },
    "policyRule": {
      "if": {
        "not": {
          "field": "location",
          "in": "[parameters('allowedLocations')]"
        }
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

Refer to the exhibit. You are reviewing an Azure Policy definition. When applied to a subscription, what is the effect of this policy?

⚠ Common exam trap

The trap here is that candidates misread the condition logic—the 'notEquals' combined with 'or' for allowed regions means the deny triggers for any location that is not in the allowed list, not for the allowed locations themselves.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deny deployment of resources in locations other than eastus or westus

The policy definition uses the 'deny' effect with a condition that evaluates to true when the resource location is not equal to 'eastus' or 'westus'. This means any deployment attempt to a region outside these two will be blocked. The 'deny' effect prevents the resource creation entirely, rather than just auditing or modifying it.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Audit resources in locations other than eastus or westus
Why it's wrong here
This option is incorrect because the Azure Policy definition's 'effect' property determines its action upon non-compliance. If the policy's effect is 'deny', it actively blocks resource deployment or updates that violate the rules, rather than merely logging them for review. An 'audit' effect would allow the resource to be created while flagging it as non-compliant, which is not what a 'deny' policy does.
✗
Append a tag to resources in eastus or westus
Why it's wrong here
This option is incorrect as it misidentifies the policy's primary action. An 'append' effect in Azure Policy is used to add or update specified fields or tags to resources during creation or update, ensuring consistency. However, the policy described has a 'deny' effect, which means its purpose is to prevent resource deployment altogether if the specified conditions are not met, not to modify or add properties to them.
✗
Deny deployment of resources in eastus or westus
Why it's wrong here
This option is incorrect because it misinterprets the logical condition of the policy. The policy likely uses a 'notIn' operator for the 'location' field against a list containing 'eastus' and 'westus'. This means the policy would deny deployment if the resource's location is *not* found within that allowed list, rather than denying deployments *in* those specific regions. It enforces exclusion, not inclusion for denial.
✓
Deny deployment of resources in locations other than eastus or westus
Why this is correct
This option is correct because it accurately describes both the effect and the condition of the Azure Policy. The 'deny' effect prevents the creation or update of resources that violate the policy rules. When combined with a condition that specifies 'location notIn ['eastus', 'westus']', the policy will block any attempt to deploy resources into any Azure region other than East US or West US, ensuring strict regional compliance.

Go deeper

AZ-204 Implement Azure security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question