Design identity, governance, and monitoring solutions →easyMultiple Choice

AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Exhibit

Refer to the exhibit.

{
  "name": "my-policy",
  "properties": {
    "policyRule": {
      "if": {
        "field": "Microsoft.Sql/servers/administratorLogin",
        "exists": "false"
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

Refer to the exhibit. You assign this Azure Policy to a resource group. A user attempts to create a new Azure SQL Server without specifying an administrator login. What will happen?

⚠ Common exam trap

Many exam-takers assume Azure SQL Server has a default administrator login or that the policy would only generate an alert, but Azure Policy's 'deny' effect proactively blocks non-compliant resource creation, not just reports on it.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The SQL Server creation is denied.

The Azure Policy assigned to the resource group includes a condition that checks if the 'administratorLogin' property is missing or null when creating a SQL Server. Since the user does not specify an administrator login, the condition evaluates to true, triggering the 'deny' effect. This prevents the creation of the SQL Server entirely, as Azure Policy enforces compliance before the resource is provisioned.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The SQL Server is created with a default administrator login.
Why it's wrong here
The 'deny' effect in Azure Policy causes Azure Resource Manager to reject the deployment before any resource properties, including a default administrator login, are applied. Since the SQL Server resource is never provisioned, no administrator login is created or assigned. Azure Policy cannot supply or substitute a default value; it only evaluates and enforces the defined condition.
✓
The SQL Server creation is denied.
Why this is correct
When the policy condition detects that the `administratorLogin` field is absent, the `deny` effect is triggered during policy evaluation, causing the deployment request to fail. Azure Resource Manager enforces this policy before the SQL Server is provisioned, so the creation operation is blocked and no resource is created. This is a hard enforcement action, not a soft warning.
✗
The policy is ignored because the condition is not met.
Why it's wrong here
The policy is not ignored because the condition checks whether the `administratorLogin` field exists, and in this scenario the field is missing, making the condition true. When the condition evaluates to true, the policy's deny effect must be applied. An ignore or 'not met' outcome would only be valid if the field were present or the condition expression evaluated to false.
✗
The SQL Server is created but a compliance alert is generated.
Why it's wrong here
A compliance alert would only be generated by effects such as `audit` or `AuditIfNotExists`, not by this policy's `deny` effect. Because the effect is `deny`, Azure Policy actively blocks the creation of the SQL Server, so there is no compliant or non-compliant resource to generate an alert for. The result is an aborted deployment, not a created resource with a compliance flag.

Go deeper

AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question