Design identity, governance, and monitoring solutions →hardMultiple Choice

AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Exhibit

Refer to the exhibit.
```json
{
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        {
          "field": "Microsoft.Compute/virtualMachines/sku",
          "like": "Standard_D*"
        },
        {
          "not": {
            "field": "Microsoft.Compute/virtualMachines/licenseType",
            "exists": true
          }
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}
```

You are tasked with ensuring that all VMs in the subscription have Azure Hybrid Benefit enabled for Windows Server. You create the Azure Policy shown in the exhibit. However, after assignment, the compliance report shows that some D-series VMs are still non-compliant. What is the most likely cause?

⚠ Common exam trap

Many exam-takers assume Azure Policy automatically applies to all resources in scope, but they overlook the fundamental difference between 'deny' (only blocks new/updated resources) and 'deployIfNotExists'/'modify' (can remediate existing resources).

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not apply to existing resources; it only blocks new or updated ones.

Azure Policy with the 'deny' effect only blocks new or updated resources that violate the policy; it does not automatically remediate existing non-compliant resources. The D-series VMs were likely created before the policy was assigned, so they remain non-compliant until they are redeployed or a remediation task is triggered. To enforce compliance on existing resources, you would need to use a 'deployIfNotExists' or 'modify' effect with a remediation task.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The 'deny' effect is incorrectly configured; it should be 'audit' to show compliance.
Why it's wrong here
The 'deny' effect is correctly configured for a compliance policy whose goal is to block non-compliant deployments; 'audit' would only log the outcome to the activity log without preventing the VM SKU from being created. The real problem is that deny enforcement only happens at resource creation or update time, so pre-existing VMs that are already using wrong SKUs are evaluated as non-compliant but are not altered. Switching to audit therefore makes the situation worse, not better, because it removes even the block on new non-compliant resources.
✓
The policy does not apply to existing resources; it only blocks new or updated ones.
Why this is correct
Azure Policy's deny effect operates during create and update operations through the Azure Resource Manager, but it never retroactively changes or removes existing resources. When the policy is assigned, existing VMs are scanned for compliance and will show as 'Non-compliant,' yet they remain running because deny only prevents a request from succeeding. To make existing VMs compliant, you must pair the policy with a DeployIfNotExists/Modify remediation task or manually redeploy them with the approved SKU.
✗
The 'like' operator does not match standard D-series SKUs.
Why it's wrong here
The 'like' condition uses wildcard matching, so the pattern 'Standard_D*' matches every SKU that begins with 'Standard_D', including Standard_D1_v2, Standard_D2s_v3, and Standard_D4s_v3; there is no formatting or operator error here. The policy's condition is not the reason VMs remain non-compliant. Even when the pattern correctly identifies the non-compliant SKUs, the deny effect cannot change those VMs after they already exist.
✗
The policy is scoped to a management group that excludes the resource group containing the VMs.
Why it's wrong here
The exhibit shows only the policy rule, not where the policy is assigned, so you cannot infer that the management group scope excludes the resource group. A policy assignment at a management group applies to all eligible subscriptions and resource groups within that hierarchy unless explicit exclusions are configured. Because no scope information is provided, the more concrete and demonstrable flaw is that deny does not remediate the existing VMs, regardless of whether the assignment scope is correct.

Go deeper

AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question