hardMultiple ChoiceObjective-mapped

AZ-400 Practice Question: Refer to the exhibit

Exhibit

{
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Compute/virtualMachines"
      },
      {
        "field": "Microsoft.Compute/virtualMachines/sku.name",
        "like": "Standard_D*"
      }
    ]
  },
  "then": {
    "effect": "deny"
  }
}

Refer to the exhibit. You apply this Azure Policy to a subscription. A developer attempts to deploy a VM with SKU Standard_D2s_v3. What is the result?

⚠ Common exam trap

Candidates often confuse the 'match' and 'notMatch' conditions. A 'notMatch' condition denies only when the field does NOT match the pattern, while a 'match' condition denies when it DOES match. Here, the SKU matches, so the deployment is allowed.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The deployment is allowed because the SKU matches the pattern.

The policy uses a deny effect with a notMatch condition on the VM SKU field, matching the pattern 'Standard_D*'. Since the attempted SKU 'Standard_D2s_v3' matches the pattern, the condition evaluates to false, so the deny effect does NOT apply. The deployment is allowed. The 'deny' effect only blocks when the condition is true, which would be for SKUs that do NOT match the pattern.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The deployment is denied only if the VM is in a specific resource group.
Why it's wrong here
The policy's condition evaluates the VM's SKU name and type, not its resource group. The deny effect applies to any deployment in the subscription scope that matches the 'Standard_D*' SKU pattern, regardless of the target resource group.
✗
The deployment is denied because the SKU matches the pattern.
Why it's wrong here
Correct. The condition matches VM type and SKU name starting with 'Standard_D', so the deny effect blocks the deployment.
✓
The deployment is allowed because the SKU matches the pattern.
Why this is correct
Under a policy with the 'deny' effect, any deployment that satisfies the condition—VM type 'Microsoft.Compute/virtualMachines' and SKU name starting with 'Standard_D'—is blocked at deployment time. Matching the pattern triggers the deny action, not approval or allowance.
✗
The deployment is allowed and a non-compliance event is logged.
Why it's wrong here
Because the policy effect is 'deny', the deployment is rejected before any resource is created; no non-compliance event is logged because the resource never exists. The deny effect is an active enforcement action, not a passive audit that logs non-compliant resources after creation.

Go deeper

AZ-400 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question