AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Policy to enforce governance rules across its Azure subscriptions. The security team wants to ensure that all virtual machines deployed in a subscription must be of an approved size from a predefined list. If a user attempts to deploy a virtual machine with a size not on the list, the deployment must be immediately blocked. Which Azure Policy effect should the company use in the policy definition?
⚠ Common exam trap
Many exam-takers confuse 'Deny' with 'Audit' because both deal with non-compliance, but 'Audit' only logs violations without blocking, which fails the explicit requirement to immediately block the deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The 'Deny' effect is correct because it actively blocks any deployment that violates the policy rule, such as deploying a virtual machine with a size not on the approved list. This effect evaluates the request during resource creation or update and denies it if the condition is met, ensuring immediate enforcement. In contrast, other effects like 'Audit' only log non-compliant resources without blocking them, which does not meet the security team's requirement to prevent unauthorized VM sizes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deny
Why this is correct
The 'Deny' effect in Azure Policy actively blocks any resource creation or update that violates the policy definition, returning an error in the deployment or API call. For a disallowed VM size, Deny prevents the VM from being provisioned entirely, ensuring the security team's requirement is enforced before the resource exists. This effect is evaluated during resource creation/update and cannot be bypassed by the resource provider, making it the only option that truly stops non-compliant deployments.
- ✗
Audit
Why it's wrong here
The 'Audit' effect creates a warning event in the activity log when a non-compliant resource is created or updated, but it does not block the operation. The deployment would still succeed, which does not meet the requirement to block disallowed VM sizes.
When this WOULD be correct
Use Audit when you want to evaluate compliance and log violations without impacting existing or new deployments, such as auditing whether all VMs use managed disks for reporting purposes.
- ✗
DeployIfNotExists
Why it's wrong here
The 'DeployIfNotExists' effect automatically deploys a resource (such as an extension or a configuration) to make a non-compliant resource compliant. It does not block the initial deployment of a non-compliant resource, so it would not prevent the creation of a VM with a disallowed size.
When this WOULD be correct
A policy must automatically deploy a missing extension (e.g., anti-malware) to existing VMs that lack it, without blocking the initial deployment. DeployIfNotExists would be correct to remediate non-compliance after creation.
- ✗
Append
Why it's wrong here
The 'Append' effect adds additional fields (such as tags) to the resource during creation or update. It does not block the deployment; it modifies the resource to include the appended fields. It would not prevent the creation of a VM with a disallowed size.
When this WOULD be correct
A company wants to automatically add a specific tag (e.g., 'CostCenter') to all new virtual machines if the tag is missing during deployment. The Append effect would be correct to add the tag without blocking the deployment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DenyCorrect answer▾
Why this is correct
The 'Deny' effect in Azure Policy actively blocks any resource creation or update that violates the policy definition, returning an error in the deployment or API call. For a disallowed VM size, Deny prevents the VM from being provisioned entirely, ensuring the security team's requirement is enforced before the resource exists. This effect is evaluated during resource creation/update and cannot be bypassed by the resource provider, making it the only option that truly stops non-compliant deployments.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources without blocking deployment, so it does not prevent a VM with an unapproved size from being created.
★ When this WOULD be the correct answer
Use Audit when you want to evaluate compliance and log violations without impacting existing or new deployments, such as auditing whether all VMs use managed disks for reporting purposes.
Why candidates choose this
Candidates may think Audit is sufficient for enforcement because it flags non-compliance, but they overlook that it does not actively block the action.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists does not block deployments; it only remediates non-compliant resources after deployment. The question requires immediate blocking of unapproved VM sizes, which Deny provides.
★ When this WOULD be the correct answer
A policy must automatically deploy a missing extension (e.g., anti-malware) to existing VMs that lack it, without blocking the initial deployment. DeployIfNotExists would be correct to remediate non-compliance after creation.
Why candidates choose this
Candidates may confuse remediation actions with enforcement, thinking DeployIfNotExists can prevent deployments by modifying them, but it only acts post-deployment.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The Append effect adds additional fields or tags to a resource during deployment but does not block the deployment. In this scenario, the requirement is to immediately block deployments of unapproved VM sizes, which only the Deny effect can accomplish.
★ When this WOULD be the correct answer
A company wants to automatically add a specific tag (e.g., 'CostCenter') to all new virtual machines if the tag is missing during deployment. The Append effect would be correct to add the tag without blocking the deployment.
Why candidates choose this
Candidates may confuse Append with Deny because both can modify or restrict deployments, but Append only adds properties and does not prevent the resource from being created.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.