Describe Azure management and governance →mediumMultiple ChoiceObjective-mapped

AZ-900 Describe Azure management and governance Practice Question

A company uses Azure Policy to enforce governance. They want to prevent users from creating virtual machines of the Standard_DS3_v2 SKU in their subscription, and they also want to log any attempt to create such a VM (whether successful or not) for audit purposes. What is the minimum number of Azure Policy assignments required to meet both requirements?

⚠ Common exam trap

A common mix-up: candidates assume a single policy can have multiple effects or that the Audit effect alone can both log and block, but Azure Policy strictly enforces one effect per definition, requiring separate assignments for deny and audit actions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Two – assign one policy definition with the Deny effect and another with the Audit effect.

Azure Policy can only enforce a single effect per policy definition. To both deny the creation of Standard_DS3_v2 VMs and log all attempts (successful or denied) for audit, you need two separate policy assignments: one with the Deny effect to block the action, and another with the Audit effect to log the attempt. A single policy cannot combine both effects, as each definition is limited to one effect type.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
One – assign a policy definition with the Deny effect.
Why it's wrong here
A single Deny effect prevents creation but does not produce a separate compliance state for audit purposes; it only logs a denial event. The requirement explicitly asks for logging attempts for audit, which is more clearly satisfied by an Audit effect.
When this WOULD be correct
If the requirement was only to prevent creation of Standard_DS3_v2 VMs, with no audit logging requirement, one Deny policy assignment would suffice.
✗
One – assign a policy definition with the Audit effect.
Why it's wrong here
The Audit effect records resource creation attempts and flags them as non-compliant in Azure Policy's compliance dashboard, but it does not intercept or deny the deployment. Azure Resource Manager will still provision the VM if it meets all other requirements, so relying solely on Audit fails the requirement to block forbidden VM SKUs. The resulting compliance state would show a non-compliant resource, but the resource exists, which means the governance control is purely reactive and not preventive.
When this WOULD be correct
If the requirement were only to log all attempts to create Standard_DS3_v2 VMs for audit purposes, without any need to block them, then a single policy assignment with the Audit effect would suffice.
✓
Two – assign one policy definition with the Deny effect and another with the Audit effect.
Why this is correct
Assigning two policies, one with Deny and one with Audit, simultaneously blocks forbidden VM SKU creation and provides a clear compliance view of all attempts (both successful and blocked) for auditing. This is the minimum configuration to satisfy both requirements.
✗
Two – assign one policy definition with the Deny effect and another with the Append effect.
Why it's wrong here
The Append effect adds or modifies resource properties (such as tags or inherited settings) at deployment time, but it neither prevents the deployment nor generates a dedicated compliance state for audit purposes. Combining Deny with Append means the VM SKU is blocked by Deny, but Append contributes nothing toward logging attempts or producing audit-visible compliance records—it only handles configuration drift. Because the requirement explicitly asks for logging attempts for audit, this combination still lacks the Audit effect, which is the only effect designed to create a distinct non-compliant state for review.
When this WOULD be correct
If the requirement were to prevent creation of Standard_DS3_v2 VMs and automatically add a tag (e.g., 'forbidden') to any such VM that is created despite the deny policy, then one Deny policy and one Append policy would be correct. The Append effect would modify the resource to include the tag for tracking.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

✓Two – assign one policy definition with the Deny effect and another with the Audit effect.Correct answer▾

Why this is correct

Assigning two policies, one with Deny and one with Audit, simultaneously blocks forbidden VM SKU creation and provides a clear compliance view of all attempts (both successful and blocked) for auditing. This is the minimum configuration to satisfy both requirements.

✗One – assign a policy definition with the Deny effect.Wrong answer — click to see why▾

Why this is wrong here

A single policy with Deny effect prevents VM creation but does not log attempts; logging requires a separate Audit effect policy.

★ When this WOULD be the correct answer

If the requirement was only to prevent creation of Standard_DS3_v2 VMs, with no audit logging requirement, one Deny policy assignment would suffice.

Why candidates choose this

Candidates may think a single policy can both deny and log, but Azure Policy effects are mutually exclusive per assignment.

✗One – assign a policy definition with the Audit effect.Wrong answer — click to see why▾

Why this is wrong here

The Audit effect only logs the attempt but does not prevent the creation of Standard_DS3_v2 VMs, so it fails to meet the requirement to block such VMs.

★ When this WOULD be the correct answer

If the requirement were only to log all attempts to create Standard_DS3_v2 VMs for audit purposes, without any need to block them, then a single policy assignment with the Audit effect would suffice.

Why candidates choose this

Candidates may think a single policy can both deny and audit, but Azure Policy assigns a single effect per definition; they might overlook that two separate assignments are needed for distinct effects.

✗Two – assign one policy definition with the Deny effect and another with the Append effect.Wrong answer — click to see why▾

Why this is wrong here

The Append effect adds additional fields or tags to a resource during creation or update, but it does not log attempts for audit purposes. The question requires logging any attempt (successful or not), which only the Audit effect provides.

★ When this WOULD be the correct answer

If the requirement were to prevent creation of Standard_DS3_v2 VMs and automatically add a tag (e.g., 'forbidden') to any such VM that is created despite the deny policy, then one Deny policy and one Append policy would be correct. The Append effect would modify the resource to include the tag for tracking.

Why candidates choose this

Candidates may confuse Append with Audit, thinking that Append can also log changes because it modifies resources, but Append does not generate audit logs for denied or attempted actions.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

AZ-900 Describe Azure management and governance Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

AWS S3 Storage Class Comparison

Related to this question