AZ-900 Describe Azure management and governance Practice Question
A company has a policy that all Azure Storage accounts must have diagnostic settings enabled to send logs and metrics to a specific Log Analytics workspace. The governance team wants to automatically configure these diagnostic settings when a new storage account is created, without blocking the initial creation. The solution must not require manual intervention. Which Azure Policy effect should the team use in their policy definition?
⚠ Common exam trap
Many candidates choose Audit thinking it will automatically fix the issue, or Deny thinking it will enforce compliance, but only DeployIfNotExists provides automatic remediation without blocking creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeployIfNotExists
The DeployIfNotExists effect is correct because it automatically deploys a remediation task to configure diagnostic settings on storage accounts that lack them, without blocking the initial creation of the resource. This effect evaluates resources after creation and triggers a deployment to bring non-compliant resources into compliance, which aligns with the requirement for automatic configuration without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeployIfNotExists
Why this is correct
DeployIfNotExists is the correct effect because it automatically deploys a diagnostic setting to any Azure Storage account that is missing one during policy evaluation. When the policy assignment's managed identity has the necessary Azure RBAC permissions (e.g., Storage Account Contributor or Monitor Contributor), it creates the diagnostic setting without blocking the storage account's creation. This effect also supports remediation tasks to fix existing non-compliant accounts, ensuring the policy requirement is enforced continuously.
- ✗
Audit
Why it's wrong here
The Audit effect generates a compliance log entry whenever a storage account without diagnostic settings is found, but it performs no deployment or modification. It only signals that the resource does not meet the policy condition, leaving the diagnostic setting absent. Because the requirement is to enforce automatic configuration, Audit alone cannot satisfy it—it lacks any mechanism to add the missing diagnostic setting.
When this WOULD be correct
Audit would be correct if the question asked to identify noncompliant storage accounts without automatically remediating them, such as for compliance reporting or manual follow-up.
- ✗
Deny
Why it's wrong here
Deny prevents the creation of resources that do not meet the policy condition. In this case, it would block the creation of a storage account that lacks diagnostic settings, which contradicts the requirement to allow creation and then automatically configure.
When this WOULD be correct
If the policy required that all storage accounts must have diagnostic settings enabled and any non-compliant account should be prevented from being created, then Deny would be the correct effect.
- ✗
Append
Why it's wrong here
Append is used to add additional fields or properties to an existing resource during creation or update, such as adding a tag. It cannot deploy a separate resource like a diagnostic setting, so it is not suitable for this scenario.
When this WOULD be correct
Append would be correct if the policy needed to add a required tag (e.g., 'Environment: Production') to all new storage accounts without blocking creation, and the tag value could be set via a simple field addition.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DeployIfNotExistsCorrect answer▾
Why this is correct
DeployIfNotExists is the correct effect because it automatically deploys a diagnostic setting to any Azure Storage account that is missing one during policy evaluation. When the policy assignment's managed identity has the necessary Azure RBAC permissions (e.g., Storage Account Contributor or Monitor Contributor), it creates the diagnostic setting without blocking the storage account's creation. This effect also supports remediation tasks to fix existing non-compliant accounts, ensuring the policy requirement is enforced continuously.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs noncompliance but does not automatically configure diagnostic settings. The requirement is to automatically configure settings without blocking creation, which requires a deployment effect like DeployIfNotExists.
★ When this WOULD be the correct answer
Audit would be correct if the question asked to identify noncompliant storage accounts without automatically remediating them, such as for compliance reporting or manual follow-up.
Why candidates choose this
Candidates may think Audit is sufficient for governance because it detects violations, but they overlook the need for automatic remediation specified in the question.
✗DenyWrong answer — click to see why▾
Why this is wrong here
The Deny effect would block the creation of storage accounts that do not have diagnostic settings configured, which violates the requirement to not block initial creation.
★ When this WOULD be the correct answer
If the policy required that all storage accounts must have diagnostic settings enabled and any non-compliant account should be prevented from being created, then Deny would be the correct effect.
Why candidates choose this
Candidates may think Deny is necessary to enforce compliance, but they overlook the requirement that creation should not be blocked, only automatically configured.
✗AppendWrong answer — click to see why▾
Why this is wrong here
Append adds configuration to a resource during creation or update, but it cannot deploy a diagnostic setting to a Log Analytics workspace; it only modifies resource properties like tags or policies. The requirement to send logs to a specific workspace requires deploying a resource, which Append cannot do.
★ When this WOULD be the correct answer
Append would be correct if the policy needed to add a required tag (e.g., 'Environment: Production') to all new storage accounts without blocking creation, and the tag value could be set via a simple field addition.
Why candidates choose this
Candidates may confuse Append with DeployIfNotExists because both can modify resources, but Append only adds properties, not deploy new resources like diagnostic settings.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Log Analytics
Log Analytics is a cloud-based service that collects, analyzes, and visualizes machine-generated log data from various sources to help IT teams monitor systems and troubleshoot issues.
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.