Describe Azure management and governance →mediumMultiple ChoiceObjective-mapped

AZ-900 Describe Azure management and governance Practice Question

A company has an Azure Policy assignment that denies the creation of any virtual machine (VM) that does not have a mandatory 'CostCenter' tag. A development team needs to deploy a temporary test VM without the required tag for a short-term experiment. The governance team wants to allow this specific exception while recording the reason for the exception, ensuring the policy is still enforced for all other resources. The exception must also automatically expire after 30 days. Which Azure Policy feature should the governance team use?

⚠ Common exam trap

Test-takers frequently confuse 'Exclusion scope' (which permanently removes resources from policy evaluation without logging) with 'Exemption' (which provides a recorded, time-bound exception), leading them to choose the wrong feature for temporary, auditable exceptions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Exemption

Azure Policy Exemption allows the governance team to create a specific exception for the test VM while recording the reason and setting an automatic expiration date (30 days). Unlike exclusion scopes, exemptions are explicitly designed to handle scenarios where a resource should be excluded from policy evaluation with a defined justification and expiry, ensuring the policy remains enforced for all other resources.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Exclusion scope
Why it's wrong here
This is incorrect because an exclusion completely removes the scope from policy evaluation. If you apply an exclusion to a resource group, the policy is not evaluated at all for resources in that group, and no compliance data is gathered. This does not meet the requirement to record the reason for the exception or to enforce the policy on other resources within the same scope.
When this WOULD be correct
An exclusion scope would be correct if the question required allowing all resources in a specific resource group or subscription to bypass the policy entirely, without needing to record reasons or set an expiration.
✓
Exemption
Why this is correct
This is correct because an exemption allows resources to be evaluated by the policy but marks them as exempt. You can provide a rationale, set an expiration date, and categorize the exemption (e.g., 'Mitigated' or 'Waiver'). The policy remains enforced for all other resources, and the exemption is visible in compliance reports for auditing.
✗
Audit effect
Why it's wrong here
This is incorrect because the Audit effect is a property of a policy definition, not a feature applied to a resource or scope. It changes how the policy behaves when non-compliance is detected (audit vs deny). In this scenario, the existing policy uses the Deny effect, and changing it to Audit would alter enforcement for all resources, not just the specific test VM. Also, the Audit effect does not provide a mechanism to record an exception reason or expiration.
When this WOULD be correct
An exam scenario where the goal is to monitor compliance without enforcement, such as 'A company wants to identify VMs missing a tag for reporting purposes, but not block their creation.'
✗
Override effect
Why it's wrong here
The 'Override effect' is not a valid Azure Policy effect; it is a fabricated term designed to sound plausible. Azure Policy supports effects such as Deny, Audit, Append, AuditIfNotExists, DeployIfNotExists, and Modify—each with specific behaviors during evaluation. Since 'Override' does not exist in the policy engine, it cannot be used to handle exceptions, and selecting it would have no technical basis in Azure Resource Manager. For managing exceptions to a Deny policy, the only valid mechanisms are policy exemptions (which retain compliance metadata) or scope exclusions (which remove evaluation entirely).
When this WOULD be correct
In a scenario where a custom policy definition or Azure RBAC role includes an 'Override' permission that allows bypassing a policy for specific users or groups, and the question asks about granting temporary bypass permissions to a specific team.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

✓ExemptionCorrect answer▾

Why this is correct

This is correct because an exemption allows resources to be evaluated by the policy but marks them as exempt. You can provide a rationale, set an expiration date, and categorize the exemption (e.g., 'Mitigated' or 'Waiver'). The policy remains enforced for all other resources, and the exemption is visible in compliance reports for auditing.

✗Exclusion scopeWrong answer — click to see why▾

Why this is wrong here

Exclusion scope removes the policy assignment from a subscription or resource group entirely, which would allow all resources without the tag, not just a specific VM, and does not support automatic expiration or recording reasons.

★ When this WOULD be the correct answer

An exclusion scope would be correct if the question required allowing all resources in a specific resource group or subscription to bypass the policy entirely, without needing to record reasons or set an expiration.

Why candidates choose this

Candidates may confuse 'exclusion' with 'exemption' because both involve making exceptions, but they don't realize exclusion is broader and lacks the tracking and expiration features needed for a controlled exception.

✗Audit effectWrong answer — click to see why▾

Why this is wrong here

The Audit effect evaluates resources and logs compliance without blocking creation, but the question requires denying non-compliant VMs and allowing a specific exception with expiration, which is not possible with Audit.

★ When this WOULD be the correct answer

An exam scenario where the goal is to monitor compliance without enforcement, such as 'A company wants to identify VMs missing a tag for reporting purposes, but not block their creation.'

Why candidates choose this

Candidates may confuse Audit with Exemption because both can record reasons, but Audit lacks the ability to allow an exception to a deny policy.

✗Override effectWrong answer — click to see why▾

Why this is wrong here

The Override effect is not a valid Azure Policy effect; Azure Policy supports effects like Deny, Audit, Append, etc., but not Override. Therefore, it cannot be used to create a time-bound exception.

★ When this WOULD be the correct answer

In a scenario where a custom policy definition or Azure RBAC role includes an 'Override' permission that allows bypassing a policy for specific users or groups, and the question asks about granting temporary bypass permissions to a specific team.

Why candidates choose this

The term 'Override' intuitively suggests the ability to bypass or supersede a policy, leading candidates to incorrectly assume it is a valid Azure Policy feature for creating exceptions.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-900 Describe Azure management and governance Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question