AZ-900 Describe Azure management and governance Practice Question
A company has an Azure subscription used by several development teams. The governance team wants to identify any virtual machines that are not tagged with a mandatory 'CostCenter' tag. The team does not want to block the creation of untagged VMs; they only want to report on non-compliant resources in Azure Policy's compliance dashboard. Which Azure Policy effect should they use in their policy definition?
⚠ Common exam trap
Watch out — candidates often confuse 'Audit' with 'Deny' because they assume any policy effect must block non-compliant resources, but Azure Policy's Audit effect is specifically designed for reporting-only scenarios without enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit
The Audit effect is correct because it enables Azure Policy to evaluate resources against the policy rule and report non-compliant resources in the compliance dashboard without blocking resource creation or modification. Since the governance team only wants visibility into untagged VMs, Audit logs the non-compliance as a warning in the activity log and marks the resource as non-compliant, but does not prevent the VM from being deployed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The 'Deny' effect blocks the creation or modification of resources that do not comply with the policy. Since the team wants to allow untagged VMs to be created and only report on them, this effect is too restrictive.
When this WOULD be correct
Use Deny when the governance team requires that any virtual machine without the mandatory 'CostCenter' tag must be prevented from being created or updated, enforcing compliance proactively.
- ✓
Audit
Why this is correct
The Audit effect evaluates resources against the policy and, if a VM lacks required tags, logs a compliance warning in the Azure Activity Log and marks the resource as non-compliant in Azure Policy compliance reports. It does not block resource creation or modification, so development teams can continue to deploy untagged VMs while the subscription gains visibility into non-compliance. This matches the requirement to report on untagged VMs without enforcing tagging, making Audit the correct choice.
- ✗
Append
Why it's wrong here
The Append effect actively modifies a resource during creation or update by adding specified fields—such as a required tag—to bring the resource into compliance. This changes the resource configuration without the team's consent and enforces tagging rather than merely reporting on it, which directly contradicts the team's stated need to allow untagged VMs and only report on them. Append is a remediation effect, not a reporting effect, so it is too restrictive and fails the requirement.
When this WOULD be correct
Use Append when the policy must automatically add a missing mandatory tag (e.g., 'CostCenter') to resources during creation or update, ensuring compliance without manual intervention.
- ✗
Disabled
Why it's wrong here
The Disabled effect turns off the policy definition entirely, meaning Azure Policy performs no evaluation, logs no compliance warnings, and generates no compliance reports for the specified tagging rule. This would provide no visibility into which VMs are untagged, failing the team's explicit requirement to report on non-compliance. Unlike Audit, which actively evaluates and logs non-compliance, Disabled yields zero governance feedback, so it is not suitable for this scenario.
When this WOULD be correct
A scenario where the governance team wants to temporarily deactivate a policy without deleting it, for example during maintenance or testing, while keeping the policy definition for future use.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AuditCorrect answer▾
Why this is correct
The Audit effect evaluates resources against the policy and, if a VM lacks required tags, logs a compliance warning in the Azure Activity Log and marks the resource as non-compliant in Azure Policy compliance reports. It does not block resource creation or modification, so development teams can continue to deploy untagged VMs while the subscription gains visibility into non-compliance. This matches the requirement to report on untagged VMs without enforcing tagging, making Audit the correct choice.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny blocks the creation or update of non-compliant resources, but the question states the team does not want to block creation, only report on non-compliance.
★ When this WOULD be the correct answer
Use Deny when the governance team requires that any virtual machine without the mandatory 'CostCenter' tag must be prevented from being created or updated, enforcing compliance proactively.
Why candidates choose this
Candidates may think Deny is the standard effect for policy enforcement, overlooking the specific requirement to only report without blocking.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The Append effect adds a tag or value to a resource during creation or update, but the question requires only reporting on non-compliant VMs without modifying them. Append would alter the resource, which is not desired.
★ When this WOULD be the correct answer
Use Append when the policy must automatically add a missing mandatory tag (e.g., 'CostCenter') to resources during creation or update, ensuring compliance without manual intervention.
Why candidates choose this
Candidates may confuse Append with Audit because both can handle missing tags, but Append actively modifies resources, which seems like a proactive solution, though the question explicitly forbids blocking or altering VMs.
✗DisabledWrong answer — click to see why▾
Why this is wrong here
The 'Disabled' effect means the policy rule is not evaluated, so it cannot report non-compliant resources in the compliance dashboard. The question requires identifying untagged VMs without blocking creation, which 'Audit' does.
★ When this WOULD be the correct answer
A scenario where the governance team wants to temporarily deactivate a policy without deleting it, for example during maintenance or testing, while keeping the policy definition for future use.
Why candidates choose this
Candidates might think 'Disabled' is a safe way to avoid blocking VM creation while still having the policy in place, but it actually stops all evaluation, including reporting.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Dashboard
A dashboard is a visual display of key metrics and data points that helps IT professionals monitor, analyze, and manage systems or processes in real time.
Key term
Azure subscription
An Azure subscription is a logical container in Microsoft Azure that provides billing isolation and access boundaries for your cloud resources and services.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.