AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To automatically fix non-compliant resources to match the policy

  Why it's wrong here

  The audit effect in Azure Policy is purely observational; it evaluates resource configuration against the policy rule and updates the compliance state, but it does not invoke any remediation action. Automatically fixing non-compliant resources requires a different policy effect such as 'deployIfNotExists' or 'modify', and often a separate remediation task orchestrated by Azure Policy. Therefore, choosing this option misidentifies audit's behavior as active repair rather than passive reporting.

• ✓

  To evaluate and flag non-compliant resources without blocking them

  Why this is correct

  The audit effect evaluates resources against the policy definition and, when a resource doesn't meet the conditions, marks it as non-compliant in the Azure Policy compliance dashboard. Critically, it neither blocks the resource's creation nor changes its configuration; the resource remains operational and fully deployed. This makes audit ideal for measuring compliance posture and detecting drift without impacting existing or newly deployed workloads.

• ✗

  To deny creation of resources that don't comply with the policy

  Why it's wrong here

  To proactively prevent the deployment of non-compliant resources, Azure Policy uses the 'deny' effect, which returns an error during resource creation and blocks the operation. The audit effect, by contrast, allows the resource to be created or modified and simply records the resulting non-compliance for visibility. Because audit does not enforce a hard block, relying on it cannot fulfill a requirement to deny non-compliant deployments.

• ✗

  To send security alerts when resources are modified

  Why it's wrong here

  Azure Policy's audit effect does not generate security alerts; it surfaces policy evaluation results, such as a resource being out of compliance with a tagging or security rule. Security alerts for suspicious activities, vulnerabilities, or threat detections are emitted by Microsoft Defender for Cloud, which integrates with Azure Policy but operates as a separate security monitoring service. Thus, equating audit with alerting conflates policy compliance reporting with a security operations function.

Go deeper

Related to this question