AZ-900 Describe Azure management and governance Practice Question
A company wants to enforce a governance policy that only allows virtual machines of the SKU 'Standard_DS2_v2' to be deployed in their Azure subscription. If a user attempts to create a virtual machine with a different SKU (e.g., 'Standard_D2s_v3'), the deployment must be immediately rejected with an error, and the resource must not be created. Which Azure Policy effect should the team use to implement this requirement?
⚠ Common exam trap
Watch out — candidates often confuse the Deny effect with Audit, thinking Audit can block deployments, but Audit only logs non-compliance without preventing resource creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The Deny effect is the correct choice because it actively prevents the creation or deployment of resources that do not comply with the policy rule. In this scenario, when a user attempts to deploy a virtual machine with a SKU other than 'Standard_DS2_v2', the Deny effect immediately rejects the request and blocks the resource from being created, ensuring the governance policy is enforced without exception.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deny
Why this is correct
The Deny effect is the correct choice because it actively prevents the resource provider from executing the create or update operation when the policy condition is not satisfied. In Azure Policy, Deny returns a 403 Forbidden response during deployment, causing the VM creation to fail immediately and ensuring that only approved SKU sizes can ever be provisioned. This effect is evaluated during the authorization phase of the deployment, before any resource is instantiated, making it the only option listed that truly blocks a non-compliant VM.
- ✗
Append
Why it's wrong here
Incorrect. The Append effect adds additional fields (such as tags) to a resource during creation or update, but it does not block the creation of a resource that violates the policy. It would not reject a VM with a wrong SKU.
When this WOULD be correct
A company wants to automatically add a 'Department' tag with value 'Finance' to any new virtual machine created in a subscription, without blocking the deployment. Append would add the tag during creation.
- ✗
Audit
Why it's wrong here
Incorrect. The Audit effect creates a compliance event in the activity log when a non-compliant resource is created or updated, but it allows the deployment to succeed. Since the requirement is to block the deployment entirely, Audit does not meet the need.
When this WOULD be correct
Use Audit when you want to evaluate compliance and log violations without blocking resource creation, such as for a policy that tracks which resources are deployed without enforcing restrictions.
- ✗
DeployIfNotExists
Why it's wrong here
Incorrect. The DeployIfNotExists effect is used to deploy a resource (e.g., a monitoring agent) to a virtual machine that does not have it. It does not block the creation of the VM itself, and thus cannot prevent a non-approved SKU from being deployed.
When this WOULD be correct
A company wants to automatically deploy a network security group (NSG) to any new virtual network that does not already have one. The policy should ensure that after the virtual network is created, a specific NSG is deployed to it.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DenyCorrect answer▾
Why this is correct
The Deny effect is the correct choice because it actively prevents the resource provider from executing the create or update operation when the policy condition is not satisfied. In Azure Policy, Deny returns a 403 Forbidden response during deployment, causing the VM creation to fail immediately and ensuring that only approved SKU sizes can ever be provisioned. This effect is evaluated during the authorization phase of the deployment, before any resource is instantiated, making it the only option listed that truly blocks a non-compliant VM.
✗AppendWrong answer — click to see why▾
Why this is wrong here
Append adds additional fields or tags to a resource during creation or update, but does not reject or block deployment. It cannot prevent a VM with a disallowed SKU from being created.
★ When this WOULD be the correct answer
A company wants to automatically add a 'Department' tag with value 'Finance' to any new virtual machine created in a subscription, without blocking the deployment. Append would add the tag during creation.
Why candidates choose this
Candidates may think Append can modify the SKU to a compliant one, but Append only adds properties, it cannot change existing ones like SKU, and does not enforce denial.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs the non-compliant deployment but does not block it, so the virtual machine would still be created, which violates the requirement to immediately reject the deployment.
★ When this WOULD be the correct answer
Use Audit when you want to evaluate compliance and log violations without blocking resource creation, such as for a policy that tracks which resources are deployed without enforcing restrictions.
Why candidates choose this
Candidates may confuse Audit with Deny, thinking that logging a violation is sufficient to enforce governance, or they may not fully understand that Audit does not prevent resource creation.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists is used to remediate non-compliant resources after creation, not to block deployment. It cannot reject a deployment immediately; it only triggers corrective actions post-creation.
★ When this WOULD be the correct answer
A company wants to automatically deploy a network security group (NSG) to any new virtual network that does not already have one. The policy should ensure that after the virtual network is created, a specific NSG is deployed to it.
Why candidates choose this
Candidates may confuse DeployIfNotExists with Deny because both involve enforcement, but DeployIfNotExists is for remediation after creation, not for blocking creation.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Azure subscription
An Azure subscription is a logical container in Microsoft Azure that provides billing isolation and access boundaries for your cloud resources and services.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.