Describe Azure management and governance →easyMultiple ChoiceObjective-mapped

AZ-900 Describe Azure management and governance Practice Question

A company wants to ensure that all Azure resources are created within a specific set of approved regions. They want to automatically block any resource creation that is not in an approved region. Which Azure Policy effect should they use?

⚠ Common exam trap

A common mix-up: candidates confuse Audit (which only logs violations) with Deny (which actively blocks), or they think Append can override the location property, but Append only adds metadata and cannot change or block the resource's region.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deny

The Deny effect is correct because it actively blocks any resource creation or update that does not comply with the policy rule. In this scenario, the policy would evaluate the location property of the resource against the approved list, and if the region is not approved, the Deny effect prevents the deployment entirely, returning a 403 Forbidden error. This ensures that only resources in approved regions are created, meeting the company's requirement to automatically block non-compliant deployments.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Deny
Why this is correct
The Deny effect intercepts the resource manager request during creation or update and returns a provisioning error if the policy condition evaluates to true, such as when a resource's location is not in the allowed list. This stops the resource from being deployed entirely, guaranteeing that every Azure resource is created within the specific boundary required. Because the request fails before any resource is provisioned, Deny is the correct effect for enforcing a mandatory location constraint.
✗
Append
Why it's wrong here
The Append effect modifies the resource request by adding specified fields, such as a required tag or property, before the resource is created, but it never rejects the request. Because Append only adds missing values and cannot remove or override existing properties, it cannot change a resource's location if the location is already specified, and it certainly cannot deny deployment. It is useful for ensuring attributes like tags are always present, yet it is not a blocking control and cannot enforce location restrictions.
When this WOULD be correct
A company wants to automatically add a specific tag (e.g., 'CostCenter') to all new resources that are missing it, without blocking their creation. In that scenario, Append would be the correct effect.
✗
Audit
Why it's wrong here
The Audit effect does not block or alter the resource creation request; it simply writes a non-compliance event to the activity log after the resource is provisioned. A resource in an undeclared location would still be deployed successfully, and the audit entry would only flag it for later review or reporting. Thus, Audit is suitable for detecting non-compliance and tracking drift, but it cannot be used to guarantee that no resource is created outside the specified location.
When this WOULD be correct
Use Audit when the requirement is to evaluate and report on resource compliance without enforcement, such as assessing current resource distribution across regions before implementing a Deny policy.
✗
DeployIfNotExists
Why it's wrong here
DeployIfNotExists triggers only after the original resource has been created and only when a required supporting resource does not exist, then deploys that missing resource to remediate the situation. It never rejects the original resource creation, so a resource in the wrong location would remain in place even if a remediation resource is deployed. This makes DeployIfNotExists useful for post-creation configuration like installing an agent or attaching a diagnostic setting, not for denying a non-compliant location.
When this WOULD be correct
An organization wants to automatically deploy a network security group (NSG) to any new virtual network that does not already have one. DeployIfNotExists would audit and then deploy the NSG to bring the resource into compliance.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

✓DenyCorrect answer▾

Why this is correct

The Deny effect intercepts the resource manager request during creation or update and returns a provisioning error if the policy condition evaluates to true, such as when a resource's location is not in the allowed list. This stops the resource from being deployed entirely, guaranteeing that every Azure resource is created within the specific boundary required. Because the request fails before any resource is provisioned, Deny is the correct effect for enforcing a mandatory location constraint.

✗AppendWrong answer — click to see why▾

Why this is wrong here

The Append effect adds additional fields or tags to a resource during creation or update, but it does not block creation; it only modifies the resource. To block creation in non-approved regions, a Deny effect is required.

★ When this WOULD be the correct answer

A company wants to automatically add a specific tag (e.g., 'CostCenter') to all new resources that are missing it, without blocking their creation. In that scenario, Append would be the correct effect.

Why candidates choose this

Candidates may confuse Append with Deny because both can enforce policies, but Append modifies resources instead of blocking them, leading to a misunderstanding of how to prevent non-compliant resource creation.

✗AuditWrong answer — click to see why▾

Why this is wrong here

The Audit effect only logs non-compliant resources but does not block creation; the question requires automatic blocking of resource creation outside approved regions.

★ When this WOULD be the correct answer

Use Audit when the requirement is to evaluate and report on resource compliance without enforcement, such as assessing current resource distribution across regions before implementing a Deny policy.

Why candidates choose this

Candidates may confuse auditing with enforcement, thinking that logging violations is sufficient to prevent creation, or they may not fully understand the difference between Audit and Deny effects.

✗DeployIfNotExistsWrong answer — click to see why▾

Why this is wrong here

DeployIfNotExists is used to deploy resources or configurations when a non-compliant resource is found, not to block creation. It cannot prevent resource creation in unapproved regions.

★ When this WOULD be the correct answer

An organization wants to automatically deploy a network security group (NSG) to any new virtual network that does not already have one. DeployIfNotExists would audit and then deploy the NSG to bring the resource into compliance.

Why candidates choose this

Candidates may confuse DeployIfNotExists with Deny because both can enforce compliance, but DeployIfNotExists remediates after creation rather than blocking it upfront.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-900 Describe Azure management and governance Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question