AZ-900 Describe Azure management and governance Practice Question
A company wants to ensure that no one can create virtual machines without approval from the IT department. They want to block all VM creation attempts and notify the requester that they need to request access. Which Azure Policy effect should they use?
⚠ Common exam trap
Test-takers frequently confuse the Deny effect with the Audit effect, mistakenly thinking that logging violations is sufficient to block actions, but Azure Policy's Audit effect does not prevent resource creation—it only records the event for later review.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The Deny effect is correct because it actively prevents the creation of virtual machines by blocking the resource creation request at the Azure Resource Manager level. When a policy with the Deny effect is assigned, any attempt to create a VM that does not meet the policy's conditions is rejected with a 403 (Forbidden) status code, and the requester receives an error message indicating the policy violation and the need to request access. This directly enforces the requirement to block all VM creation attempts without requiring manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deny
Why this is correct
The Deny effect in Azure Policy actively blocks the creation of a virtual machine when the policy condition is met. During deployment evaluation, the policy engine intercepts the request and returns an error to the user, and you can include a custom error message directing them to the approval workflow. This is the only effect among these that prevents the operation from occurring.
- ✗
Audit
Why it's wrong here
The Audit effect does not block the virtual machine creation; instead, it evaluates the request and, if non-compliant, marks the resource as non-compliant and writes an entry to the Activity Log. The deployment succeeds and the VM is provisioned, but auditors can later see that it was created without approval. You would use Audit when you want to monitor compliance without disrupting operations.
When this WOULD be correct
Use Audit when the goal is to monitor and log non-compliant resource creation for compliance reporting, without blocking the action or requiring approval.
- ✗
Append
Why it's wrong here
The Append effect is used to add additional fields or properties to a resource during deployment, such as mandatory tags or specific settings. It does not evaluate whether the VM creation is allowed; rather, it modifies the resource as it is being created to satisfy requirements. Since it cannot stop the deployment, it cannot ensure that no VM is created without approval—it merely can add metadata or configuration.
When this WOULD be correct
An Append effect would be correct in a scenario where the company wants to automatically add a specific tag (e.g., 'Department: IT') to any new virtual machine to ensure compliance, without blocking the creation.
- ✗
Disabled
Why it's wrong here
Setting a policy effect to Disabled means the policy rule is not evaluated at all, so the policy has no impact on resource creation. This is typically used to deactivate a policy without deleting it, for example during maintenance or when testing other effects. With Disabled, any user can create a VM without any policy-driven approval check, so it provides no assurance of compliance.
When this WOULD be correct
Use Disabled when you want to temporarily deactivate a policy without deleting it, such as during maintenance or testing, while preserving the policy definition for future use.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DenyCorrect answer▾
Why this is correct
The Deny effect in Azure Policy actively blocks the creation of a virtual machine when the policy condition is met. During deployment evaluation, the policy engine intercepts the request and returns an error to the user, and you can include a custom error message directing them to the approval workflow. This is the only effect among these that prevents the operation from occurring.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs VM creation attempts without blocking them, so it does not prevent unauthorized VM creation or notify the requester.
★ When this WOULD be the correct answer
Use Audit when the goal is to monitor and log non-compliant resource creation for compliance reporting, without blocking the action or requiring approval.
Why candidates choose this
Candidates may think Audit can be used to track and then manually enforce approval, but it lacks the automatic denial and notification required by the question.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The Append effect adds additional fields or metadata to a resource during creation or update, but it does not block or deny the creation. The company wants to block VM creation entirely, not modify it.
★ When this WOULD be the correct answer
An Append effect would be correct in a scenario where the company wants to automatically add a specific tag (e.g., 'Department: IT') to any new virtual machine to ensure compliance, without blocking the creation.
Why candidates choose this
Candidates might confuse Append with Deny because both are used for enforcement, but Append only modifies resources rather than preventing them, leading to a misunderstanding of its blocking capability.
✗DisabledWrong answer — click to see why▾
Why this is wrong here
Disabled turns off the policy effect entirely, so it would not block VM creation or notify anyone; it would simply not evaluate the policy.
★ When this WOULD be the correct answer
Use Disabled when you want to temporarily deactivate a policy without deleting it, such as during maintenance or testing, while preserving the policy definition for future use.
Why candidates choose this
Candidates might think 'Disabled' means the policy is inactive but still logs or blocks something, confusing it with a 'deny' state, or they may misinterpret it as a way to 'disable' VM creation by default.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.