AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Policy to govern its Azure environment. The governance team wants to enforce that all virtual machines (VMs) deployed in the production subscription use only approved operating system images from a specific Azure Compute Gallery. However, during a transition period, the team does not want to block the creation of VMs that use non-approved images; instead, they need to identify and report on any non-compliant VMs. They also want to track compliance over time. Which Azure Policy effect should the governance team use in the policy definition to meet these requirements?
⚠ Common exam trap
Many candidates choose Deny because they assume governance requires enforcement, missing the explicit requirement to allow creation and only report non-compliance during the transition period.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit
The Audit effect is correct because it enables the governance team to identify and report non-compliant VMs without blocking their creation. Azure Policy's Audit effect logs a warning in the activity log for resources that violate the policy, allowing the team to track compliance over time via Azure Policy compliance reports and Azure Monitor, while the transition period remains unblocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The Deny effect actively blocks resource creation or update operations that do not comply with the policy definition, returning an error and preventing the deployment. In this scenario, Deny would stop the deployment of VMs using non-approved images, which directly contradicts the stated requirement to allow deployments during the transition period. Additionally, because the operation is blocked before completion, no compliance warning event is generated in the activity log for the would-be non-compliant resource; instead, only a denial event is recorded, so the governance team loses the visibility needed to track and report on those VMs.
When this WOULD be correct
Use Deny when the governance team wants to proactively prevent the creation of VMs with non-approved images, blocking any deployment that violates the policy.
- ✓
Audit
Why this is correct
The Audit effect evaluates resources for compliance and generates a warning event in the activity log, but does not block the resource operation. This allows the governance team to identify and report non-compliant VMs without interrupting the deployment process.
- ✗
Append
Why it's wrong here
The Append effect is used to add additional fields (such as tags) to a resource during creation or update. It does not evaluate or report on existing properties like the OS image, so it cannot identify VMs with non-approved images.
When this WOULD be correct
A policy that must automatically add a specific tag (e.g., 'Environment: Production') to any VM that lacks it during deployment, without blocking the creation.
- ✗
Modify
Why it's wrong here
The Modify effect is used to add, update, or remove properties on a resource. While it can change configurations, it does not inherently log compliance or allow for tracking of non-approved images without additional logic. It also may alter the resource, which is not desired here.
When this WOULD be correct
A policy needs to automatically add a specific tag (e.g., 'Environment: Production') to all new virtual machines in a subscription to ensure consistent tagging. The Modify effect would be correct because it can add or update tags on resources during deployment without denying the creation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AuditCorrect answer▾
Why this is correct
The Audit effect evaluates resources for compliance and generates a warning event in the activity log, but does not block the resource operation. This allows the governance team to identify and report non-compliant VMs without interrupting the deployment process.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny blocks non-compliant VM creation, but the question explicitly states the team does not want to block creation; they only need to identify and report non-compliant VMs.
★ When this WOULD be the correct answer
Use Deny when the governance team wants to proactively prevent the creation of VMs with non-approved images, blocking any deployment that violates the policy.
Why candidates choose this
Candidates may think Deny is the only way to enforce compliance, overlooking that Audit can identify non-compliance without blocking.
✗AppendWrong answer — click to see why▾
Why this is wrong here
Append adds additional fields or tags to a resource during creation or update but does not audit or report on non-compliant resources; it modifies the resource to meet policy, which is not what the team needs.
★ When this WOULD be the correct answer
A policy that must automatically add a specific tag (e.g., 'Environment: Production') to any VM that lacks it during deployment, without blocking the creation.
Why candidates choose this
Candidates may confuse Append with Audit because both can be used for compliance, but Append actively modifies resources rather than just reporting non-compliance.
✗ModifyWrong answer — click to see why▾
Why this is wrong here
The Modify effect can add or change tags and properties on resources during creation or update, but it does not audit or report on non-compliant VMs; it alters the resource. The requirement is to identify and report non-compliant VMs without blocking or changing them, which is the purpose of the Audit effect.
★ When this WOULD be the correct answer
A policy needs to automatically add a specific tag (e.g., 'Environment: Production') to all new virtual machines in a subscription to ensure consistent tagging. The Modify effect would be correct because it can add or update tags on resources during deployment without denying the creation.
Why candidates choose this
Candidates may confuse Modify with Audit, thinking that Modify can also track changes or report compliance, but Modify is an effect that changes resources, not one that audits or reports on existing resources.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.