A company has a root management group that contains two child management groups: Production and Development. Each child management group contains several subscriptions. The security team assigns a built-in Azure Policy definition with the 'Deny' effect to the Production management group to enforce encryption on all storage accounts. Later, the Development team requests that storage accounts in their subscriptions must not be encrypted because they host temporary test data that needs to be quickly deleted and recreated. The security team must allow this exception for Development only, without changing the policy for Production. What should the security team do?

Assign a new policy with the 'Audit' effect at the Development management group to override the Deny effect.

Incorrect. Policy effects are not overridden by less restrictive effects at a child scope. The Deny policy from the parent management group still applies to Development subscriptions because policy inheritance is cumulative. An Audit policy does not prevent the Deny from blocking encryption-free storage accounts.

Remove the policy assignment from the root management group and assign it individually to each Production subscription.

Incorrect. While this would technically allow Development subscriptions to not have the policy, it negates the benefit of management groups and increases administrative overhead. It also does not address the need to keep the policy enforced for Production. Azure Policy exemptions provide a cleaner, more scalable approach.

Create an Azure RBAC role assignment that grants the Development team permission to bypass the policy.

Incorrect. Azure Policy and Azure RBAC are separate. RBAC controls who can make changes to resources, but it does not bypass policy effects. Even if a user has Owner permissions, Azure Policy with Deny effect will block non-compliant resource creation regardless of RBAC.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Create an Azure Policy exemption for the Development management group with the 'Mitigated' category. — Azure Policy inheritances can be overridden by exemptions. When a policy with Deny effect is assigned at a parent scope (like a management group), it applies to all child scopes (subscriptions/resource groups) unless an exemption is created. An Azure Policy exemption excludes a scope from policy evaluation and reporting. There are two categories: 'Mitigated' (for policies that are still compliant due to compensating controls) and 'Waiver' (for a limited time). Creating an exemption at the Development management group allows storage accounts in Development subscriptions to be created without encryption while the Deny policy remains enforced for Production.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.