A company has an Azure Policy assignment that denies the creation of any virtual machine (VM) that does not have a mandatory 'CostCenter' tag. A development team needs to deploy a temporary test VM without the required tag for a short-term experiment. The governance team wants to allow this specific exception while recording the reason for the exception, ensuring the policy is still enforced for all other resources. The exception must also automatically expire after 30 days. Which Azure Policy feature should the governance team use?

Exclusion scope

This is incorrect because an exclusion completely removes the scope from policy evaluation. If you apply an exclusion to a resource group, the policy is not evaluated at all for resources in that group, and no compliance data is gathered. This does not meet the requirement to record the reason for the exception or to enforce the policy on other resources within the same scope.

Audit effect

This is incorrect because the Audit effect is a property of a policy definition, not a feature applied to a resource or scope. It changes how the policy behaves when non-compliance is detected (audit vs deny). In this scenario, the existing policy uses the Deny effect, and changing it to Audit would alter enforcement for all resources, not just the specific test VM. Also, the Audit effect does not provide a mechanism to record an exception reason or expiration.

Override effect

This is incorrect because there is no 'Override effect' in Azure Policy. Azure Policy supports effects such as Deny, Audit, Append, DeployIfNotExists, etc., but not Override. This is a plausible-sounding but fictitious option.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Exemption — This question tests understanding of Azure Policy compliance features, specifically the difference between exclusions and exemptions. An exclusion removes a scope from policy evaluation entirely, meaning no compliance data is collected for that scope. An exemption, on the other hand, allows the scope to be evaluated but marks resources as exempt with a recorded justification, optional expiration, and metadata such as who approved the exemption. This is ideal for temporary exceptions that must be tracked and audited. The Audit effect would only log non-compliance without blocking, but it does not allow the resource to be created if the policy uses the Deny effect. There is no 'Override effect' in Azure Policy. Therefore, an exemption is the correct solution for this controlled temporary exception.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.