AZ-900 Describe Azure management and governance Practice Question
A company has an Azure subscription used by multiple development teams. The security team wants to ensure that every virtual network (VNet) created in the subscription automatically has a specific network security group (NSG) associated with its default subnet. The NSG rules are defined by the security team, and developers should not have to perform any extra steps after creating a VNet. Which Azure Policy effect should the security team use in the policy definition?
⚠ Common exam trap
Test-takers frequently confuse DeployIfNotExists with Deny, thinking that blocking non-compliant resources is the only way to enforce compliance, but the question explicitly requires automatic association without extra steps, which only DeployIfNotExists can achieve through remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeployIfNotExists
The DeployIfNotExists effect is correct because it automatically deploys a specific NSG to the default subnet of any VNet that does not already have it, ensuring compliance without requiring developer intervention. This effect evaluates the resource after creation and triggers a deployment to remediate non-compliant states, aligning with the requirement for zero extra steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The Deny effect blocks creation of the VNet if it does not meet the condition. While this enforces compliance, it does not automatically deploy the NSG. Developers would have to manually create and associate the NSG before the VNet can be created, which adds extra steps.
When this WOULD be correct
If the security team wanted to block any VNet creation that does not include a specific tag or does not have a certain size, Deny would be the correct effect to prevent non-compliant resources from being created.
- ✗
Audit
Why it's wrong here
The Audit effect logs a compliance event when the condition is not met (e.g., missing NSG association), but it does not deploy the NSG or remediate the issue. It only alerts the security team to the non-compliance, requiring manual follow-up.
When this WOULD be correct
Use Audit when the goal is to monitor and report on existing VNets that lack the required NSG, without automatically remediating them, such as for compliance reporting before enforcing a policy.
- ✓
DeployIfNotExists
Why this is correct
The DeployIfNotExists effect automatically deploys a resource (in this case, an NSG and its association to the subnet) when a VNet is created without it. This ensures compliance without manual effort from developers, matching the requirement exactly.
- ✗
Append
Why it's wrong here
The Append effect adds additional fields to the existing resource definition (e.g., tags on a VNet). However, an NSG association is a separate resource (a subnet property referencing the NSG), not a property of the VNet itself. Append cannot create or attach a separate resource like an NSG.
When this WOULD be correct
A policy needs to ensure that every storage account has a specific tag (e.g., 'Environment') with a value from a predefined list. If the tag is missing, Append adds it with a default value, preventing non-compliant resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DeployIfNotExistsCorrect answer▾
Why this is correct
The DeployIfNotExists effect automatically deploys a resource (in this case, an NSG and its association to the subnet) when a VNet is created without it. This ensures compliance without manual effort from developers, matching the requirement exactly.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny prevents the creation of a VNet if it doesn't meet conditions, but it cannot automatically associate an NSG with the default subnet after creation. The requirement is to ensure the NSG is associated without developer intervention, which requires remediation, not denial.
★ When this WOULD be the correct answer
If the security team wanted to block any VNet creation that does not include a specific tag or does not have a certain size, Deny would be the correct effect to prevent non-compliant resources from being created.
Why candidates choose this
Candidates may think Deny is the strictest way to enforce compliance, but they overlook that the scenario requires automatic remediation (associating the NSG) rather than just blocking non-compliant creation.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliance without taking any action to deploy the NSG, so developers would still need to manually associate the NSG, failing the requirement of no extra steps.
★ When this WOULD be the correct answer
Use Audit when the goal is to monitor and report on existing VNets that lack the required NSG, without automatically remediating them, such as for compliance reporting before enforcing a policy.
Why candidates choose this
Candidates may think Audit is sufficient because it detects non-compliance, but they overlook the requirement for automatic remediation without developer intervention.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The Append effect adds fields to an existing resource during creation or update, but it cannot deploy a new resource like an NSG. The requirement is to automatically associate an NSG with a subnet, which requires deploying the NSG if it doesn't exist, not just appending properties.
★ When this WOULD be the correct answer
A policy needs to ensure that every storage account has a specific tag (e.g., 'Environment') with a value from a predefined list. If the tag is missing, Append adds it with a default value, preventing non-compliant resources.
Why candidates choose this
Candidates may think Append can add an NSG association to a subnet, but Append only modifies properties of the resource being created, not deploy separate resources.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
Azure subscription
An Azure subscription is a logical container in Microsoft Azure that provides billing isolation and access boundaries for your cloud resources and services.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.