AZ-900 Describe Azure management and governance Practice Question
A company wants to enforce that all storage accounts use the 'Standard' performance tier and block creation of any 'Premium' storage accounts. Which Azure Policy effect could achieve this?
⚠ Common exam trap
Many candidates confuse the Audit effect with Deny, thinking that logging non-compliance is sufficient to enforce a policy, but Audit only reports violations without blocking the resource creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The Deny effect is the correct choice because it actively prevents the creation of Azure resources that do not comply with the policy definition. In this scenario, by assigning a policy with the Deny effect that targets storage accounts with the 'Premium' performance tier, Azure Resource Manager will block any request to create a Premium storage account, ensuring only 'Standard' tier accounts are provisioned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Append
Why it's wrong here
Append is a policy effect that adds extra properties to a resource during deployment, such as a cost center tag or a default diagnostic setting. It cannot override or remove an existing property like the performance sku that the user specified in the request. When a storage account is created with Premium performance, append has nothing to add, and the policy does not reject the deployment, so the non-compliant account persists.
When this WOULD be correct
If the requirement were to automatically add a tag or set a default value (e.g., ensure all storage accounts have the 'Standard' tier tag appended) without blocking creation, Append would be correct.
- ✓
Deny
Why this is correct
Deny is a proactive policy effect that prevents the resource from being created or updated if it violates the policy condition. For storage accounts, any request to create a Premium performance tier fails immediately with an authorization error, and the resource provider never provisions the account. This ensures the 'standard performance' requirement is enforced at deployment time, not just reported after the fact.
- ✗
Audit
Why it's wrong here
Audit evaluates the storage account against the policy and records a compliance failure in the Azure Activity Log, but the create operation continues normally. A Premium storage account is deployed successfully despite being non-compliant, and the policy does not intervene. This effect is useful for assessing existing resources or testing new policy definitions before switching to Deny.
When this WOULD be correct
If the question asked to 'log non-compliant storage accounts for reporting purposes without blocking creation', then 'Audit' would be correct, as it writes to the activity log without preventing the action.
- ✗
Disabled
Why it's wrong here
Disabled turns off the policy rule completely, so the policy is not evaluated at all when storage accounts are created. No logging, no denial, and no property injection occurs, meaning a Premium storage account is allowed without any policy intervention. Administrators may use Disabled when they want to keep a policy definition in the environment but temporarily stop its enforcement, such as during a planned migration.
When this WOULD be correct
A scenario where an organization wants to temporarily disable a policy without deleting it, for example during a planned maintenance window or to test the impact of removing a policy. The 'Disabled' effect would be correct when the goal is to stop policy evaluation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DenyCorrect answer▾
Why this is correct
Deny is a proactive policy effect that prevents the resource from being created or updated if it violates the policy condition. For storage accounts, any request to create a Premium performance tier fails immediately with an authorization error, and the resource provider never provisions the account. This ensures the 'standard performance' requirement is enforced at deployment time, not just reported after the fact.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The Append effect adds configuration to a resource but does not block creation; it cannot prevent a user from creating a Premium storage account.
★ When this WOULD be the correct answer
If the requirement were to automatically add a tag or set a default value (e.g., ensure all storage accounts have the 'Standard' tier tag appended) without blocking creation, Append would be correct.
Why candidates choose this
Candidates may confuse Append with Deny, thinking it can modify or enforce settings during creation, but Append only adds metadata and does not prevent non-compliant resources.
✗AuditWrong answer — click to see why▾
Why this is wrong here
The 'Audit' effect only logs non-compliant resources but does not block creation; the question requires enforcement to block Premium storage accounts, which only 'Deny' can do.
★ When this WOULD be the correct answer
If the question asked to 'log non-compliant storage accounts for reporting purposes without blocking creation', then 'Audit' would be correct, as it writes to the activity log without preventing the action.
Why candidates choose this
Candidates may confuse 'Audit' with enforcement, thinking logging alone satisfies the requirement, or they may not understand that 'Audit' does not prevent resource creation.
✗DisabledWrong answer — click to see why▾
Why this is wrong here
The 'Disabled' effect means the policy rule is not enforced, so it cannot block creation of Premium storage accounts. The question requires an effect that actively prevents non-compliant resources from being created.
★ When this WOULD be the correct answer
A scenario where an organization wants to temporarily disable a policy without deleting it, for example during a planned maintenance window or to test the impact of removing a policy. The 'Disabled' effect would be correct when the goal is to stop policy evaluation.
Why candidates choose this
Candidates might think 'Disabled' could be used to turn off a policy that is blocking something, misunderstanding that the question asks for an effect to enforce a block, not to remove one.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.