AZ-900 Describe Azure management and governance Practice Question
A company has deployed hundreds of virtual machines in Azure across multiple subscriptions. The governance team wants to generate a compliance report that identifies which VMs are using approved VM sizes and which are not, according to a corporate policy. The team must not block the deployment of non-compliant VMs; they only want to track compliance. Which Azure Policy effect should they use in the policy definition?
⚠ Common exam trap
Test-takers frequently confuse Audit with Deny, assuming that compliance tracking requires blocking non-compliant resources, but Azure Policy separates auditing (logging) from enforcement (denying) to allow flexible governance scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit
The Audit effect is the correct choice because it enables the governance team to log non-compliant resources (such as VMs using unapproved sizes) in the Azure Activity Log without blocking their deployment. This effect generates a compliance report while allowing the deployment to proceed, exactly matching the requirement to track compliance without enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The Deny effect blocks resource creation or update when the policy condition is met, preventing the deployment of VMs with non-approved sizes. This would actively interfere with the team's ability to create resources, which contradicts the requirement to only track compliance without affecting deployment. Since the goal is to generate a compliance report, Deny is too restrictive and would cause deployment failures rather than simply flagging non-compliant resources for review.
When this WOULD be correct
Use Deny when the governance team wants to enforce compliance by preventing the creation or modification of resources that violate policy, such as blocking deployment of VMs with unapproved sizes.
- ✓
Audit
Why this is correct
The Audit effect logs a compliance event in the activity log and marks the resource as non-compliant, but does not block deployment. This allows the team to generate a compliance report without interfering with existing deployments.
- ✗
Append
Why it's wrong here
The Append effect adds additional fields, such as tags or resource properties, during resource creation or update, but it does not evaluate VM size or generate compliance reports. It is a mutation action that modifies the request, not an audit action that records compliance status. Therefore, Append cannot identify non-compliant VMs based on size or produce the desired compliance report, making it unsuitable for this scenario.
When this WOULD be correct
A company wants to automatically add a specific tag (e.g., 'Environment: Production') to any new or updated virtual machine that lacks it, without blocking the deployment. The policy should ensure all VMs have the tag for cost tracking.
- ✗
DeployIfNotExists
Why it's wrong here
DeployIfNotExists is a remediation effect that deploys a specified resource, such as a monitoring agent or diagnostic setting, when the policy engine detects that the required resource is missing. It does not assess VM size compliance or log audit events; instead, it focuses on provisioning missing resources to bring the environment into a desired state. This effect is designed for remediation, not for tracking compliance with VM size policies, so it cannot be used to generate a compliance report on non-compliant VMs.
When this WOULD be correct
A policy definition that automatically deploys a monitoring agent to VMs that are missing it, ensuring all VMs have the agent installed without manual intervention.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AuditCorrect answer▾
Why this is correct
The Audit effect logs a compliance event in the activity log and marks the resource as non-compliant, but does not block deployment. This allows the team to generate a compliance report without interfering with existing deployments.
✗DenyWrong answer — click to see why▾
Why this is wrong here
The Deny effect blocks non-compliant deployments, but the question explicitly states the team must not block deployment—they only want to track compliance.
★ When this WOULD be the correct answer
Use Deny when the governance team wants to enforce compliance by preventing the creation or modification of resources that violate policy, such as blocking deployment of VMs with unapproved sizes.
Why candidates choose this
Candidates may assume that enforcing compliance requires blocking non-compliant resources, overlooking the requirement to only track without blocking.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The 'Append' effect adds additional fields to a resource during creation or update, but it does not generate compliance reports or track non-compliant resources without modifying them. The question requires only tracking compliance without blocking or altering VMs, which 'Audit' does.
★ When this WOULD be the correct answer
A company wants to automatically add a specific tag (e.g., 'Environment: Production') to any new or updated virtual machine that lacks it, without blocking the deployment. The policy should ensure all VMs have the tag for cost tracking.
Why candidates choose this
Candidates might think 'Append' can be used to mark non-compliant VMs by adding a tag, but the question explicitly requires only tracking compliance, not modifying resources.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists is used to automatically remediate non-compliant resources by deploying a defined template, but the question explicitly states the team only wants to track compliance without blocking or changing deployments.
★ When this WOULD be the correct answer
A policy definition that automatically deploys a monitoring agent to VMs that are missing it, ensuring all VMs have the agent installed without manual intervention.
Why candidates choose this
Candidates may confuse 'tracking' with 'remediation', thinking DeployIfNotExists can generate reports, but it actually modifies resources rather than just auditing.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.