AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create policy definition, assign policy, review compliance, remediate non-compliant resources.

  Why this is correct

  Define the Azure Policy definition first, because its JSON policyRule and effect (e.g., Deny, Audit, Append, DeployIfNotExists) establish the exact compliance standard. Next, assign the definition to a management group, subscription, or resource group; assignment is what activates the policy and sets parameters. After assignment, the compliance engine evaluates resources and produces a compliance state for each applicable resource. Finally, remediate non-compliant resources, either by running a remediation task for deployIfNotExists/modify effects or by manually fixing the resource so it can become compliant.

• ✗

  Assign policy, create policy definition, review compliance, remediate non-compliant resources.

  Why it's wrong here

  Assigning a policy before creating its definition is logically impossible in Azure Policy, because an assignment must reference an existing definition or initiative stored in the policy definition library. Without the definition, the assignment REST API call fails at validation, so no policy will be active. This order also prevents meaningful review of compliance, since there would be no assigned definition to evaluate resources against.

• ✗

  Create policy definition, review compliance, assign policy, remediate non-compliant resources.

  Why it's wrong here

  Reviewing compliance immediately after creating the definition is premature because the policy has not yet been assigned to any scope, and Azure Policy only generates compliance data from active assignments. A definition alone is just a reusable rule; it can be assigned to multiple scopes, and the compliance state depends on that assignment's parameters and scope. Until an assignment exists, the evaluation engine has no policy to apply, so compliance results would be empty or undefined.

• ✗

  Remediate non-compliant resources, create policy definition, assign policy, review compliance.

  Why it's wrong here

  Starting with remediation is invalid because remediation tasks act on the compliance results Azure Policy produces, and those results do not exist until a policy is defined and assigned to a scope. The create definition step would then occur too late, meaning any attempted remediation would have no assigned policy to indicate what is non-compliant. This order also inverts the diagnostic loop: compliance review must identify violations before remediation can repair them.

Go deeper

Related to this question