DP-900 Practice Question: Identify considerations for relational data on Azure
Exhibit
Refer to the exhibit.
```json
{
"properties": {
"resource": {
"type": "Microsoft.Sql/servers/databases"
},
"policyRule": {
"if": {
"field": "Microsoft.Sql/servers/databases/zoneRedundant",
"equals": false
},
"then": {
"effect": "deny"
}
}
}
}
```Refer to the exhibit. An Azure Policy is defined as shown. A database administrator attempts to create an Azure SQL Database without enabling zone redundancy. What will happen?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The database creation will be denied
The policy has an effect of 'deny', so any attempt to create an Azure SQL Database without zone redundancy will be denied. Option B is correct because the policy explicitly denies the creation. Option A is incorrect because the effect is deny, not audit. Option C is incorrect because the policy denies creation rather than enabling zone redundancy automatically. Option D is incorrect because the policy denies the creation entirely, it does not allow creation with zone redundancy disabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The database will be created and an audit event will be logged
Why it's wrong here
This option incorrectly assumes the policy effect is 'audit', but the definition uses a 'deny' effect. Under a deny effect, Azure Policy evaluates the condition before Resource Manager accepts the request; if the condition matches, the deployment is rejected with a policy violation, and no database resource is created. No database exists, so no audit event for the database itself is emitted — only a failure/denial entry in the activity log would appear. Thus the database is not created and no database-level audit event is logged.
- ✓
The database creation will be denied
Why this is correct
This is correct because the policy rule uses a deny effect with a condition that compares the 'zoneRedundant' property to the literal value false. When a user attempts to create a SQL Database with zoneRedundant set to false, the condition evaluates true, causing Azure Resource Manager to block the deployment before the resource provider provisions anything. The request fails with an error indicating the resource was disallowed by policy, so the database is never created. This is the intended behavior of a deny policy.
- ✗
The database will be created and zone redundancy will be automatically enabled
Why it's wrong here
A deny-effect policy cannot modify or set resource properties; it only rejects requests that violate its condition. The Azure Policy effects that can change a property post-deployment are 'modify' or 'deployIfNotExists' combined with a remediation task, neither of which is present in this definition. Because the requested database has zoneRedundant false (which satisfies the policy's deny condition), the creation attempt is blocked outright rather than being silently adjusted to true. Therefore the database is not created, and zone redundancy is not automatically enabled.
- ✗
The database will be created with zone redundancy disabled
Why it's wrong here
The policy is configured to deny exactly when zoneRedundant equals false, which means a database with redundancy disabled is the disallowed configuration. The deny effect causes the entire create operation to be rejected, so the resource provider never receives the request to create the database. No SQL Database resource is provisioned, with or without zone redundancy, because the policy check happens before the resource is deployed. Thus the database cannot be created with disabled zone redundancy.
Go deeper
Related to this question
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.