AZ-900 Practice Question 79: Policy Effects Deny vs Audit
Microsoft Azure Fundamentals (AZ-900) · Test 8 · question 9 of 10
A governance team needs two separate Azure Policy definitions. The first must block, outright, any new storage account that allows public blob access. The second must flag every existing virtual machine that lacks a required CostCenter tag, without stopping anyone from creating or updating a VM. Which pair of effects should the two definitions use, respectively?
Show answer and explanation
Answer:
The deny effect prevents a resource request that doesn't match the policy from ever reaching the resource provider; the request fails with a 403, which is "block outright." The audit effect creates a warning in the activity log for a non-compliant resource and marks it non-compliant, but explicitly doesn't stop the request, which is "flag without blocking." That is exactly one deny definition and one audit definition, in that order.
Option B reverses the two needs: it would block a VM from being created or updated over a missing tag, which is too strict, while only flagging public blob access on a new storage account, which is too lax for the stated requirement. Option C misapplies both effects; append adds or overwrites a field on a matching resource during creation or update rather than blocking it, and modify alters properties of resources rather than merely reporting on them; neither stops a noncompliant storage account from being created. Option D pairs the wrong tools entirely: disabled turns off evaluation of a definition altogether, and manual requires a person to attest to compliance rather than the platform detecting it automatically.
Reference: Azure Policy definitions effect basics