Microsoft AZ-104 Exam Dumps, Practice Test Questions

Audit marks a matching deployment as noncompliant but does not reject the incoming resource request. It is valuable for observation, not for the preventive region requirement.

Disabled turns off policy evaluation for the rule, so a request in an unapproved region proceeds without enforcement from that definition.

AuditIfNotExists checks related-resource existence and records compliance findings. It is not the effect for rejecting an otherwise valid resource whose region is disallowed.

The ordinary Audit effect can mark a VM noncompliant based on properties or policy aliases available on that resource. A team-maintained tag, however, is only metadata and may be present even when the related diagnostic-setting child resource is missing. It cannot establish the requested existence condition; the intended audit must inspect the actual related resource type.

DeployIfNotExists can check related-resource presence much like AuditIfNotExists, but it also runs an ARM deployment to create missing configuration with a managed identity and appropriate rights. That changes the VM’s associated diagnostic settings rather than simply reporting missing configuration. The security group explicitly forbids automatic creation or modification during this assessment phase.

Modify is used for supported property or tag changes and remediation operations, not as a substitute for evaluating the existence of a separately provisioned diagnostic-setting child resource. A newly inserted tag could suggest the VM is compliant even while diagnostic events are never exported. The team needs a compliance report based on actual related configuration, with no write side effect.

Deny would prevent deployments that lack the setting. This conflicts with the explicit measure-first requirement to leave deployments operational.

DeployIfNotExists is an automated deployment mechanism for related configuration, not a passive assessment of the storage account itself. It would act rather than solely observe.

A Disabled Azure Policy effect stops the assignment from evaluating the targeted compliance condition. Use Audit when deployment must continue but each noncompliant storage account should still be surfaced in policy evaluation results.

Deny prevents a matching resource creation or update request from succeeding; it is a request-time enforcement effect, not a configuration deployment tool. The team expressly allows resource creation and needs a related diagnostic-setting resource added afterward. Rejecting the request does not provision that child resource and would interrupt workloads instead of satisfying the automated follow-up requirement.

AuditIfNotExists checks whether a related resource meeting the existence condition is present and reports a compliance violation if not. It is useful for visibility when changes should not occur automatically, but it does not execute an ARM template deployment. Here the specification explicitly calls for adding the missing setting without denying resource creation, so passive auditing alone leaves the problem unresolved.

Modify is useful for altering supported tags or provider-exposed properties and can be remediated in supported cases. A diagnostic setting is a related extension resource that must be deployed with the right parent scope, destination and authorization. Merely altering parent metadata does not establish that child resource or route diagnostic events to the required destination.

Exemptions remove selected resources from normal compliance treatment; this would lose the uniform observation-only compliance reporting that the pilot requires. An assignment-wide non-enforcement trial is more precise.

A Disabled effect is not a trial that evaluates and reports potential violations. The team requires policy compliance visibility while avoiding enforcement of the original deny effect.

Owner does not generally bypass Azure Policy enforcement; escalating permissions also expands privilege without providing an audit-only setting.

Policy deny controls evaluated requests; it is not a destructive cleanup job for existing resources. Automatically deleting storage accounts would be dangerous and is not how a deny effect operates.

Azure Policy does not perform cross-region resource migration. Region changes often require purpose-built migration processes and explicit data movement.

An existing resource can still be evaluated and reported as non-compliant; policy denial of invalid writes does not erase compliance visibility.

Deny performs request-time blocking, while Disabled does not execute the rule for enforcement. No denial occurs from this disabled effect.

These are distinct Azure Policy controls. Disabling enforcement can retain compliance evaluation, while the policy effect Disabled prevents evaluation for that definition; conflating them gives the wrong compliance expectation.

A Disabled effect does not run its rule to establish noncompliance in the usual way. It cannot be interpreted as an Audit or DeployIfNotExists effect that evaluates resources but avoids remediation.

Audit records a compliance state; it does not reject the incoming DELETE operation and would leave the production database at risk.

DeployIfNotExists checks and can deploy related resources after evaluation; it is not an RBAC rights-removal or direct delete-denial mechanism.

Disabled stops evaluation of that policy definition. An inactive policy cannot protect the matching production resources from deletion.

Default enforcement turns normal policy enforcement on but does not make a nonmodifiable alias writable under the older API version. The conflict effect remains decisive.

The deny conflict effect rejects requests when the Modify operation cannot be safely applied. That violates the specific requirement to permit existing clients using the older API version.

A resource tag and a real resource-provider property are different data. Adding a similarly named tag cannot substitute for writing the unsupported property alias.

Grouping a definition into an initiative is a way to package and organize related policies; an unassigned initiative does not apply evaluation or denial to the target subscription. A policy or initiative assignment at the appropriate scope is needed before the disallowed SKU is blocked.

A deny effect is evaluated only when the policy definition is associated with an assignment at a scope that includes the requested resource. Modifying the effect in an otherwise unused definition cannot block a VM SKU in this subscription. The missing step is to create the scoped policy assignment with the intended parameters.

A policy exemption is a scoped exception to an existing policy assignment, not the action that activates a built-in policy definition. Creating an exemption for a different resource does not apply enforcement to the subscription. The VM deployment remains outside the rule until an appropriate policy or initiative assignment exists.

A definition default applies wherever the assignment omits a parameter. Editing the common default would risk changing development behavior too; the production assignment should pass the production-specific list explicitly.

Definition or initiative metadata describes an artifact; it does not supply a particular assignment's allowedSkus parameter value. Production needs its own parameter binding.

A resource-group tag is not automatically bound to an Azure Policy definition parameter. Without an explicit assignment parameter value or a definition that reads that tag, the intended production SKU list is not enforced.