Exam AZ-500 topic 4 question 85 discussion

This is an audit policy with an exception for NSG1. Since Networrk Flow Log is disabled on NSG1 and NSG2 it remains disabled. You need DeployIfNotExists effect to activate NFL. https://azure.microsoft.com/en-us/updates/nsg-flow-logs-built-in-azure-policy/ We are launching two built-in policies for deploying NSG Flow Logs • An Audit policy: Flag NSGs without Flow logs enabled • A DeployIfNotExists policy: Enable Flow logs on NSGs where it is disabled Get started with our tutorial for using the above policies.

I think it should be B since it's an audit policy

Wording the option as "Flow logs remains disabled for NSG1 and NSG2" or "Flow logs status unchanged for NSG1 and NSG2" would be a lot better.

Answer is B - flow logs will continue to be disabled for both NSG1. Reason: policy mode is Audit and even if it would be something else, there is no remediation task. The policy does nothing by itself.

Policy definition : Flow logs should be enabled for every network security group Both flow logs status are "Off" Therefore "B"

B is the answer. https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#audit Audit is used to create a warning event in the activity log when evaluating a non-compliant resource, but it doesn't stop the request.

The correct answer is A just because of English :D "B" states that flows "Will be disabled" for NSG1 - but they ARE disabled, they will not BE disabled. So the provided answer is correct.

B. Flow logs will be disabled for NSG1 and NSG2.

The wording is confusing. The actual effect is that flow logs status will remain off for NSG1 and NSG2

I think the correct answer is "B" , because the effect of the policy is "Audit"