AZ-104 Manage Azure Identities and Governance Practice Question
A policy that requires secure transfer for storage accounts has been assigned to a subscription with the DeployIfNotExists effect. Several existing storage accounts are still noncompliant and have not changed. What should you do next to update those existing resources automatically?
⚠ Common exam trap
Watch out — candidates often assume DeployIfNotExists automatically remediates all existing resources, but it only applies to new or updated resources, requiring a separate remediation task for existing noncompliant resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create and run a remediation task for the policy assignment
The DeployIfNotExists effect on a policy assignment automatically deploys a template to remediate noncompliant resources, but only for new or updated resources. Existing noncompliant resources require a manual remediation task to trigger the deployment of the template. Creating and running a remediation task for the policy assignment applies the required secure transfer configuration to all existing storage accounts, bringing them into compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a CanNotDelete lock to the storage accounts
Why it's wrong here
A CanNotDelete lock is an Azure management lock that prevents accidental deletion or modification of a resource, but it does not affect resource configuration or policy compliance. Locks are separate from Azure Policy and do not perform any corrective action, so enabling secure transfer on storage accounts is not achieved by placing a lock. In fact, if a remediation task attempts to modify the storage account, the lock could block that modification, exacerbating noncompliance.
When this WOULD be correct
If a question asks how to prevent accidental deletion of critical storage accounts that already comply with security policies, assigning a CanNotDelete lock would be correct.
- ✓
Create and run a remediation task for the policy assignment
Why this is correct
Azure Policy with a deployIfNotExists or modify effect can apply corrective configuration to existing resources when a remediation task is triggered. Running a remediation task evaluates current non-compliant storage accounts and automatically enables the secure transfer setting, bringing them into compliance without manual intervention. This is the direct way to fix policy noncompliance that existed before the assignment.
- ✗
Move the storage accounts into a new resource group
Why it's wrong here
Moving storage accounts to a new resource group changes their scope for management and policy evaluation, but it does not change the resource's configuration. If the policy assignment is at the subscription or management group level, the storage accounts remain within scope and still non-compliant after the move. If moved to a different subscription without the policy assignment, they would fall out of scope, but that is circumvention, not remediation—the secure transfer setting remains disabled.
When this WOULD be correct
A question where storage accounts need to be isolated from a policy's scope to avoid compliance issues, such as when a policy incorrectly applies to resources that should be exempt, and moving them to a different resource group with a policy exemption is the intended solution.
- ✗
Grant the administrators a higher RBAC role on the subscription
Why it's wrong here
Assigning a higher RBAC role like Owner or Contributor increases administrators' permissions to manage and modify resources, but it does not change the underlying configuration of storage accounts. Policy compliance is evaluated based on the resource's actual settings against the policy definition, not on who has access. Even with elevated rights, the secure transfer property remains disabled, and the policy continues to report noncompliance until someone manually reconfigures it—role elevation alone does not remediate anything.
When this WOULD be correct
A question where an administrator cannot modify a storage account's configuration due to insufficient permissions, and the solution is to assign a role like 'Storage Account Contributor' to enable changes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create and run a remediation task for the policy assignmentCorrect answer▾
Why this is correct
Azure Policy with a deployIfNotExists or modify effect can apply corrective configuration to existing resources when a remediation task is triggered. Running a remediation task evaluates current non-compliant storage accounts and automatically enables the secure transfer setting, bringing them into compliance without manual intervention. This is the direct way to fix policy noncompliance that existed before the assignment.
✗Assign a CanNotDelete lock to the storage accountsWrong answer — click to see why▾
Why this is wrong here
A CanNotDelete lock prevents deletion but does not enforce secure transfer settings; it cannot remediate policy noncompliance.
★ When this WOULD be the correct answer
If a question asks how to prevent accidental deletion of critical storage accounts that already comply with security policies, assigning a CanNotDelete lock would be correct.
Why candidates choose this
Candidates may confuse locks with policy remediation, thinking a lock can enforce configuration changes, or they may assume any 'lock' type can fix compliance issues.
✗Move the storage accounts into a new resource groupWrong answer — click to see why▾
Why this is wrong here
Moving storage accounts to a new resource group does not trigger the DeployIfNotExists policy to remediate noncompliant resources; it only changes their location without applying the required policy effect.
★ When this WOULD be the correct answer
A question where storage accounts need to be isolated from a policy's scope to avoid compliance issues, such as when a policy incorrectly applies to resources that should be exempt, and moving them to a different resource group with a policy exemption is the intended solution.
Why candidates choose this
Candidates may think that moving resources to a new group resets their compliance status or triggers policy evaluation, but DeployIfNotExists requires explicit remediation tasks to modify existing resources.
✗Grant the administrators a higher RBAC role on the subscriptionWrong answer — click to see why▾
Why this is wrong here
Granting administrators a higher RBAC role does not trigger policy remediation; it only changes permissions. The DeployIfNotExists policy requires a remediation task to update noncompliant resources.
★ When this WOULD be the correct answer
A question where an administrator cannot modify a storage account's configuration due to insufficient permissions, and the solution is to assign a role like 'Storage Account Contributor' to enable changes.
Why candidates choose this
Candidates may think that higher RBAC roles automatically enforce policies or fix compliance, confusing permission elevation with policy remediation mechanisms.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Policy assignment
Policy assignment is the process of attaching a set of rules or permissions to a specific resource, user, or group so that those rules are enforced in a cloud or IT environment.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.