A policy that requires secure transfer for storage accounts has been assigned to a subscription with the DeployIfNotExists effect. Several existing storage accounts are still noncompliant and have not changed. What should you do next to update those existing resources automatically?

Assign a CanNotDelete lock to the storage accounts

A lock prevents deletion or modification, but it does not remediate policy noncompliance.

Move the storage accounts into a new resource group

Changing the resource group does not automatically apply a policy fix to the storage accounts.

Grant the administrators a higher RBAC role on the subscription

RBAC affects access, not policy compliance or automatic configuration correction.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create and run a remediation task for the policy assignment — Policy assignment alone does not always update resources that already exist. When a policy uses a corrective effect such as DeployIfNotExists, a remediation task is needed to make Azure evaluate existing noncompliant resources and apply the required configuration. That is the step that turns an assigned policy into an actual fix for the resources already in place. Why others are wrong: Locks do not enforce configuration standards, moving resources does not remediate them, and RBAC changes permissions rather than settings. The operational follow-up for existing noncompliant resources is remediation.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.