A team wants every resource in a subscription to include a Department tag. New resources that do not have the tag should be blocked from being created. Which Azure Policy effect should you use?

Audit

Audit reports noncompliance but still allows the resource to be created.

Append

Append can add or modify properties in some cases, but it does not simply block creation.

Disabled

Disabled turns off enforcement and would not help with mandatory tagging.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Deny — The Deny effect is correct because the requirement says new resources without the Department tag must not be created. Deny is the Azure Policy effect that actively blocks a noncompliant deployment at request time. Audit would only report the issue, and append would not reliably enforce a mandatory tag requirement by itself. Why others are wrong: Audit is only for visibility, not blocking. Append is used to add or modify certain properties and is not the standard answer for mandatory tag enforcement. Disabled obviously turns the policy off and provides no compliance control.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.