AZ-104 Manage Azure Identities and Governance Practice Question
An administrator assigned a modify policy at the subscription scope to add a CostCenter tag to new virtual machines. New VMs now have the tag, but older VMs in the subscription still do not. What must the administrator do to bring the existing VMs into compliance?
⚠ Common exam trap
Candidates often assume a policy assigned with a modify effect automatically applies to existing resources, but Azure Policy's modify effect only applies to new resources unless a remediation task is explicitly created and run.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a remediation task for the noncompliant resources.
The modify effect policy assigned at the subscription scope automatically applies the CostCenter tag to new resources during creation, but it does not retroactively update existing noncompliant resources. To bring older VMs into compliance, the administrator must create a remediation task, which triggers Azure Policy's deployment engine to evaluate and apply the defined modify effect (e.g., adding the missing tag) to existing noncompliant resources using a managed identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reassign the policy at the resource group scope.
Why it's wrong here
Reassigning the policy at the resource group scope changes the scope of evaluation, but it does not trigger any automatic remediation for resources that are already deployed. Azure Policy evaluates resources continuously, but the evaluation only reports compliance; it does not apply the modify effect retroactively. Instead, existing noncompliant VMs would still require a remediation task to have the missing tag added, regardless of the scope used for the assignment.
When this WOULD be correct
If the question asked how to ensure that only new resources in a specific resource group receive the tag (e.g., to limit policy scope), then reassigning the policy at the resource group scope would be correct. This would apply the policy only to that resource group, not the entire subscription.
- ✓
Create a remediation task for the noncompliant resources.
Why this is correct
Policy assignments evaluate both existing and new resources, but a modify effect needs remediation to update already deployed resources. The remediation task tells Azure Policy to apply the configured effect to noncompliant resources that were created before the assignment or before the policy changed. That is the step that fills in the missing tag on the older virtual machines.
- ✗
Add a resource lock to the subscription.
Why it's wrong here
A resource lock is intended to protect resources from accidental deletion or modification by applying CanNotDelete or ReadOnly restrictions at the management level. It has no effect on the compliance evaluation of a policy assignment, because it does not alter resource properties like tags. Consequently, existing virtual machines missing the required tag will remain noncompliant; locks do not perform any action that updates or remediates resources.
When this WOULD be correct
An administrator needs to prevent accidental deletion of critical resources in a subscription. The correct answer would be to add a resource lock (e.g., CanNotDelete) to the subscription or resource group to protect those resources.
- ✗
Move the VMs to another resource group and back again.
Why it's wrong here
Moving virtual machines to another resource group and then back does not invoke any policy remediation logic; it simply changes the ARM resource path. The modify effect only updates a resource when a remediation task is run, not when a resource is moved or re-evaluated by the policy engine. Therefore, the VMs would still lack the mandatory tag, and this approach introduces unnecessary administrative overhead and potential downtime without achieving compliance.
When this WOULD be correct
If a VM needs to be migrated to a different resource group to apply resource-specific policies (e.g., location restrictions) that are scoped at the resource group level, moving it would bring it under the new policy scope.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a remediation task for the noncompliant resources.Correct answer▾
Why this is correct
Policy assignments evaluate both existing and new resources, but a modify effect needs remediation to update already deployed resources. The remediation task tells Azure Policy to apply the configured effect to noncompliant resources that were created before the assignment or before the policy changed. That is the step that fills in the missing tag on the older virtual machines.
✗Reassign the policy at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Reassigning the policy at the resource group scope does not retroactively apply the policy to existing resources; it only affects new resources in that scope. The issue is that existing VMs are noncompliant, and reassignment does not trigger remediation.
★ When this WOULD be the correct answer
If the question asked how to ensure that only new resources in a specific resource group receive the tag (e.g., to limit policy scope), then reassigning the policy at the resource group scope would be correct. This would apply the policy only to that resource group, not the entire subscription.
Why candidates choose this
Candidates may think that applying the policy at a more granular scope (resource group) will force compliance on existing resources, misunderstanding that policies are only enforced on new resources unless remediation is used.
✗Add a resource lock to the subscription.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of resources, but it does not apply or enforce Azure Policy assignments. It cannot bring existing noncompliant resources into compliance.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion of critical resources in a subscription. The correct answer would be to add a resource lock (e.g., CanNotDelete) to the subscription or resource group to protect those resources.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking that locking the subscription will somehow force compliance, or they may believe that a lock can trigger remediation actions.
✗Move the VMs to another resource group and back again.Wrong answer — click to see why▾
Why this is wrong here
Moving VMs to another resource group and back does not trigger policy evaluation or remediation; policies are evaluated on resource creation or update, not on move.
★ When this WOULD be the correct answer
If a VM needs to be migrated to a different resource group to apply resource-specific policies (e.g., location restrictions) that are scoped at the resource group level, moving it would bring it under the new policy scope.
Why candidates choose this
Candidates may think that moving resources forces a re-evaluation of policies, similar to how moving can trigger other Azure operations, but policy compliance is not automatically reassessed on move.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.