An Azure Policy that appends the Environment tag is assigned to a subscription. New virtual machines get the tag, but existing VMs do not. What should the administrator do next?

Remove the policy and reassign it at the resource group scope

Changing scope does not automatically fix existing resources that already missed the tag.

Grant the policy assignment Reader access

RBAC permissions do not cause the policy engine to update existing resources.

Apply a CanNotDelete lock to the subscription

A lock prevents deletion, but it does not add missing tags or remediate policy compliance.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create a remediation task for the policy assignment — When a policy is already assigned and you want existing resources to be updated to match it, the next step is to create a remediation task. Remediation tells Azure Policy to apply the effect to resources that were created before the assignment or before the compliance change. This is the practical step that turns a policy from being only preventive for new resources into one that also corrects drift. Why others are wrong: Reassigning the policy elsewhere does not automatically update already deployed virtual machines. RBAC roles are unrelated to policy remediation. A lock only controls deletion or write access and does not correct configuration drift. The key point is that existing noncompliant resources often need a remediation task after the policy is assigned.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.