Based on the exhibit, an Azure Policy with the Modify effect was assigned to add Environment=Prod to resources in RG-Prod. New resources get the tag, but existing virtual machines still do not have it. What should the administrator do next?

Move the policy assignment to the subscription scope.

Changing the scope does not automatically update existing resources. The assignment is already at the correct RG scope for the requirement.

Change the policy effect from Modify to Deny.

Deny would block noncompliant deployments, but it still would not backfill tags onto existing virtual machines.

Add a CanNotDelete lock to RG-Prod.

A lock protects against deletion, but it has nothing to do with evaluating or correcting tag compliance.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Create a remediation task for the policy assignment. — Modify policies commonly affect new or updated resources, but existing noncompliant resources often require remediation to be brought into compliance. By creating a remediation task, the administrator instructs Azure Policy to evaluate and update the already deployed VMs so the Environment tag is applied consistently. This is the correct operational step after the policy assignment is in place. Why others are wrong: Moving the assignment does not trigger retroactive updates by itself. Deny is about preventing future noncompliant creation, not fixing existing resources. Locks do not interact with policy remediation or tags, so they cannot solve the missing tag issue.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.