AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Policy evaluation output Definition name: Require-Environment Assignment scope: /subscriptions/1111-2222 Compliance state: Non-compliant Non-compliant resource: stapp01 Reason: Missing tag 'Environment' Requirement: Any new resource created without the Environment tag must be prevented from deploying.
Based on the exhibit, which Azure Policy effect should be used so new resources without an Environment tag are blocked at deployment time?
⚠ Common exam trap
Watch out — candidates often confuse 'Audit' with 'Deny' because both can report non-compliance, but only Deny actively prevents the deployment, whereas Audit merely logs the violation without blocking it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The Deny effect (Option C) is the correct choice because it actively blocks any deployment that does not meet the policy rule—in this case, resources lacking an Environment tag. When a policy with Deny is assigned, Azure Resource Manager evaluates the request during deployment and rejects it with a 403 (Forbidden) status if the condition is not satisfied, preventing the resource from being created entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit
Why it's wrong here
The Audit effect creates a warning in the Azure Activity Log when a noncompliant resource is deployed, but it does not interfere with the deployment process. The resource is successfully created and later appears as 'Non-compliant' in policy compliance reports, but this is corrective reporting rather than enforcement. Therefore, Audit cannot block resources missing the required tag and is unsuitable for the stated requirement.
When this WOULD be correct
An exam question asks: 'Which policy effect should be used to log non-compliant resources without blocking deployment?' Audit would be correct because it creates a compliance log entry without preventing resource creation.
- ✗
Append
Why it's wrong here
The Append effect takes action during evaluation by adding or modifying fields on the incoming request, typically to inject a default tag value when none exists. However, it does not stop deployment; if the append operation fails or the resource type does not support it, the request may still proceed, and it never returns a denial. Append is intended for remediation-like scenarios, not for blocking noncompliant resources, so it cannot enforce a strict tag requirement.
When this WOULD be correct
When the requirement is to automatically add a missing tag (e.g., 'Environment') with a default value to all new resources during deployment, without blocking the deployment.
- ✓
Deny
Why this is correct
The Deny effect evaluates the requested resource during deployment and, if the condition (e.g., missing required tag) is not satisfied, returns an error that stops the entire deployment from succeeding. Unlike Audit, it does not simply report; it actively blocks creation of any noncompliant resources, which is the precise behavior needed to enforce a mandatory tag. This is the strongest enforcement effect in Azure Policy and is the correct choice here.
- ✗
Disabled
Why it's wrong here
Disabled turns off the policy rule entirely, meaning Azure Policy will not evaluate or enforce anything for this policy. As a result, all resources can be created without any checks for the required tag, and no compliance activity is logged. This is used only to temporarily deactivate a policy without deleting the assignment, but it completely defeats the blocking requirement.
When this WOULD be correct
A question asks: 'You need to temporarily disable a policy assignment without deleting it, to test the impact of a new policy effect. Which effect should you set?' In that case, 'Disabled' is correct because it deactivates the policy while preserving the assignment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓DenyCorrect answer▾
Why this is correct
The Deny effect evaluates the requested resource during deployment and, if the condition (e.g., missing required tag) is not satisfied, returns an error that stops the entire deployment from succeeding. Unlike Audit, it does not simply report; it actively blocks creation of any noncompliant resources, which is the precise behavior needed to enforce a mandatory tag. This is the strongest enforcement effect in Azure Policy and is the correct choice here.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit logs non-compliant resources but does not block deployment; the question requires blocking new resources at deployment time, which only Deny can do.
★ When this WOULD be the correct answer
An exam question asks: 'Which policy effect should be used to log non-compliant resources without blocking deployment?' Audit would be correct because it creates a compliance log entry without preventing resource creation.
Why candidates choose this
Candidates may confuse Audit with Deny, thinking that logging non-compliance is sufficient to enforce tagging, or they may not fully understand that Audit does not block deployment.
✗AppendWrong answer — click to see why▾
Why this is wrong here
Append adds a tag or value to a resource but does not block deployment; it modifies the resource after creation, so it cannot prevent untagged resources from being deployed.
★ When this WOULD be the correct answer
When the requirement is to automatically add a missing tag (e.g., 'Environment') with a default value to all new resources during deployment, without blocking the deployment.
Why candidates choose this
Candidates may think Append can enforce tagging by adding the tag automatically, but they overlook that Append does not prevent deployment of resources that lack the tag—it only modifies them after creation.
✗DisabledWrong answer — click to see why▾
Why this is wrong here
The 'Disabled' effect turns off the policy definition, meaning it does not evaluate or enforce any rule. It would not block resources missing the Environment tag at deployment time.
★ When this WOULD be the correct answer
A question asks: 'You need to temporarily disable a policy assignment without deleting it, to test the impact of a new policy effect. Which effect should you set?' In that case, 'Disabled' is correct because it deactivates the policy while preserving the assignment.
Why candidates choose this
Candidates might think 'Disabled' means the policy is inactive and thus won't block anything, but they fail to realize the question requires an effect that actively blocks deployment, not one that does nothing.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which Azure service is preventing deployment because the resource is missing a required tag?
easy- ✓ A.Azure Policy
- B.Azure RBAC
- C.Resource locks
- D.Azure Monitor
Why A: Azure Policy is the correct answer because it enforces organizational standards and compliance rules, such as requiring specific tags on resources. When a policy is defined to require a tag (e.g., 'CostCenter') and a deployment attempts to create a resource without that tag, Azure Policy evaluates the request against the policy assignment and denies the deployment. This is a built-in capability of Azure Policy, not a permission or lock mechanism.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.