Finance wants every resource created in one production resource group to receive the tag CostCenter=FINSVC automatically, but deployments should not be blocked if a template omits the tag. Existing resources should be updated when possible. Which two actions should the administrator take? Select two.

Apply a ReadOnly lock to the resource group to keep tags consistent.

ReadOnly would block normal operational changes, including the tag updates you are trying to automate. It is not a tagging strategy.

Assign Reader to the resource group to ensure tag visibility.

Reader provides visibility but does not create or modify tags. It has no effect on compliance enforcement.

Use only an Audit policy so teams can see missing tags.

Audit reports noncompliance but does not correct it. The scenario specifically requires automatic tagging when possible.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Assign a Modify policy that adds or updates the CostCenter tag. — A Modify policy is the best fit because it can add or update the CostCenter tag without blocking deployments that forget the tag. Existing resources still need a remediation task so Azure can apply the change retroactively where supported. This combination keeps operations flowing while steadily improving tag compliance across both new and existing resources. Why others are wrong: A ReadOnly lock would interfere with normal operations and does not automate tagging. Reader is only a visibility role, not a governance tool. Audit-only policies are useful for reporting but do not satisfy the requirement to add the tag automatically when possible.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.