AZ-104 Manage Azure Identities and Governance Practice Question
Your organization requires all storage accounts to allow access only from selected networks. You need a governance solution that automatically corrects noncompliant new storage accounts when possible instead of only reporting them. What policy effect should you choose?
⚠ Common exam trap
Candidates often choose Append thinking it can modify network rules, but Append only adds properties to the resource (like tags) and cannot change existing network access configurations, whereas DeployIfNotExists can deploy a full remediation template.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeployIfNotExists
The DeployIfNotExists policy effect is correct because it can automatically remediate noncompliant storage accounts by deploying a network rules configuration that restricts access to selected networks. Unlike Audit, which only reports compliance status, DeployIfNotExists actively modifies the resource to meet the policy requirement when possible, aligning with the need for automatic correction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit
Why it's wrong here
Audit is incorrect because it only evaluates and logs the compliance state of storage accounts, emitting a compliance event but making no changes to the resource. While Audit is useful for continuous monitoring and reporting, it leaves noncompliant storage accounts fully accessible or misconfigured, so it cannot satisfy a requirement that all storage accounts be actively brought into or kept in a compliant state.
When this WOULD be correct
When the requirement is to log and report noncompliance for audit purposes without automatic remediation, such as for initial compliance assessment or monitoring only.
- ✗
Disabled
Why it's wrong here
Disabled is incorrect because it simply turns off the policy effect entirely, meaning the policy rule is not evaluated and no compliance or remediation actions occur. Selecting Disabled would make the assignment inert, providing neither detection nor enforcement, which directly contradicts the organization's mandate to require access controls on all storage accounts.
When this WOULD be correct
If the organization wants to temporarily turn off a policy without deleting it, for example during maintenance or testing, the Disabled effect would be correct to prevent the policy from applying.
- ✓
DeployIfNotExists
Why this is correct
DeployIfNotExists is the correct effect because it actively deploys a required configuration—such as a network rule or Service Endpoint—when the policy engine detects that a storage account is noncompliant. This effect supports automatic remediation by triggering a deployment task that brings the resource into compliance without manual intervention, making it the only listed effect that both identifies and fixes the misconfiguration.
- ✗
Append
Why it's wrong here
Append is incorrect because it only adds or modifies resource properties at creation or update time, and it cannot remediate existing noncompliant storage accounts. In scenarios where the required setting is a complex ARM property like a network ACL or a diagnostic setting, Append may fail or be overwritten, and it does not integrate with Azure Policy's remediation tasks to correct already-deployed resources.
When this WOULD be correct
Append would be correct if the policy needed to add a tag or a specific setting (like a network ACL rule) to an existing storage account that is already compliant in other aspects, without deploying a new resource or modifying the entire resource configuration.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓DeployIfNotExistsCorrect answer▾
Why this is correct
DeployIfNotExists is the correct effect because it actively deploys a required configuration—such as a network rule or Service Endpoint—when the policy engine detects that a storage account is noncompliant. This effect supports automatic remediation by triggering a deployment task that brings the resource into compliance without manual intervention, making it the only listed effect that both identifies and fixes the misconfiguration.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only reports noncompliant resources without taking any automatic remediation action, but the requirement is to automatically correct noncompliant storage accounts.
★ When this WOULD be the correct answer
When the requirement is to log and report noncompliance for audit purposes without automatic remediation, such as for initial compliance assessment or monitoring only.
Why candidates choose this
Candidates may think Audit is sufficient for governance, overlooking the need for automatic correction specified in the question.
✗DisabledWrong answer — click to see why▾
Why this is wrong here
Disabled policy effect means the policy is not evaluated, so it cannot automatically correct noncompliant storage accounts. The question requires automatic correction, not ignoring the policy.
★ When this WOULD be the correct answer
If the organization wants to temporarily turn off a policy without deleting it, for example during maintenance or testing, the Disabled effect would be correct to prevent the policy from applying.
Why candidates choose this
Candidates might think 'Disabled' could prevent noncompliant resources by blocking them, but it actually means the policy is inactive and does nothing.
✗AppendWrong answer — click to see why▾
Why this is wrong here
Append adds configuration to existing resources but cannot deploy new resources like a storage account with network rules; it only modifies existing properties, so it cannot automatically correct noncompliant new storage accounts by deploying the required network rules.
★ When this WOULD be the correct answer
Append would be correct if the policy needed to add a tag or a specific setting (like a network ACL rule) to an existing storage account that is already compliant in other aspects, without deploying a new resource or modifying the entire resource configuration.
Why candidates choose this
Candidates may think Append can 'fix' noncompliant resources by adding missing settings, but they overlook that Append cannot create or deploy new resources; it only modifies existing ones, making it unsuitable for correcting new storage accounts that lack network rules entirely.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.