The correct answer is to create a policy with the Deny effect for new resources and a separate DeployIfNotExists policy with a remediation task for existing resources. This dual approach is necessary because a single Azure Policy effect cannot both block non-compliant deployments and automatically fix existing resources; Deny proactively prevents creation without the CostCenter tag, while DeployIfNotExists reactively adds the tag to non-compliant resources via a remediation task. On the AZ-305 exam, this scenario tests your understanding of how policy effects work in tandem across the resource lifecycle, often appearing in questions about governance at the management group level. A common trap is assuming one effect can handle both requirements, but remember: Deny stops the bad, DeployIfNotExists fixes the old. Memory tip: "Deny the new, deploy to renew."
AZ-305 Practice Question: Design identity, governance, and monitoring solutions
This AZ-305 practice question tests your understanding of design identity, governance, and monitoring solutions. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your organization has multiple Azure subscriptions managed through Azure Management Groups. You need to enforce a policy that requires all resources to have a 'CostCenter' tag. If a resource is created without the tag, the deployment should be denied. Additionally, you need to ensure that existing non-compliant resources are automatically remediated. Which combination of actions should you take?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a policy with Deny effect for new resources, and create a remediation task using a DeployIfNotExists policy for existing resources.
Option C is correct because it combines two policy effects to address both requirements: the Deny effect blocks creation of new resources without the 'CostCenter' tag, while a separate DeployIfNotExists policy with a remediation task automatically adds the tag to existing non-compliant resources. This dual approach ensures enforcement for new deployments and automated remediation for existing resources, which is necessary because a single policy effect cannot both deny and remediate simultaneously.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Create a policy with DeployIfNotExists effect only, and rely on periodic evaluation.
Why it's wrong here
DeployIfNotExists does not block new deployments.
✗
Create a policy with Modify effect to add the tag, and assign it at the management group level.
Why it's wrong here
Modify effect auto-corrects but does not block deployments; also, remediation tasks are not needed for Modify.
✓
Create a policy with Deny effect for new resources, and create a remediation task using a DeployIfNotExists policy for existing resources.
Why this is correct
Deny blocks new; remediation fixes existing.
Related concept
Read the scenario before looking for a memorised answer.
✗
Create a policy with Deny effect only, and run a script to tag existing resources.
Why it's wrong here
Using a script is not automated remediation as required.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often think a single policy effect (like Modify or DeployIfNotExists) can both deny new non-compliant resources and remediate existing ones, but Azure Policy requires separate effects for denial and remediation, and Modify does not deny—it silently changes the resource, which may not meet strict governance requirements.
Detailed technical explanation
How to think about this question
Azure Policy uses the Deny effect to prevent non-compliant resource creation by intercepting the PUT request and returning a 403 Forbidden status, while DeployIfNotExists triggers a deployment task (via a linked ARM template) to correct non-compliant resources. Remediation tasks are created and run on demand or on a schedule, leveraging managed identities to perform the corrective action, and they evaluate compliance state based on the policy definition's conditions. In practice, you must assign both policies at the same scope (e.g., management group) and ensure the remediation task has appropriate permissions (e.g., Contributor role) to modify resources.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A startup's cloud architect reviews their monthly bill and notices costs are higher than expected for a long-running batch job. Switching from on-demand instances to Reserved Instances — or using Spot/Preemptible VMs — can reduce compute costs by up to 72 %. Questions like this test whether you understand the tradeoffs between commitment, flexibility, and cost across cloud pricing models.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-305 question in full detail.
Design identity, governance, and monitoring solutions — This question tests Design identity, governance, and monitoring solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create a policy with Deny effect for new resources, and create a remediation task using a DeployIfNotExists policy for existing resources. — Option C is correct because it combines two policy effects to address both requirements: the Deny effect blocks creation of new resources without the 'CostCenter' tag, while a separate DeployIfNotExists policy with a remediation task automatically adds the tag to existing non-compliant resources. This dual approach ensures enforcement for new deployments and automated remediation for existing resources, which is necessary because a single policy effect cannot both deny and remediate simultaneously.
What should I do if I get this AZ-305 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company uses Azure Policy to enforce compliance. You need to ensure that all storage accounts use HTTPS only. The policy should automatically remediate non-compliant storage accounts by enabling HTTPS-only. What policy effect should you use?
easy
A.Deny
B.AuditIfNotExists
C.Append
✓ D.DeployIfNotExists
Why D: The DeployIfNotExists effect is correct because it not only evaluates whether storage accounts have the 'HTTPS only' setting enabled but also automatically deploys a remediation task to enable it when non-compliance is detected. This ensures continuous compliance without manual intervention, which aligns with the requirement for automatic remediation.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.