Azure Policy: Using Deny and DeployIfNotExists to Enforce Tags and Remediate
Your organization has multiple Azure subscriptions managed through Azure Management Groups. You need to enforce a policy that requires all resources to have a 'CostCenter' tag. If a resource is created without the tag, the deployment should be denied. Additionally, you need to ensure that existing non-compliant resources are automatically remediated. Which combination of actions should you take?
Quick Answer
The correct answer is to create a policy with the Deny effect for new resources and a separate DeployIfNotExists policy with a remediation task for existing resources. This dual approach is necessary because a single Azure Policy effect cannot both block non-compliant deployments and automatically fix existing resources; Deny proactively prevents creation without the CostCenter tag, while DeployIfNotExists reactively adds the tag to non-compliant resources via a remediation task. On the AZ-305 exam, this scenario tests your understanding of how policy effects work in tandem across the resource lifecycle, often appearing in questions about governance at the management group level. A common trap is assuming one effect can handle both requirements, but remember: Deny stops the bad, DeployIfNotExists fixes the old. Memory tip: "Deny the new, deploy to renew."
⚠ Common exam trap
It's easy for candidates to think a single policy effect (like Modify or DeployIfNotExists) can both deny new non-compliant resources and remediate existing ones, but Azure Policy requires separate effects for denial and remediation, and Modify does not deny—it silently changes the resource, which may not meet strict governance requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a policy with Deny effect for new resources, and create a remediation task using a DeployIfNotExists policy for existing resources.
It combines two policy effects to address both requirements: the Deny effect blocks creation of new resources without the 'CostCenter' tag, while a separate DeployIfNotExists policy with a remediation task automatically adds the tag to existing non-compliant resources. This dual approach ensures enforcement for new deployments and automated remediation for existing resources, which is necessary because a single policy effect cannot both deny and remediate simultaneously.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a policy with DeployIfNotExists effect only, and rely on periodic evaluation.
Why it's wrong here
DeployIfNotExists does not block new deployments.
- ✗
Create a policy with Modify effect to add the tag, and assign it at the management group level.
Why it's wrong here
Modify effect auto-corrects but does not block deployments; also, remediation tasks are not needed for Modify.
- ✓
Create a policy with Deny effect for new resources, and create a remediation task using a DeployIfNotExists policy for existing resources.
Why this is correct
Deny blocks new; remediation fixes existing.
- ✗
Create a policy with Deny effect only, and run a script to tag existing resources.
Why it's wrong here
Using a script is not automated remediation as required.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-305
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company uses Azure Policy to enforce compliance. You need to ensure that all storage accounts use HTTPS only. The policy should automatically remediate non-compliant storage accounts by enabling HTTPS-only. What policy effect should you use?
easy- A.Deny
- B.AuditIfNotExists
- C.Append
- ✓ D.DeployIfNotExists
Why D: The DeployIfNotExists effect is correct because it not only evaluates whether storage accounts have the 'HTTPS only' setting enabled but also automatically deploys a remediation task to enable it when non-compliance is detected. This ensures continuous compliance without manual intervention, which aligns with the requirement for automatic remediation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.