AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your organization plans to use Azure Policy to enforce tagging on all resources. The tags must include 'CostCenter' and 'Environment'. Resources that do not have these tags should be automatically remediated. What should you use?
⚠ Common exam trap
It's easy for candidates to confuse 'append' with 'deployIfNotExists', thinking that 'append' can remediate existing resources, but 'append' only applies during resource creation or update, not to already deployed resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A policy with 'deployIfNotExists' effect and a remediation task
The 'deployIfNotExists' effect is correct because it allows Azure Policy to evaluate resources for missing tags and then deploy a remediation task that automatically adds the required tags. This effect is specifically designed for scenarios where non-compliance can be corrected by deploying or modifying resources, such as adding tags via a policy definition that triggers a remediation task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A policy with 'append' effect
Why it's wrong here
The append effect is only evaluated during create or update operations, so a tagless resource that already exists will remain unchanged unless a change is made to that resource. Append cannot be retroactively applied to existing resources via a remediation task, since remediation tasks are only supported for the modify and deployIfNotExists effects. This makes it ineffective for closing the compliance gap on your current inventory, even though it works well for tagging new resources.
- ✗
A policy with 'audit' effect
Why it's wrong here
Audit simply marks non-compliant resources in the policy compliance report and writes an activity log entry; it has no code path to alter the resource. While it is useful for measuring the size of the problem or listing which resources need attention, it offers zero remediation capability. Therefore, it fails the requirement to actually enforce tagging because the tags would never be added automatically.
- ✓
A policy with 'deployIfNotExists' effect and a remediation task
Why this is correct
DeployIfNotExists is evaluated periodically and can trigger a template deployment when a resource lacks the required tag, and a remediation task can be started after the policy is assigned to proactively fix all existing non-compliant resources. The remediation task uses managed identity to modify those resources by executing the linked ARM template that attaches the tag, bringing the current inventory into compliance without requiring a manual update. This combination is the only one among the choices that both detects and corrects pre-existing resources.
- ✗
A policy with 'deny' effect
Why it's wrong here
The deny effect blocks creation or update requests when a resource doesn't have the required tag, but it never touches any resource that was already deployed before the policy took effect. Because enforcement happens at request time, deny only establishes a hardened boundary for future changes and cannot remediate the existing resources that triggered the compliance report. This leaves the current non-compliant resources untouched, so it cannot by itself satisfy the requirement.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.