AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Policy to enforce governance rules across its subscriptions. The governance team wants to ensure that every resource in the 'Production' subscription has a tag named 'Environment' with the value 'Production'. If a resource is created without this tag, or with a different value, the tag must be automatically corrected to 'Production' without blocking the creation of the resource. Which Azure Policy effect should the team configure?
⚠ Common exam trap
It's easy for candidates to confuse Append with Modify: Append only adds missing tags but cannot change existing values, while Modify can both add and change tags, making it the correct choice for enforcing a specific value.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify
The Modify effect is correct because it automatically applies the required tag value to resources during creation or update without blocking the operation. Unlike Append, which only adds tags to new resources but cannot change existing values, Modify can alter both new and existing resources to enforce the desired tag value. This ensures that any resource created without the 'Environment' tag or with a different value is automatically corrected to 'Production'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The Deny effect is a hard enforcement mechanism that blocks any resource creation or update if the resource does not comply with the defined policy rule. In this scenario, Deny would prevent the deployment of resources with an incorrect 'Environment' tag value, causing the user's request to fail outright. The requirement explicitly wants resources to be created and then automatically corrected, not blocked, making Deny unsuitable because it offers no remediation and disrupts operational workflows.
When this WOULD be correct
An organization wants to prevent any resource from being created without a specific tag value, such as ensuring all resources have a 'CostCenter' tag. Deny would block non-compliant creation.
- ✗
Audit
Why it's wrong here
The Audit effect is a passive monitoring mechanism that records a compliance event in the Azure activity log or policy compliance report when a resource violates the policy. It does not alter the resource, fix the tag value, or prevent the non-compliance; it simply flags the issue for manual inspection. Because the team needs automatic correction of the 'Environment' tag to 'Production', Audit fails to satisfy the requirement — it only surfaces the problem without resolving it.
When this WOULD be correct
When the requirement is to log non-compliant resources for reporting or manual review, without automatically modifying them. For example, to identify resources missing a required tag for compliance auditing.
- ✗
Append
Why it's wrong here
The Append effect can add additional fields (like tags) to a resource during creation or update, but it cannot modify existing tag values. If a resource already has the 'Environment' tag with a different value, Append will not change it, leaving the resource non-compliant.
When this WOULD be correct
A scenario where the requirement is to add a missing tag to resources without modifying existing tags, such as ensuring all resources have a 'CostCenter' tag if not already present, without altering any existing tag values.
- ✓
Modify
Why this is correct
The Modify effect is designed to add, update, or remove properties of a resource to ensure compliance. It can automatically correct tag values (e.g., set 'Environment' to 'Production') even if the user provides a different value, without blocking the resource creation. This matches the requirement exactly.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓ModifyCorrect answer▾
Why this is correct
The Modify effect is designed to add, update, or remove properties of a resource to ensure compliance. It can automatically correct tag values (e.g., set 'Environment' to 'Production') even if the user provides a different value, without blocking the resource creation. This matches the requirement exactly.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny blocks resource creation if the tag is missing or incorrect, but the requirement is to automatically correct the tag without blocking creation.
★ When this WOULD be the correct answer
An organization wants to prevent any resource from being created without a specific tag value, such as ensuring all resources have a 'CostCenter' tag. Deny would block non-compliant creation.
Why candidates choose this
Candidates may think Deny is the only way to enforce tagging, not realizing Modify can automatically correct tags without blocking creation.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources without taking any automatic remediation action, so it cannot automatically correct the tag value as required.
★ When this WOULD be the correct answer
When the requirement is to log non-compliant resources for reporting or manual review, without automatically modifying them. For example, to identify resources missing a required tag for compliance auditing.
Why candidates choose this
Candidates may confuse 'Audit' with a corrective action, thinking it will automatically fix the tag, or they may focus on the logging aspect without realizing the need for automatic remediation.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The Append effect adds a tag only if it is missing, but does not correct an existing tag with a different value. The question requires automatic correction of an incorrect tag value, which only the Modify effect can do.
★ When this WOULD be the correct answer
A scenario where the requirement is to add a missing tag to resources without modifying existing tags, such as ensuring all resources have a 'CostCenter' tag if not already present, without altering any existing tag values.
Why candidates choose this
Candidates may confuse Append with Modify, thinking Append can also update existing values, or they may overlook the specific requirement to correct an incorrect tag value, focusing only on adding missing tags.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.