AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Policy to enforce resource tagging. The governance team creates a policy that requires all resources in a subscription to have a 'CostCenter' tag. However, the team does not want to block resource creation if the tag is missing. Instead, they want the policy to automatically add the tag with a default value of 'Unassigned' to any new resource that is created without the tag. Which Azure Policy effect should the team configure in the policy definition?
⚠ Common exam trap
Many candidates confuse DeployIfNotExists with Modify, as both can remediate non-compliance, but DeployIfNotExists deploys a separate resource (like an extension) while Modify directly changes properties of the evaluated resource itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify
The Modify effect is correct because it allows Azure Policy to automatically add or change a tag on a resource during creation or update without blocking the operation. This matches the requirement to add the 'CostCenter' tag with a default value of 'Unassigned' to any new resource missing it, while still permitting resource creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The Deny effect in Azure Policy blocks resource creation or modification when the policy condition is not met, returning a denial response (such as a 403) to the requester. While a Deny policy could be written to forbid resources without the 'CostCenter' tag, this would reject the creation instead of automatically adding the tag. That behavior directly contradicts the requirement to enforce tagging by auto-adding the tag, so Deny is incorrect for this scenario.
When this WOULD be correct
A scenario where the governance team wants to prevent any resource from being created without a required tag, and they are willing to block non-compliant resources entirely.
- ✗
Audit
Why it's wrong here
The Audit effect in Azure Policy generates a compliance alert by recording events in the activity log and showing non-compliance in the Azure Policy compliance dashboard, but it does not modify resource properties. It cannot automatically add the 'CostCenter' tag; it only flags the resource as non-compliant after the resource has already been created without the tag. Since the scenario requires automatic addition of the tag, Audit alone is insufficient.
When this WOULD be correct
A governance team wants to identify resources missing a required tag for reporting purposes, but does not want to automatically modify or block them. They need to track compliance without enforcement.
- ✗
DeployIfNotExists
Why it's wrong here
The DeployIfNotExists effect in Azure Policy evaluates whether a resource that should exist is missing, and if so, deploys that specific type of resource, such as an agent or extension, typically during remediation. It is not designed to modify the properties of the resource that is being created; it cannot add a tag to the resource itself. For tagging, the Modify effect is the appropriate effect, so DeployIfNotExists is incorrect here.
When this WOULD be correct
A policy must deploy a Log Analytics extension to VMs that do not have it installed, without modifying the VM's existing configuration. DeployIfNotExists would be correct because it deploys a new resource (the extension) when a VM lacks it.
- ✓
Modify
Why this is correct
The Modify effect in Azure Policy can add, update, or remove tags (or other properties) on resources at creation or during remediation. For this scenario, a policy definition with the Modify effect would include an operation to add the 'CostCenter' tag with a default value, automatically applying it to resources without blocking the deployment. Because the modification happens transparently as part of the resource creation process, the resource is created successfully with the tag already in place, making this the correct choice.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓ModifyCorrect answer▾
Why this is correct
The Modify effect in Azure Policy can add, update, or remove tags (or other properties) on resources at creation or during remediation. For this scenario, a policy definition with the Modify effect would include an operation to add the 'CostCenter' tag with a default value, automatically applying it to resources without blocking the deployment. Because the modification happens transparently as part of the resource creation process, the resource is created successfully with the tag already in place, making this the correct choice.
✗DenyWrong answer — click to see why▾
Why this is wrong here
The 'Deny' effect blocks resource creation when the tag is missing, but the question requires the policy to automatically add the tag with a default value, not block creation.
★ When this WOULD be the correct answer
A scenario where the governance team wants to prevent any resource from being created without a required tag, and they are willing to block non-compliant resources entirely.
Why candidates choose this
Candidates may confuse 'Deny' with 'Modify' because both enforce compliance, but 'Deny' is a hard block while 'Modify' allows creation and then auto-corrects.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources without taking any automatic remediation action, so it cannot add the missing tag with a default value.
★ When this WOULD be the correct answer
A governance team wants to identify resources missing a required tag for reporting purposes, but does not want to automatically modify or block them. They need to track compliance without enforcement.
Why candidates choose this
Candidates may think Audit is sufficient because it detects non-compliance, but they overlook the requirement for automatic remediation (adding the tag).
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists can deploy a resource (like a Log Analytics agent) if a condition is not met, but it cannot modify existing resource properties like tags. The question requires automatically adding a tag to the resource itself, which is only possible with the Modify effect.
★ When this WOULD be the correct answer
A policy must deploy a Log Analytics extension to VMs that do not have it installed, without modifying the VM's existing configuration. DeployIfNotExists would be correct because it deploys a new resource (the extension) when a VM lacks it.
Why candidates choose this
Candidates may confuse DeployIfNotExists with Modify because both can 'fix' non-compliant resources, but DeployIfNotExists only deploys additional resources, not modify existing ones.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.