AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Policy to enforce that all virtual machines must be from an approved list of SKUs. They want to ensure that any non-compliant VMs that already exist are automatically remediated by changing the VM size to a compliant SKU. Which policy effect should they use?
⚠ Common exam trap
Test-takers frequently confuse Append with Modify, but Append only adds to arrays or strings and cannot change an existing value like a VM SKU, while Modify is designed for altering existing properties.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify
The Modify effect is correct because it allows Azure Policy to automatically change non-compliant resources to a compliant state during evaluation. In this scenario, it can alter the VM size to an approved SKU without manual intervention, ensuring continuous compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The Deny effect prevents a non-compliant resource from being created or updated at deployment time, but it does nothing to resources that already exist. If a virtual machine was deployed before the policy was assigned and has a non-compliant size, Deny will not intervene or modify that VM. It only blocks future attempts to create or change the resource, leaving the existing VM non-compliant until someone manually fixes it.
When this WOULD be correct
Use Deny when the requirement is to block the creation of non-compliant resources entirely, such as preventing deployment of VMs outside an approved list of SKUs, without needing to fix existing ones.
- ✗
Audit
Why it's wrong here
The Audit effect simply records a warning in the Azure Activity Log when a resource is evaluated as non-compliant, but it makes zero changes to the resource itself. For a virtual machine with an incorrect size, Audit would flag it in compliance reports and logs, yet the VM size remains unchanged. Therefore, while useful for monitoring compliance history, it does not enforce the policy by altering the VM to a compliant state.
When this WOULD be correct
When the requirement is to identify and report non-compliant VMs without automatic remediation, such as for compliance auditing or monitoring purposes.
- ✗
Append
Why it's wrong here
The Append effect adds extra fields — such as tags or mandatory metadata — to a resource when it is created or updated, but it cannot modify existing values like the VM size. It operates by appending content to the resource properties, not by replacing or resizing an existing VM. Consequently, even with Append assigned, a currently non-compliant virtual machine would keep its original size, making this effect ineffective for the stated requirement.
When this WOULD be correct
A policy requires that all new virtual machines must have a specific tag (e.g., 'CostCenter') added automatically if missing. The Append effect would add the tag during resource creation or update.
- ✓
Modify
Why this is correct
The Modify effect in Azure Policy actively changes properties of existing resources by running a remediation task through a managed identity. When a virtual machine is found non-compliant — such as having the wrong VM size — the remediation task alters the property to match the policy's definition. This is the only effect among these that both identifies and fixes a pre-existing non-compliant resource automatically, without requiring manual redeployment or creation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓ModifyCorrect answer▾
Why this is correct
The Modify effect in Azure Policy actively changes properties of existing resources by running a remediation task through a managed identity. When a virtual machine is found non-compliant — such as having the wrong VM size — the remediation task alters the property to match the policy's definition. This is the only effect among these that both identifies and fixes a pre-existing non-compliant resource automatically, without requiring manual redeployment or creation.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny prevents non-compliant resources from being created or updated, but it does not remediate existing non-compliant VMs by changing their SKU.
★ When this WOULD be the correct answer
Use Deny when the requirement is to block the creation of non-compliant resources entirely, such as preventing deployment of VMs outside an approved list of SKUs, without needing to fix existing ones.
Why candidates choose this
Candidates may think Deny is the strongest enforcement, but they overlook that it only applies to new or updated resources, not existing non-compliant ones.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources without taking any remediation action, so it cannot automatically change VM sizes to compliant SKUs.
★ When this WOULD be the correct answer
When the requirement is to identify and report non-compliant VMs without automatic remediation, such as for compliance auditing or monitoring purposes.
Why candidates choose this
Candidates may confuse Audit with Modify, thinking that Audit includes some form of automatic correction, or they may overlook the need for remediation in the question.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The Append effect adds fields or values to a resource during creation or update but cannot change existing values like VM SKUs. It is not designed for automatic remediation of non-compliant resources.
★ When this WOULD be the correct answer
A policy requires that all new virtual machines must have a specific tag (e.g., 'CostCenter') added automatically if missing. The Append effect would add the tag during resource creation or update.
Why candidates choose this
Candidates may confuse Append with Modify, thinking both can alter resources, but Append only adds to existing properties and cannot change values like SKUs.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.