AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Policy to require that all storage accounts must have blob soft delete enabled. They also want to automatically create a remediation task that fixes any existing non-compliant storage accounts. Which policy effect should they include in the policy definition to achieve automatic remediation?
⚠ Common exam trap
A common mix-up: candidates confuse 'Audit' (which only reports) with 'DeployIfNotExists' (which actually fixes), or assume 'Deny' can retroactively fix existing resources, when it only blocks new non-compliant changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeployIfNotExists
The DeployIfNotExists effect is designed to automatically remediate non-compliant resources by deploying a defined template (e.g., enabling blob soft delete) when the resource is evaluated as non-compliant. This effect triggers a remediation task that can be run on existing resources, ensuring all storage accounts meet the policy requirement without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The Deny effect blocks the creation or update of a resource when the policy evaluation finds it non-compliant, returning a 403 Forbidden error to the requester. This prevention happens at the time of the request, but the effect does not scan or modify resources that already exist before the policy is assigned. Consequently, while Deny prevents new non-compliant storage accounts, it cannot remediate existing ones that became non-compliant earlier.
When this WOULD be correct
A policy definition that must block the creation or modification of storage accounts without blob soft delete enabled. For example, a company wants to enforce that no new storage accounts can be created without soft delete, and any attempt to create one is denied.
- ✗
Audit
Why it's wrong here
The Audit effect in Azure Policy only writes a compliance event to the activity log or resource logs when a resource is evaluated, without any action to modify the resource itself. It is used for monitoring and reporting on compliance posture, such as flagging storage accounts that do not meet encryption requirements, but it never changes the resource configuration. Therefore, audit cannot remediate existing non-compliant storage accounts because it lacks any deployment or modification capability.
When this WOULD be correct
If the question asked for a policy effect that logs compliance state for reporting without automatically fixing resources, Audit would be correct.
- ✓
DeployIfNotExists
Why this is correct
DeployIfNotExists is an Azure Policy effect that automatically deploys a desired configuration to existing resources that are non-compliant, using a linked managed identity with the necessary permissions. When the policy is assigned, it evaluates existing resources and creates remediation tasks that trigger a deployment to bring them into compliance. This effect is specifically designed for automatic remediation and is the only option among these that actively fixes already provisioned storage accounts.
- ✗
Append
Why it's wrong here
The Append effect adds a specified set of fields, such as tags or resource settings, to a resource during a create or update operation, but it does not run on existing resources that are not being modified. It is most useful for enriching resources with required properties at the moment of provisioning, but it cannot retroactively apply a configuration to existing storage accounts that are already deployed. Unlike DeployIfNotExists, Append does not create a remediation task and only works if the resource is being created or updated as part of the request.
When this WOULD be correct
Append would be correct if the policy needed to add a tag or enforce a setting (like enabling blob soft delete) on new or updated storage accounts during creation/modification, without requiring remediation of existing resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DeployIfNotExistsCorrect answer▾
Why this is correct
DeployIfNotExists is an Azure Policy effect that automatically deploys a desired configuration to existing resources that are non-compliant, using a linked managed identity with the necessary permissions. When the policy is assigned, it evaluates existing resources and creates remediation tasks that trigger a deployment to bring them into compliance. This effect is specifically designed for automatic remediation and is the only option among these that actively fixes already provisioned storage accounts.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny prevents non-compliant resources from being created or updated, but it does not automatically remediate existing non-compliant storage accounts. The question requires automatic remediation of existing resources, which Deny cannot do.
★ When this WOULD be the correct answer
A policy definition that must block the creation or modification of storage accounts without blob soft delete enabled. For example, a company wants to enforce that no new storage accounts can be created without soft delete, and any attempt to create one is denied.
Why candidates choose this
Candidates may confuse prevention of new violations (Deny) with remediation of existing violations. They might think that blocking non-compliant resources is sufficient to achieve compliance, overlooking the need to fix already non-compliant resources.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs compliance state without taking action; it cannot automatically remediate non-compliant storage accounts by enabling blob soft delete.
★ When this WOULD be the correct answer
If the question asked for a policy effect that logs compliance state for reporting without automatically fixing resources, Audit would be correct.
Why candidates choose this
Candidates may confuse Audit with DeployIfNotExists, thinking that logging compliance is sufficient for remediation, or they may not understand that Audit does not trigger automatic fixes.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The Append effect adds configuration to a resource during creation or update but does not trigger remediation tasks for existing non-compliant resources. It cannot automatically fix existing storage accounts that lack blob soft delete.
★ When this WOULD be the correct answer
Append would be correct if the policy needed to add a tag or enforce a setting (like enabling blob soft delete) on new or updated storage accounts during creation/modification, without requiring remediation of existing resources.
Why candidates choose this
Candidates may confuse Append with DeployIfNotExists because both can modify resources, but Append only works on create/update operations and cannot remediate existing non-compliant resources.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.