AZ-900 Describe Azure management and governance Practice Question
A company has a governance requirement that every Azure virtual machine must have a tag named 'CostCenter' with the value 'Unassigned'. If a user creates a VM without the tag, or with a different value for that tag, the tag should be automatically corrected to 'Unassigned' immediately upon resource creation. The IT team is writing an Azure Policy definition to enforce this. Which Policy effect should they use?
⚠ Common exam trap
Many exam-takers choose Deny thinking it enforces compliance by blocking non-compliant resources, but the question explicitly requires automatic correction, not rejection, making Modify the only effect that performs the required remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify
The Modify effect is correct because it automatically corrects non-compliant tags (missing or wrong value) to the specified value ('Unassigned') during resource creation or update, without blocking the deployment. This satisfies the requirement for immediate, automatic remediation without denying the VM creation entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The Deny effect prevents a resource from being created or updated if it fails the policy condition, such as missing the essential tag. It acts as a proactive guardrail that forces the requesting user to fix the issue before submission, but it never modifies the resource itself. Since the requirement explicitly calls for automatic corrective action (setting the tag) rather than blocking VM creation, Deny is not a valid solution in this scenario.
When this WOULD be correct
If the governance requirement was to block creation of VMs without the 'CostCenter' tag or with an incorrect value, and the IT team wanted to enforce compliance by preventing non-compliant resources, then Deny would be the correct effect.
- ✗
Audit
Why it's wrong here
The Audit effect only writes a compliance event to the Azure Activity Log when a resource is found non-compliant, functioning as a reporting and monitoring mechanism. It does not alter the resource in any way, so a VM without the required tag remains non-compliant and the tag is never applied or corrected. Thus, Audit cannot fulfill the requirement to automatically correct the tag value on every VM.
When this WOULD be correct
If the requirement was to log non-compliant VMs for reporting or manual review without automatic remediation, Audit would be correct.
- ✓
Modify
Why this is correct
The Modify effect in Azure Policy is explicitly designed to add, change, or remove properties (such as tags) on resources during creation and through remediation tasks. It uses a managed identity to append or update the tag value automatically, so every VM gets the correct tag without any manual intervention. Because it corrects the tag rather than blocking the VM creation, it directly meets the governance requirement to automatically set the tag to the right value.
- ✗
DeployIfNotExists
Why it's wrong here
DeployIfNotExists is used to deploy an additional resource (e.g., a network security group) to the resource's location when the resource is created. It is not designed to modify properties like tags on the existing resource, so it is incorrect.
When this WOULD be correct
DeployIfNotExists would be correct if the policy needed to deploy a missing resource (e.g., a network security group) to VMs that are non-compliant, and the deployment could occur asynchronously after creation, not requiring immediate correction.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓ModifyCorrect answer▾
Why this is correct
The Modify effect in Azure Policy is explicitly designed to add, change, or remove properties (such as tags) on resources during creation and through remediation tasks. It uses a managed identity to append or update the tag value automatically, so every VM gets the correct tag without any manual intervention. Because it corrects the tag rather than blocking the VM creation, it directly meets the governance requirement to automatically set the tag to the right value.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny prevents creation of non-compliant resources, but the requirement is to automatically correct the tag value, not block creation. Deny would reject the VM entirely, which is not the desired behavior.
★ When this WOULD be the correct answer
If the governance requirement was to block creation of VMs without the 'CostCenter' tag or with an incorrect value, and the IT team wanted to enforce compliance by preventing non-compliant resources, then Deny would be the correct effect.
Why candidates choose this
Candidates may think Deny is the strictest enforcement and assume it can correct tags by blocking creation, but they overlook that the requirement is to auto-correct, not block.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources but does not automatically correct the tag value to 'Unassigned', failing the requirement for immediate automatic correction.
★ When this WOULD be the correct answer
If the requirement was to log non-compliant VMs for reporting or manual review without automatic remediation, Audit would be correct.
Why candidates choose this
Candidates may confuse Audit with a monitoring effect that can trigger remediation, or think logging is sufficient to meet the enforcement requirement.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists does not automatically correct tags on existing resources; it only deploys a resource (e.g., a remediation task) to non-compliant resources after evaluation, not immediately upon creation. The requirement is for immediate automatic correction, which Modify provides.
★ When this WOULD be the correct answer
DeployIfNotExists would be correct if the policy needed to deploy a missing resource (e.g., a network security group) to VMs that are non-compliant, and the deployment could occur asynchronously after creation, not requiring immediate correction.
Why candidates choose this
Candidates may confuse DeployIfNotExists with Modify because both can alter resources, but DeployIfNotExists is for deploying additional resources, not modifying existing properties like tags.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.