AZ-900 Describe Azure management and governance Practice Question
A company has a policy that all Azure resources deployed to production subscriptions must be tagged with a 'CostCenter' tag. They want to automatically prevent the creation of any resource that does not include this tag. Which Azure Policy effect should they use in their policy definition?
⚠ Common exam trap
Candidates often confuse the Audit effect (which only reports non-compliance) with the Deny effect (which actively blocks the operation), mistakenly thinking that logging alone is sufficient to enforce a policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The Deny effect is correct because it actively prevents the creation or deployment of any Azure resource that does not comply with the policy rule, such as missing the required 'CostCenter' tag. Unlike Audit, which only logs compliance violations without blocking the operation, Deny enforces the policy at the time of the resource creation request, ensuring non-compliant resources are never provisioned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit
Why it's wrong here
With the Audit effect, the Azure Policy engine logs a compliance event but does not prevent the resource from being created. A resource missing the required tag would still be deployed, and then appear as 'Non-compliant' in the Azure Policy compliance dashboard. Because the company's explicit intent is to prevent deployment of such resources, Audit alone is insufficient as it is a reactive reporting tool rather than a proactive block.
When this WOULD be correct
If the policy goal were to monitor and report resources missing the tag without blocking deployment, Audit would be correct.
- ✓
Deny
Why this is correct
The Deny effect stops a resource from being created or updated when a policy condition is not satisfied, such as a missing required tag. Azure Policy evaluates this during the deployment request, returning an error before any resource is provisioned. This makes it a proactive enforcement mechanism that ensures only compliant resources exist at the moment they are deployed, directly meeting the requirement to block non-compliant production resources.
- ✗
DeployIfNotExists
Why it's wrong here
DeployIfNotExists triggers a remediation action only after a non-compliant resource already exists, typically by deploying a nested resource such as a tag or a configuration. This effect does not intercept the original deployment call, so the resource is created without the tag and then corrected asynchronously. Since the policy goal is to disallow the creation of untagged resources entirely, DeployIfNotExists fails to enforce the requirement at the time of deployment.
When this WOULD be correct
DeployIfNotExists would be correct if the policy required automatically adding the missing 'CostCenter' tag to resources after they are created, rather than preventing creation.
- ✗
Modify
Why it's wrong here
Modify can add tags during creation or update, but it does not block the creation if the tag is missing; it modifies the resource to include the tag. The requirement is to prevent creation, so Deny is appropriate.
When this WOULD be correct
Modify would be correct if the policy required automatically adding the missing 'CostCenter' tag to resources that are created without it, rather than blocking their creation. For example, a policy that ensures all resources have a 'CostCenter' tag by adding a default value if missing.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DenyCorrect answer▾
Why this is correct
The Deny effect stops a resource from being created or updated when a policy condition is not satisfied, such as a missing required tag. Azure Policy evaluates this during the deployment request, returning an error before any resource is provisioned. This makes it a proactive enforcement mechanism that ensures only compliant resources exist at the moment they are deployed, directly meeting the requirement to block non-compliant production resources.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources but does not block creation; the requirement is to prevent creation, which requires Deny.
★ When this WOULD be the correct answer
If the policy goal were to monitor and report resources missing the tag without blocking deployment, Audit would be correct.
Why candidates choose this
Candidates may confuse 'audit' with enforcement, thinking logging non-compliance is sufficient to prevent creation.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists does not prevent resource creation; it only deploys a resource (e.g., a remediation task) after the resource is created, so it cannot block resources missing the tag.
★ When this WOULD be the correct answer
DeployIfNotExists would be correct if the policy required automatically adding the missing 'CostCenter' tag to resources after they are created, rather than preventing creation.
Why candidates choose this
Candidates may think DeployIfNotExists can enforce tagging by automatically adding the tag, but they overlook that it does not block creation and only remediates after the fact.
✗ModifyWrong answer — click to see why▾
Why this is wrong here
Modify is used to add or change tags on existing or new resources, but it does not prevent creation; it only alters the resource after creation or during deployment. The requirement is to block creation entirely, which requires Deny.
★ When this WOULD be the correct answer
Modify would be correct if the policy required automatically adding the missing 'CostCenter' tag to resources that are created without it, rather than blocking their creation. For example, a policy that ensures all resources have a 'CostCenter' tag by adding a default value if missing.
Why candidates choose this
Candidates may confuse Modify with Deny because both can enforce tag compliance, but Modify is less disruptive and seems like a 'softer' enforcement, leading them to choose it over the stricter Deny effect.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.