AZ-900 Describe Azure management and governance Practice Question
A company has a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically audit and deny the creation of any resource that does not include this tag. Which Azure Policy effect should they use?
⚠ Common exam trap
Watch out — candidates often confuse 'Audit' (which only reports) with 'Deny' (which blocks), or mistakenly think 'Append' can enforce a mandatory tag by adding it, but Append does not prevent creation of resources that already lack the tag—it only modifies them after the fact, which violates the 'deny' requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The 'Deny' effect is correct because the company's policy requires that any resource creation attempt missing the 'CostCenter' tag must be blocked entirely, not just reported or modified. Azure Policy's Deny effect actively prevents the resource from being provisioned by rejecting the API call at the Azure Resource Manager level, ensuring non-compliant resources are never created.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deny
Why this is correct
Deny is the only Azure Policy effect that actively blocks deployment at evaluation time. During a PUT/PATCH request, Azure Resource Manager evaluates the applicable policy and, if the resource lacks the required costcenter tag, returns a 403 (Forbidden) response and the resource is never created. This makes Deny a preventive control that guarantees non-compliant resources cannot exist.
- ✗
Audit
Why it's wrong here
Audit allows the resource to be created as requested and simply records a non-compliance event in the Azure Activity Log. It does not reject the deployment, so a resource without the costcenter tag will still be provisioned and appear in the environment. Audit is useful for assessing current state or enforcing policies in a non-disruptive 'flag only' mode, not for preventing non-compliant resources.
When this WOULD be correct
If the policy goal were to monitor and report resources missing the 'CostCenter' tag without blocking deployment, such as for a compliance dashboard or cost tracking, 'Audit' would be the correct effect.
- ✗
Append
Why it's wrong here
Append adds the missing costcenter tag (often with a default value) to the resource during creation, but it does not block or deny the deployment. The resource is still created successfully, and the policy only modifies it to appear compliant. This effect cannot enforce that the correct user-specified tag value is supplied; it only injects a value, so it is a corrective action rather than a hard control.
When this WOULD be correct
A scenario where the policy should automatically add a missing 'CostCenter' tag with a default value (e.g., 'Unassigned') to resources that lack it, without blocking their creation. For example, 'All resources must have a CostCenter tag; if missing, add it with value Unassigned.'
- ✗
DeployIfNotExists
Why it's wrong here
DeployIfNotExists reacts after the resource has already been created by running a linked deployment through a managed identity to fix the non-compliance, such as adding the missing costcenter tag. It never denies the original resource creation, so the resource exists first and is remediated asynchronously later. This effect is designed for post-creation remediation, not for preventing non-compliant deployments in real time.
When this WOULD be correct
DeployIfNotExists would be correct if the policy required automatically deploying a 'CostCenter' tag with a default value to resources that are missing it, without blocking their creation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DenyCorrect answer▾
Why this is correct
Deny is the only Azure Policy effect that actively blocks deployment at evaluation time. During a PUT/PATCH request, Azure Resource Manager evaluates the applicable policy and, if the resource lacks the required costcenter tag, returns a 403 (Forbidden) response and the resource is never created. This makes Deny a preventive control that guarantees non-compliant resources cannot exist.
✗AuditWrong answer — click to see why▾
Why this is wrong here
The 'Audit' effect only logs non-compliant resources but does not block their creation. The question requires denying creation, which 'Audit' cannot do.
★ When this WOULD be the correct answer
If the policy goal were to monitor and report resources missing the 'CostCenter' tag without blocking deployment, such as for a compliance dashboard or cost tracking, 'Audit' would be the correct effect.
Why candidates choose this
Candidates may confuse auditing (monitoring) with enforcement (denying), or think that auditing alone can prevent resource creation by alerting administrators.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The 'Append' effect adds tags or values to resources during creation or update, but it does not deny creation if the tag is missing; it only modifies the resource to include the tag. The question requires denying creation entirely, which 'Deny' does.
★ When this WOULD be the correct answer
A scenario where the policy should automatically add a missing 'CostCenter' tag with a default value (e.g., 'Unassigned') to resources that lack it, without blocking their creation. For example, 'All resources must have a CostCenter tag; if missing, add it with value Unassigned.'
Why candidates choose this
Candidates may confuse 'Append' with 'Deny' because both can enforce tagging, but 'Append' seems like a softer enforcement that fixes the issue automatically, whereas the question explicitly requires denying creation.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists is used to deploy resources to remediate non-compliant resources, not to deny creation. The question requires denying creation of resources without the tag, which is achieved by the Deny effect.
★ When this WOULD be the correct answer
DeployIfNotExists would be correct if the policy required automatically deploying a 'CostCenter' tag with a default value to resources that are missing it, without blocking their creation.
Why candidates choose this
Candidates may confuse DeployIfNotExists with Append, thinking it can automatically add the missing tag, but DeployIfNotExists is for deploying entire resources, not just modifying tags.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Resource Manager
Azure Resource Manager (ARM) is the deployment and management service for Azure that provides a consistent management layer for creating, updating, and deleting resources in your Azure account.
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.