AZ-900 Describe Azure management and governance Practice Question
A company has a policy that all Azure resources must have a 'CostCenter' tag. The governance team wants to identify any resources that are missing the tag without preventing their creation. They need a compliance report generated automatically showing all non-compliant resources. Which Azure Policy effect should they use?
⚠ Common exam trap
Candidates often confuse 'audit' with 'deny' or 'append' because they think tagging enforcement requires blocking or automatically adding tags, but the question explicitly states that resource creation must not be prevented, making 'audit' the only effect that purely reports without intervention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
audit
The 'audit' effect is correct because it allows the company to monitor and report on resources that are missing the 'CostCenter' tag without blocking their creation. Azure Policy's audit effect logs a compliance event in the activity log for non-compliant resources, which can then be used to generate automatic compliance reports via Azure Policy's compliance dashboard or exported to Log Analytics. This meets the requirement of identifying non-compliant resources while not preventing their deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
deny
Why it's wrong here
The 'deny' effect blocks the creation of resources that are non-compliant. This would prevent resources from being created if they lack the required tag, which is not what the team wants. They only want to identify missing tags without blocking deployment.
When this WOULD be correct
Use 'deny' when the governance team wants to enforce a tag requirement by blocking any resource creation that lacks the mandatory tag, ensuring compliance at creation time.
- ✓
audit
Why this is correct
The 'audit' effect creates a compliance report entry in the activity log and marks the resource as non-compliant in policy compliance, but does not block the resource creation or modify it. This meets the requirement to identify missing tags without disrupting deployment.
- ✗
deployIfNotExists
Why it's wrong here
The 'deployIfNotExists' effect automatically deploys a resource (or modifies the resource) to make it compliant when a condition is met. If used, it would add the missing tag automatically, which modifies the resource. The team only wants to identify non-compliant resources, not automatically fix them.
When this WOULD be correct
A scenario where the governance team wants to automatically deploy a default 'CostCenter' tag with a specific value (e.g., 'Unassigned') to any resource that is missing the tag, without blocking resource creation. The 'deployIfNotExists' effect would be correct to remediate non-compliance by deploying the missing tag.
- ✗
append
Why it's wrong here
The 'append' effect adds additional fields to the resource during creation or update to make it compliant. For a missing tag, it would add the tag with a default value. This modifies the resource, which is not desired. The team only wants to generate a compliance report without changing resources.
When this WOULD be correct
Use 'append' when the policy requires automatically adding a missing tag (e.g., 'CostCenter') with a default value to all new or updated resources without blocking their creation, and you want to ensure compliance by modifying the resource.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓auditCorrect answer▾
Why this is correct
The 'audit' effect creates a compliance report entry in the activity log and marks the resource as non-compliant in policy compliance, but does not block the resource creation or modify it. This meets the requirement to identify missing tags without disrupting deployment.
✗denyWrong answer — click to see why▾
Why this is wrong here
The 'deny' effect prevents resource creation or update if non-compliant, but the company policy requires identifying missing tags without blocking creation, so deny is too restrictive.
★ When this WOULD be the correct answer
Use 'deny' when the governance team wants to enforce a tag requirement by blocking any resource creation that lacks the mandatory tag, ensuring compliance at creation time.
Why candidates choose this
Candidates may think 'deny' is the only way to enforce tagging policies, overlooking that 'audit' can report non-compliance without blocking operations.
✗deployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
The 'deployIfNotExists' effect is used to deploy a resource or configuration when a resource is non-compliant, but it does not generate a compliance report. The question requires automatic reporting of non-compliant resources without preventing creation, which is achieved by the 'audit' effect.
★ When this WOULD be the correct answer
A scenario where the governance team wants to automatically deploy a default 'CostCenter' tag with a specific value (e.g., 'Unassigned') to any resource that is missing the tag, without blocking resource creation. The 'deployIfNotExists' effect would be correct to remediate non-compliance by deploying the missing tag.
Why candidates choose this
Candidates may confuse 'deployIfNotExists' with 'audit' because both can identify non-compliance, but 'deployIfNotExists' also attempts remediation, which is not required here. The word 'automatically' in the question might mislead them into thinking automatic deployment is needed.
✗appendWrong answer — click to see why▾
Why this is wrong here
The 'append' effect adds a tag with a default value to non-compliant resources during creation or update, but the requirement is only to identify missing tags without preventing creation, not to modify resources.
★ When this WOULD be the correct answer
Use 'append' when the policy requires automatically adding a missing tag (e.g., 'CostCenter') with a default value to all new or updated resources without blocking their creation, and you want to ensure compliance by modifying the resource.
Why candidates choose this
Candidates may think 'append' is appropriate because it can add the missing tag automatically, but they overlook that the question explicitly asks for identification and reporting, not modification.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
Key term
Report
A report in Azure data services is a structured output that summarizes, visualizes, or details data stored in cloud databases or data warehouses, often used for business intelligence and monitoring.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.