AZ-900 Describe Azure management and governance Practice Question
A company has a policy that all Azure resources must have a tag named 'CostCenter'. The governance team wants to automatically add the tag with a default value 'IT' to any new resource that is created without it. The team wants the tag to be applied during resource creation, not just report non-compliance. The solution must also support remediation for existing non-compliant resources if needed later. Which Azure Policy effect should the team use in their policy definition?
⚠ Common exam trap
Many candidates confuse Append with Modify, thinking Append can also update existing tags, but Append only adds to properties that don't exist, while Modify can replace or add tags and supports full remediation for existing resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify
The Modify effect is correct because it can automatically add or change tags on resources during creation or update, enforcing compliance in real-time. Unlike Append, Modify supports both creation and remediation of existing resources, and unlike DeployIfNotExists, it directly alters the resource properties without deploying a separate remediation task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Append
Why it's wrong here
Incorrect. The Append effect can add additional fields to a resource during creation or update, and it can be used for tags. However, it does not support modifying existing tags or running remediation on existing resources. The Modify effect is the recommended and more capable choice for tags.
When this WOULD be correct
A policy must add a tag to new resources but never modify existing tags on resources that already have the tag. The team only cares about new resources and does not need to fix existing non-compliant resources.
- ✓
Modify
Why this is correct
Correct. The Modify effect is designed to add, change, or remove tags and other properties on resources. It can be applied during resource creation or update and supports remediation tasks to bring existing non-compliant resources into compliance. This makes it the best fit for the scenario.
- ✗
DeployIfNotExists
Why it's wrong here
Incorrect. The DeployIfNotExists effect is used to deploy a resource (such as a diagnostic setting or a network security group) when a parent resource does not have it. It does not modify properties of existing resources like tags.
When this WOULD be correct
Use DeployIfNotExists when you need to deploy a supporting resource (e.g., a Log Analytics workspace or a diagnostic setting) to non-compliant resources after creation, and you don't need to modify the resource itself at creation time.
- ✗
Audit
Why it's wrong here
The Audit effect in Azure Policy is a non-compliant reporting mechanism: it evaluates resources against the policy definition and marks them as non-compliant in the compliance dashboard, but it takes no remediation action whatsoever. It cannot append or modify tags, nor can it deploy any configuration. Therefore, while Audit would alert you to resources missing the required tag, it would not enforce the policy or automatically add the tag, making it unsuitable for the stated requirement that 'all Azure resources must have a tag'.
When this WOULD be correct
Use Audit when the requirement is only to monitor and report on compliance status (e.g., 'Identify all resources missing a required tag') without any automatic enforcement or remediation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓ModifyCorrect answer▾
Why this is correct
Correct. The Modify effect is designed to add, change, or remove tags and other properties on resources. It can be applied during resource creation or update and supports remediation tasks to bring existing non-compliant resources into compliance. This makes it the best fit for the scenario.
✗AppendWrong answer — click to see why▾
Why this is wrong here
Append can add tags to resources during creation, but it cannot modify existing tags or support remediation for existing non-compliant resources. The question requires the ability to also remediate existing resources later, which Append cannot do.
★ When this WOULD be the correct answer
A policy must add a tag to new resources but never modify existing tags on resources that already have the tag. The team only cares about new resources and does not need to fix existing non-compliant resources.
Why candidates choose this
Candidates often confuse Append with Modify because both can add tags, but they overlook that Append cannot change existing tags and lacks remediation capabilities for existing resources.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists does not apply tags during resource creation; it only deploys a resource (like a Logic App) to remediate non-compliance after the fact, not during creation as required.
★ When this WOULD be the correct answer
Use DeployIfNotExists when you need to deploy a supporting resource (e.g., a Log Analytics workspace or a diagnostic setting) to non-compliant resources after creation, and you don't need to modify the resource itself at creation time.
Why candidates choose this
Candidates confuse DeployIfNotExists with Modify because both can remediate, but DeployIfNotExists deploys separate resources rather than modifying the original resource's properties directly.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliance without applying any automatic remediation, so it cannot add the missing tag during resource creation or support remediation for existing resources.
★ When this WOULD be the correct answer
Use Audit when the requirement is only to monitor and report on compliance status (e.g., 'Identify all resources missing a required tag') without any automatic enforcement or remediation.
Why candidates choose this
Candidates may mistakenly think Audit can trigger actions or confuse it with a policy that enforces tags, overlooking that Audit is purely observational and does not modify resources.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Report
A report in Azure data services is a structured output that summarizes, visualizes, or details data stored in cloud databases or data warehouses, often used for business intelligence and monitoring.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.