AZ-900 Describe Azure management and governance Practice Question
A company has a policy that requires all storage accounts to have secure transfer enabled. They want to automatically audit all existing storage accounts and enforce the setting on new ones. They also want to automatically fix non-compliant new storage accounts. Which Azure Policy effect combination should they use?
⚠ Common exam trap
Candidates often confuse 'deployIfNotExists' with 'modify'. 'deployIfNotExists' is for deploying auxiliary resources, not for changing properties of the existing resource. 'modify' is the correct effect for altering resource properties like secure transfer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
D) modify and audit
The correct combination is 'audit' and 'modify'. 'audit' logs non-compliant existing storage accounts without changing them, satisfying the audit requirement. 'modify' automatically changes the secure transfer property on new storage accounts during creation, enforcing the policy without blocking deployment. 'deployIfNotExists' is incorrect because it only deploys additional resources (e.g., a diagnostic setting), it does not modify properties of the resource itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A) audit and deny
Why it's wrong here
The 'audit and deny' combination provides compliance visibility but no remediation. 'audit' simply logs a non-compliant storage account without changing any settings, while 'deny' actively blocks creation of new non-compliant accounts. This blocking approach is not the desired outcome because the goal is to automatically fix the secure transfer property, not to prevent the resource from being created. Furthermore, 'deny' does nothing to correct storage accounts that already exist.
When this WOULD be correct
If the policy required only preventing non-compliant new resources and did not require auditing existing ones, 'audit and deny' would be appropriate.
- ✗
B) audit and deployIfNotExists
Why it's wrong here
The 'audit and deployIfNotExists' pair fails because 'deployIfNotExists' does not modify the storage account’s security properties. Instead, it deploys a separate, supplementary resource (such as a diagnostic setting) when the storage account is non-compliant. Secure transfer is a boolean property on the storage account itself, so it cannot be changed by a deployIfNotExists action. The policy would audit non-compliance but never actually enable 'Secure transfer required'.
- ✗
C) append and deny
Why it's wrong here
Neither 'append' nor 'deny' can remedy an existing storage account. 'append' only adds new properties to a resource definition, but secure transfer is an existing resource property that must be altered, not appended. 'deny' blocks the creation of non-compliant storage accounts, which is a preemptive enforcement action rather than an automatic fix. Because the requirement is to automatically correct the secure transfer setting, this combination is inappropriate.
When this WOULD be correct
If the question required adding a tag to storage accounts that lack it (e.g., append a 'costCenter' tag) and denying creation of accounts without the tag, then 'append and deny' would be correct.
- ✓
D) modify and audit
Why this is correct
The 'modify and audit' pair is correct because 'modify' directly changes the storage account’s configuration to enforce 'Secure transfer required' during resource creation or update, while 'audit' captures a compliance record for any resource that remains or becomes non-compliant. 'modify' is a remediation effect that can alter an existing property, and for existing non-compliant accounts, a remediation task can apply the fix. Combined, these effects both log non-compliance and automatically set secure transfer to true, fully satisfying the policy requirement.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓D) modify and auditCorrect answer▾
Why this is correct
The 'modify and audit' pair is correct because 'modify' directly changes the storage account’s configuration to enforce 'Secure transfer required' during resource creation or update, while 'audit' captures a compliance record for any resource that remains or becomes non-compliant. 'modify' is a remediation effect that can alter an existing property, and for existing non-compliant accounts, a remediation task can apply the fix. Combined, these effects both log non-compliance and automatically set secure transfer to true, fully satisfying the policy requirement.
✗A) audit and denyWrong answer — click to see why▾
Why this is wrong here
The 'deny' effect prevents creation of non-compliant resources but does not audit existing ones, failing the requirement to audit all existing storage accounts.
★ When this WOULD be the correct answer
If the policy required only preventing non-compliant new resources and did not require auditing existing ones, 'audit and deny' would be appropriate.
Why candidates choose this
Candidates may think 'deny' is needed to enforce compliance on new resources, overlooking the need to audit existing ones.
✗C) append and denyWrong answer — click to see why▾
Why this is wrong here
The 'append' effect adds configuration to a resource but cannot enforce or fix settings like secure transfer; 'deny' prevents creation but does not audit existing resources or auto-fix non-compliant new ones.
★ When this WOULD be the correct answer
If the question required adding a tag to storage accounts that lack it (e.g., append a 'costCenter' tag) and denying creation of accounts without the tag, then 'append and deny' would be correct.
Why candidates choose this
Candidates may think 'deny' is needed to block non-compliant resources and 'append' can fix them, but 'append' cannot enable secure transfer (a boolean property) and 'deny' alone doesn't audit existing resources.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.