AZ-900 Describe Azure management and governance Practice Question
A company has an Azure policy requirement that all new resources in a specific resource group must have a 'Department' tag. If a resource is created without this tag, the tag should be automatically added with a default value of 'Finance'. Which Azure Policy effect should be used?
⚠ Common exam trap
Many exam-takers confuse Append with Deny, thinking that blocking non-compliant resources is the only way to enforce tagging, but Append provides a non-blocking remediation that satisfies the requirement to automatically add the tag.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Append
The Append effect is correct because it allows Azure Policy to automatically add a 'Department' tag with a default value of 'Finance' to any resource created without it in the specified resource group. This effect modifies the resource during creation or update to enforce compliance without blocking the operation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
Deny is incorrect because the Deny effect prevents the creation or update of a resource that does not meet the policy condition, returning a 403 Forbidden error and failing the deployment. The requirement is to allow the resource to be created while automatically supplying the missing tag, not to reject it. Deny enforces compliance by blocking non-compliant requests, which would unnecessarily disrupt resource provisioning.
When this WOULD be correct
If the policy requirement was to block creation of any resource in the resource group that does not have a 'Department' tag, then Deny would be the correct effect to enforce that compliance.
- ✓
Append
Why this is correct
Append is correct because Azure Policy's Append effect injects a specified tag and value directly into a resource during its creation or update, before the resource is committed by Resource Manager. For a new resource missing the default tag, Append automatically adds it without blocking the request, so the resource is created compliant. It requires no separate remediation step for new deployments, making it the precise effect for this requirement.
- ✗
Audit
Why it's wrong here
Audit is incorrect because the Audit effect only generates a compliance warning in the activity log and marks the resource as non-compliant in policy compliance reports; it does not modify the resource in any way. Using Audit would mean the new resource is created without the default tag, and administrators would only see a log entry after the fact. Audit is for monitoring or validating compliance, not for automatically applying a tag or other property.
When this WOULD be correct
When the requirement is to log resources that are missing a required tag for compliance reporting, but no automatic remediation is needed.
- ✗
Modify
Why it's wrong here
Modify is incorrect because while it can add tags to existing resources through remediation tasks, it is not the standard effect for automatically applying a tag during creation. Modify requires a managed identity and a remediation task to act on non-compliant resources, adding overhead and complexity. For adding a missing tag at provisioning time, Append is the simpler and intended effect; Modify is typically reserved for changing properties that require a resource provider operation after initial deployment.
When this WOULD be correct
A company has an Azure policy requiring that all existing resources in a subscription must have a 'CostCenter' tag. If a resource is missing the tag, it should be automatically added with a default value. In this scenario, 'Modify' would be the correct effect because it can update existing resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AppendCorrect answer▾
Why this is correct
Append is correct because Azure Policy's Append effect injects a specified tag and value directly into a resource during its creation or update, before the resource is committed by Resource Manager. For a new resource missing the default tag, Append automatically adds it without blocking the request, so the resource is created compliant. It requires no separate remediation step for new deployments, making it the precise effect for this requirement.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny prevents resource creation if the tag is missing, but does not automatically add the tag with a default value. The requirement is to add the tag, not block creation.
★ When this WOULD be the correct answer
If the policy requirement was to block creation of any resource in the resource group that does not have a 'Department' tag, then Deny would be the correct effect to enforce that compliance.
Why candidates choose this
Candidates may confuse 'Deny' with 'Append' because both enforce tag requirements, but Deny is a hard block while Append allows creation and then adds the tag.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources without taking any action; it does not automatically add the missing tag, which is required by the question.
★ When this WOULD be the correct answer
When the requirement is to log resources that are missing a required tag for compliance reporting, but no automatic remediation is needed.
Why candidates choose this
Candidates may confuse 'Audit' with 'Append' because both are used for compliance, but Audit only reports while Append actively modifies the resource.
✗ModifyWrong answer — click to see why▾
Why this is wrong here
The 'Modify' effect is used to add or change tags on existing resources, but the question requires automatically adding a tag to new resources during creation. 'Append' is the correct effect for adding fields to new resources during creation, while 'Modify' is for altering existing resources.
★ When this WOULD be the correct answer
A company has an Azure policy requiring that all existing resources in a subscription must have a 'CostCenter' tag. If a resource is missing the tag, it should be automatically added with a default value. In this scenario, 'Modify' would be the correct effect because it can update existing resources.
Why candidates choose this
Candidates may confuse 'Modify' with 'Append' because both can add tags, but they forget that 'Modify' is designed for existing resources, while 'Append' is for new resources during creation.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.