AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Deny

  Why it's wrong here

  The Deny effect is incorrect because it actively blocks resource creation whenever the requested resource does not already meet the policy condition, such as lacking a required naming tag. While this can enforce compliance, it prevents the resource from being created at all, which is disruptive and does not add the missing tag to bring the resource into compliance afterwards. The goal is to encourage a naming convention by adding tags, not to reject resources outright.

  When this WOULD be correct

  Use Deny when the requirement is to prevent resource creation if a mandatory tag (e.g., cost center) is missing, and non-compliance must result in rejection of the request.

• ✗

  Audit

  Why it's wrong here

  The Audit effect is incorrect because it only generates a log entry and an alert when a resource does not meet the policy condition, leaving the resource unchanged. It provides visibility into non-compliance but does not actually enforce or apply the naming convention by adding tags to the resource. Since the company wants to automatically ensure that all resources have the correct tag, Audit alone is insufficient.

  When this WOULD be correct

  Use Audit when the requirement is to log non-compliant resources for reporting or monitoring, but not to automatically remediate or block creation. For example, to track resources missing a required tag without taking automatic action.

• ✓

  Append

  Why this is correct

  The Append effect is correct because it automatically adds the specified tag (and its value) to a resource during creation or update, without blocking the operation. This is ideal for enforcing a naming convention through metadata: you can append a tag such as 'NameStandard' or append a prefix to an existing tag field, ensuring every resource carries the required identifier while still allowing the resource to be provisioned. Because it modifies the resource in-place to make it compliant, it provides a non-disruptive enforcement mechanism.

• ✗

  DeployIfNotExists

  Why it's wrong here

  The DeployIfNotExists effect is incorrect because it is designed to deploy a separate, additional resource to make the environment compliant, such as creating a diagnostic setting or a virtual network, rather than modifying the target resource itself. It cannot directly add a tag to the resource under evaluation; it only triggers the deployment of supplemental resources when a required configuration is missing. For tagging or naming conventions, Append is the appropriate effect because it directly modifies the resource being created.

  When this WOULD be correct

  A company wants to ensure that all new resource groups have a specific network security group (NSG) deployed if one is not already present. They want to automatically deploy the NSG without blocking resource group creation. DeployIfNotExists would be the correct effect to trigger deployment of the NSG via a remediation task.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question