AZ-900 Describe Azure management and governance Practice Question
A company wants to enforce that all Azure storage accounts must have encryption enabled. If a storage account is created without encryption, the policy should automatically enable encryption without manual intervention. Which Azure Policy effect should they use?
⚠ Common exam trap
Many candidates confuse DeployIfNotExists with Modify: DeployIfNotExists deploys a new resource (like a diagnostic setting) but cannot change properties of the existing resource itself, whereas Modify directly alters the resource's configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify
The Modify effect is correct because it can automatically enable encryption on a storage account that does not have it enabled, without requiring manual intervention. Unlike DeployIfNotExists, which only deploys resources if they don't exist, Modify can alter existing properties (like encryption settings) on the resource itself. This ensures compliance by remediating non-compliant resources in real time or during evaluation cycles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify
Why this is correct
The Modify effect is the only effect that can directly change a property of an existing Azure resource to remediate non-compliance. When paired with a role assignment in the policy definition, it enables automatic remediation tasks that update the resource configuration—such as enabling encryption on a storage account—without requiring manual intervention. It evaluates both during the create/update cycle and through proactive remediation runs.
- ✗
Deny
Why it's wrong here
Deny blocks the creation or update of a resource that would violate the policy, but it does nothing to fix resources that already exist. For a storage account that was created before the policy was assigned, Deny cannot retroactively enable encryption; it only prevents future non-compliant actions. It is a preventive control, not a corrective one.
When this WOULD be correct
If the requirement is to block any storage account creation that does not have encryption enabled, and automatic remediation is not needed, then Deny would be the correct effect.
- ✗
Audit
Why it's wrong here
Audit simply logs the compliance state of a resource in the Azure Policy activity log and compliance dashboard without taking any action. It will flag a storage account that lacks encryption as non-compliant, but it will never alter the resource or apply encryption. Audit is for visibility and monitoring, not for enforcement or remediation.
When this WOULD be correct
If the question asked for a policy that monitors and reports whether storage accounts have encryption enabled, but does not require automatic remediation, Audit would be the correct effect.
- ✗
DeployIfNotExists
Why it's wrong here
DeployIfNotExists is designed to deploy a new supporting resource—such as a network security group, diagnostic setting, or extension—when a specified condition is not met. It cannot change an existing resource's own properties; for example, it cannot flip the encryption flag on a storage account because that requires updating the current resource, not deploying a separate one. Therefore, it is not appropriate for remediating a property like storage encryption.
When this WOULD be correct
DeployIfNotExists would be correct in a scenario where the policy must deploy a missing resource, such as deploying a network security group to a subnet if it doesn't exist, without needing to modify the subnet itself.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓ModifyCorrect answer▾
Why this is correct
The Modify effect is the only effect that can directly change a property of an existing Azure resource to remediate non-compliance. When paired with a role assignment in the policy definition, it enables automatic remediation tasks that update the resource configuration—such as enabling encryption on a storage account—without requiring manual intervention. It evaluates both during the create/update cycle and through proactive remediation runs.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny prevents the creation of a storage account without encryption, but it does not automatically enable encryption on existing or newly created accounts; it only blocks non-compliant resources.
★ When this WOULD be the correct answer
If the requirement is to block any storage account creation that does not have encryption enabled, and automatic remediation is not needed, then Deny would be the correct effect.
Why candidates choose this
Candidates may think Deny is the strongest enforcement, but they overlook the requirement for automatic remediation without manual intervention.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs compliance state without taking any action, so it cannot automatically enable encryption as required by the question.
★ When this WOULD be the correct answer
If the question asked for a policy that monitors and reports whether storage accounts have encryption enabled, but does not require automatic remediation, Audit would be the correct effect.
Why candidates choose this
Candidates may confuse Audit with a remediation effect, thinking that logging alone is sufficient to enforce compliance, or they may overlook the requirement for automatic action.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists can deploy resources or configurations if a condition is not met, but it cannot modify existing resources that were created without encryption; it only deploys new resources. The question requires automatic enabling of encryption on an existing storage account, which Modify can do.
★ When this WOULD be the correct answer
DeployIfNotExists would be correct in a scenario where the policy must deploy a missing resource, such as deploying a network security group to a subnet if it doesn't exist, without needing to modify the subnet itself.
Why candidates choose this
Candidates may confuse DeployIfNotExists with Modify because both can automatically remediate non-compliant resources, but DeployIfNotExists is for deploying new resources, not modifying existing ones.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.