AZ-900 Describe Azure management and governance Practice Question
A company wants to ensure that all Azure resources are tagged with a 'CostCenter' tag at creation time. If a resource is created without the tag, it should be automatically denied. Which Azure Policy effect should they use?
⚠ Common exam trap
A common mix-up: candidates confuse 'deny' with 'audit' or 'append', thinking that logging or auto-tagging is sufficient to enforce compliance, but only 'deny' actively prevents the resource from being created in the first place.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A) deny
The 'deny' effect is correct because it actively blocks any resource creation request that does not include the required 'CostCenter' tag. Azure Policy with the 'deny' effect evaluates the resource against the policy rule at creation or update time and rejects the request if the condition is not met, ensuring compliance before the resource is provisioned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A) deny
Why this is correct
The Deny effect is the only one that actively blocks non-compliant resource deployment. When Azure Policy evaluates a request with a Deny policy, the resource creation or update is rejected with an error before it is provisioned, ensuring every resource in scope must include the costcenter tag or it cannot be created at all.
- ✗
B) audit
Why it's wrong here
Audit does not stop resource creation; it only records a compliance failure in the activity log and policy compliance state. A resource missing the costcenter tag would be created successfully and later appear as non-compliant, so it cannot guarantee that all resources are tagged.
When this WOULD be correct
If the requirement were to log non-compliant resources for reporting without blocking creation, audit would be correct.
- ✗
C) append
Why it's wrong here
Append attempts to mutate the resource during deployment by adding the missing costcenter tag, effectively repairing compliance in place. However, it never denies the resource request; if the tag cannot be added for any reason, the resource is still provisioned, and it relies on the resource type's update capabilities rather than enforcing the tag as a prerequisite.
When this WOULD be correct
If the requirement were to automatically add a missing 'CostCenter' tag with a default value (e.g., 'Unassigned') to resources during creation, without blocking their creation, then 'append' would be the correct effect.
- ✗
D) deployIfNotExists
Why it's wrong here
DeployIfNotExists triggers a corrective deployment (often via a remediation task) after a non-compliant resource exists, but the original resource is allowed to be created first. There is a period where the resource may lack the costcenter tag, and the effect depends on separate remediation infrastructure rather than preventing the non-tagged state.
When this WOULD be correct
A scenario where a company wants to automatically deploy a 'CostCenter' tag with a default value to any new resource that is created without it, without denying the creation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓A) denyCorrect answer▾
Why this is correct
The Deny effect is the only one that actively blocks non-compliant resource deployment. When Azure Policy evaluates a request with a Deny policy, the resource creation or update is rejected with an error before it is provisioned, ensuring every resource in scope must include the costcenter tag or it cannot be created at all.
✗B) auditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources without blocking creation, so it cannot automatically deny resources missing the CostCenter tag.
★ When this WOULD be the correct answer
If the requirement were to log non-compliant resources for reporting without blocking creation, audit would be correct.
Why candidates choose this
Candidates may confuse audit with deny, thinking logging alone is sufficient for enforcement, or they may not understand that audit does not prevent resource creation.
✗C) appendWrong answer — click to see why▾
Why this is wrong here
The 'append' effect adds a tag to a resource after creation, but it does not deny creation of resources missing the tag. The requirement is to automatically deny creation, which requires the 'deny' effect.
★ When this WOULD be the correct answer
If the requirement were to automatically add a missing 'CostCenter' tag with a default value (e.g., 'Unassigned') to resources during creation, without blocking their creation, then 'append' would be the correct effect.
Why candidates choose this
Candidates may confuse 'append' with 'deny' because both can enforce tagging, but 'append' modifies the resource after creation rather than preventing creation, which is a subtle but critical distinction.
✗D) deployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
The 'deployIfNotExists' effect is used to deploy resources to remediate non-compliant resources after evaluation, not to deny creation. It does not prevent the creation of untagged resources.
★ When this WOULD be the correct answer
A scenario where a company wants to automatically deploy a 'CostCenter' tag with a default value to any new resource that is created without it, without denying the creation.
Why candidates choose this
Candidates may confuse 'deployIfNotExists' with 'deny' because both involve enforcing compliance, but 'deployIfNotExists' remediates after creation rather than blocking it.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.