AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Append

  Why it's wrong here

  Append is a policy effect that injects additional fields—such as a default costcenter tag value—into the resource deployment request before the resource is provisioned. However, it only adds the tag when it is missing; if a resource already has a different costcenter value, Append cannot change it, and it never forbids the creation of a resource with an incorrect tag. This means non-compliant resources can still be created, which is why Append does not enforce a mandatory tag.

  When this WOULD be correct

  Use Append when you need to automatically add a missing tag (e.g., 'CostCenter') to existing resources during evaluation, without blocking creation. For example, a policy that adds a department tag to all resources that lack it.

• ✓

  Deny

  Why this is correct

  Deny is the only Azure Policy effect that blocks the resource provider request before deployment. When a resource is submitted without the costcenter tag, the policy engine evaluates the request and returns an error (e.g., 403 or 409), so the resource creation fails entirely. This guarantees that every successfully created resource already carries the tag, making it the correct choice for a mandatory tagging requirement.

• ✗

  Audit

  Why it's wrong here

  Audit does not interfere with the creation pipeline; it allows the resource to be created while registering it as non-compliant in the Azure Policy compliance report and emitting an activity log entry. This effect is ideal for generating a compliance inventory without disrupting existing workloads, but it cannot enforce the costcenter tag because the resource will still exist even if the tag is missing. Thus, it is insufficient for a strict mandatory requirement.

  When this WOULD be correct

  Use Audit when the requirement is to monitor and report on resources missing the 'CostCenter' tag, but not to block creation—for example, to track compliance over time without disrupting operations.

• ✗

  DeployIfNotExists

  Why it's wrong here

  DeployIfNotExists triggers a secondary ARM deployment after the evaluated resource has been created, which can then add the missing costcenter tag. Because the initial resource creation is permitted, there is a temporary window of non-compliance, and enforcement depends on the separate remediation deployment succeeding. It is a corrective mechanism, not a preventive guardrail, so it does not satisfy a policy that requires all resources to have the tag from creation onward.

  When this WOULD be correct

  A scenario where the company wants to automatically apply the 'CostCenter' tag to any resource created without it, without blocking creation. For example: 'A company needs to ensure all Azure resources have a 'CostCenter' tag; if a resource is created without it, the tag should be automatically added.'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question