AZ-900 Describe Azure management and governance Practice Question
A company wants to ensure that all new Azure storage accounts have a specific encryption setting enabled. They also want to automatically remediate any existing non-compliant storage accounts without manual effort. Which Azure Policy effect should they use?
⚠ Common exam trap
A common mix-up: candidates confuse AuditIfNotExists (which only audits) with DeployIfNotExists (which both audits and automatically remediates), assuming that any 'IfNotExists' effect provides automatic fixing, but only DeployIfNotExists includes the deployment action for remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeployIfNotExists
DeployIfNotExists is the correct effect because it not only evaluates the compliance of storage accounts against the encryption policy but also automatically deploys a remediation task (e.g., enabling encryption via a linked ARM template or Azure function) to bring non-compliant resources into compliance without manual intervention. This effect is specifically designed for scenarios where the resource itself needs to be modified or configured to meet the policy requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Append
Why it's wrong here
Append is a policy effect that attaches additional fields or tags to a resource during create or update operations. It cannot enable encryption on a storage account because encryption is a service-level capability, not a simple property that can be appended; attempting to use Append would either error or be ignored, leaving non-compliant accounts unchanged.
When this WOULD be correct
Use Append when you need to add a tag or setting to a resource during creation or update, such as automatically adding a 'CostCenter' tag to all new storage accounts, without affecting existing ones.
- ✗
AuditIfNotExists
Why it's wrong here
AuditIfNotExists only evaluates resources and records non-compliance in the Azure activity log or security center; it does not change the resource. While it can trigger alerts, it leaves existing storage accounts unencrypted, so it fails to 'ensure' the setting is applied — it merely reports that it is missing.
When this WOULD be correct
AuditIfNotExists would be correct if the question asked to identify non-compliant storage accounts (e.g., those missing encryption) and log the compliance state, but without any automatic remediation. For example: 'Which effect should be used to report on storage accounts that do not have encryption enabled?'
- ✓
DeployIfNotExists
Why this is correct
DeployIfNotExists is the correct effect because it actively remediates non-compliant storage accounts by deploying a required definition (e.g., enabling encryption) at scale. It uses a managed identity to assess existing resources and apply the configuration automatically, covering both new and pre-existing accounts without manual intervention.
- ✗
Deny
Why it's wrong here
Deny prevents new storage accounts from being created if they do not meet the encryption requirement, but it does nothing to remediate accounts that already exist. Existing non-compliant storage accounts remain unencrypted, so while it enforces compliance for future resources, it does not ensure all new and existing accounts meet the requirement.
When this WOULD be correct
Deny would be correct in a scenario where the company wants to block the creation of any new storage accounts that do not have the specific encryption setting, and they are willing to manually remediate existing non-compliant accounts or have a separate process for that.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DeployIfNotExistsCorrect answer▾
Why this is correct
DeployIfNotExists is the correct effect because it actively remediates non-compliant storage accounts by deploying a required definition (e.g., enabling encryption) at scale. It uses a managed identity to assess existing resources and apply the configuration automatically, covering both new and pre-existing accounts without manual intervention.
✗AppendWrong answer — click to see why▾
Why this is wrong here
Append adds configuration to a resource but cannot deploy or modify existing resources; it only appends fields during creation or update, not remediate existing non-compliant storage accounts.
★ When this WOULD be the correct answer
Use Append when you need to add a tag or setting to a resource during creation or update, such as automatically adding a 'CostCenter' tag to all new storage accounts, without affecting existing ones.
Why candidates choose this
Candidates may think Append can modify existing resources, confusing its ability to add properties during resource creation with remediation of existing resources.
✗AuditIfNotExistsWrong answer — click to see why▾
Why this is wrong here
AuditIfNotExists only audits resources that are missing a required extension or configuration; it does not automatically remediate non-compliant storage accounts. The question requires automatic remediation, which AuditIfNotExists cannot provide.
★ When this WOULD be the correct answer
AuditIfNotExists would be correct if the question asked to identify non-compliant storage accounts (e.g., those missing encryption) and log the compliance state, but without any automatic remediation. For example: 'Which effect should be used to report on storage accounts that do not have encryption enabled?'
Why candidates choose this
Candidates may confuse auditing with remediation, thinking that auditing non-compliant resources automatically leads to fixing them, or they may not fully understand the difference between AuditIfNotExists and DeployIfNotExists.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny prevents creation or modification of non-compliant resources, but it does not automatically remediate existing non-compliant storage accounts. The question requires both ensuring new accounts are compliant and fixing existing ones without manual effort, which Deny cannot do.
★ When this WOULD be the correct answer
Deny would be correct in a scenario where the company wants to block the creation of any new storage accounts that do not have the specific encryption setting, and they are willing to manually remediate existing non-compliant accounts or have a separate process for that.
Why candidates choose this
Candidates may choose Deny because it is a common effect for enforcing compliance on new resources, and they overlook the requirement for automatic remediation of existing resources.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.