AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Policy to enforce governance on their subscriptions. They want to ensure that every newly created Azure resource automatically receives two tags: 'Owner' and 'CostCenter'. If a user or an automated process creates a resource without specifying these tags, the policy should add the missing tags with default values of 'Unassigned' without blocking the resource creation. Which Azure Policy effect should be used in the policy definitions?
⚠ Common exam trap
Many exam-takers confuse Append with DeployIfNotExists: candidates often choose DeployIfNotExists because it sounds like it 'deploys' missing tags, but DeployIfNotExists is designed to deploy a separate resource (like a diagnostic setting) after the fact, not to modify the resource being created, whereas Append directly alters the resource request in-flight.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Append
(Append) is correct because the Append effect adds specified fields (such as tags) to a resource during creation or update without blocking the operation. In this scenario, the policy must automatically add the 'Owner' and 'CostCenter' tags with default values of 'Unassigned' when they are missing, which is exactly what Append does—it modifies the resource request to include the missing tags before the resource is created.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny
Why it's wrong here
The Deny effect prevents the creation or update of resources that do not match the policy condition. This would block resource creation if tags are missing, which is not the desired behavior because the company wants to allow creation and automatically add missing tags.
When this WOULD be correct
Use Deny when the policy must prevent creation of resources that do not meet specific compliance requirements, such as blocking any resource without a required tag to enforce strict tagging.
- ✗
Audit
Why it's wrong here
The Audit effect creates a log entry when a resource is non-compliant but does not take any action to modify the resource. It would not add the missing tags, so it does not meet the requirement to automatically add default tags.
When this WOULD be correct
If the requirement was to log resources missing the required tags for compliance reporting, without automatically adding them or blocking creation, then Audit would be correct.
- ✓
Append
Why this is correct
The Append effect is designed to add additional fields (such as tags) to a resource during creation or update. It does not block the creation; instead, it automatically applies the specified values to bring the resource into compliance. This perfectly matches the requirement to add default tags without blocking resource creation.
- ✗
DeployIfNotExists
Why it's wrong here
The DeployIfNotExists effect is used to deploy a resource (like a network security group or diagnostic setting) if the required resource does not exist. It is not suitable for adding tags to the current resource; its purpose is to provision a separate resource during evaluation.
When this WOULD be correct
A scenario where you need to automatically deploy a resource, such as a network security group or diagnostic settings, to any virtual machine that lacks it, without blocking VM creation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AppendCorrect answer▾
Why this is correct
The Append effect is designed to add additional fields (such as tags) to a resource during creation or update. It does not block the creation; instead, it automatically applies the specified values to bring the resource into compliance. This perfectly matches the requirement to add default tags without blocking resource creation.
✗DenyWrong answer — click to see why▾
Why this is wrong here
Deny blocks resource creation if tags are missing, but the requirement is to add default tags without blocking creation.
★ When this WOULD be the correct answer
Use Deny when the policy must prevent creation of resources that do not meet specific compliance requirements, such as blocking any resource without a required tag to enforce strict tagging.
Why candidates choose this
Candidates may think Deny is needed to enforce tagging, but they overlook the requirement to allow creation with default values.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources without modifying them, but the requirement is to automatically add missing tags with default values, which requires a policy effect that modifies the resource.
★ When this WOULD be the correct answer
If the requirement was to log resources missing the required tags for compliance reporting, without automatically adding them or blocking creation, then Audit would be correct.
Why candidates choose this
Candidates may think Audit is sufficient because it flags non-compliance, but they overlook the need for automatic remediation (adding tags) specified in the question.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists is used to deploy a resource (e.g., a Log Analytics agent) if it doesn't exist, not to add tags to an existing resource. It cannot modify the resource being created; it only deploys additional resources.
★ When this WOULD be the correct answer
A scenario where you need to automatically deploy a resource, such as a network security group or diagnostic settings, to any virtual machine that lacks it, without blocking VM creation.
Why candidates choose this
Candidates may confuse 'deploy if not exists' with 'add if not exists', thinking it can append tags, but DeployIfNotExists is for deploying separate resources, not modifying the evaluated resource.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.