AZ-900 Describe Azure management and governance Practice Question
A company has an Azure subscription with hundreds of existing virtual machines. The governance team wants to enforce a policy that every virtual machine must have a tag named 'CostCenter' with a valid value. The team wants to automatically add the 'CostCenter' tag with a default value of 'Undefined' to any existing or new virtual machine that is missing the tag. They do not want to block the creation of virtual machines that are missing the tag, but they do want the tag to be added automatically within a few minutes of detection. Which Azure Policy effect should the team use?
⚠ Common exam trap
A common mix-up: candidates confuse Append with Modify, assuming Append can handle existing resources, but Append only applies during resource creation, while Modify is designed for both new and existing resources with remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify
The Modify effect is correct because it can automatically add or change tags on existing and new resources without blocking creation. Unlike Append, which only works during resource creation and cannot modify existing resources, Modify uses a 'remediation' task to fix non-compliant resources after they are created, aligning with the requirement to add the tag within minutes of detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit
Why it's wrong here
Audit merely evaluates resources against the policy definition and writes compliance details to the Azure activity log. For an existing VM missing the CostCenter tag, Audit would report it as non-compliant without ever modifying the VM, and new deployments would receive the same passive treatment. Since the requirement is to apply the tag automatically to both existing and new VMs, Audit provides no remediation action and leaves the resources untouched.
When this WOULD be correct
Use Audit when the requirement is to monitor and report on compliance status (e.g., which VMs are missing a tag) without automatically modifying resources, such as for initial compliance discovery or auditing purposes.
- ✗
Deny
Why it's wrong here
The Deny effect prevents creation or update of any non-compliant resource, so a VM without the CostCenter tag would be rejected rather than tagged. This directly contradicts the requirement to automatically add the tag, and it would also disrupt existing workflows that expect successful provisioning. Moreover, Deny does nothing to remediate already deployed VMs; it only blocks future non-compliant attempts, making it an enforcement tool, not an auto-tagging mechanism.
When this WOULD be correct
If the governance team required that no virtual machine can be created or updated without a valid 'CostCenter' tag, and they wanted to prevent any non-compliant resource from being provisioned, then Deny would be the correct effect.
- ✗
Append
Why it's wrong here
The Append effect can add missing fields (like tags) during resource creation or update. However, it does not automatically apply to existing resources unless a manual remediation task is triggered. The scenario requires automatic application to existing resources without manual steps, making Modify a better fit.
When this WOULD be correct
Append would be correct if the policy required adding the 'CostCenter' tag only to resources that are missing it entirely, without needing to update existing tags with different values, and if the team did not need to handle cases where the tag exists but is empty or invalid.
- ✓
Modify
Why this is correct
The Modify effect uses a defined role (via managed identity) to change resource properties on existing and new resources. It can automatically add the 'CostCenter' tag with a default value to both existing VMs (through remediation tasks that run automatically or on a schedule) and new VMs, fulfilling the requirement without blocking resource creation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓ModifyCorrect answer▾
Why this is correct
The Modify effect uses a defined role (via managed identity) to change resource properties on existing and new resources. It can automatically add the 'CostCenter' tag with a default value to both existing VMs (through remediation tasks that run automatically or on a schedule) and new VMs, fulfilling the requirement without blocking resource creation.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources without taking any remediation action, so it cannot automatically add the missing 'CostCenter' tag.
★ When this WOULD be the correct answer
Use Audit when the requirement is to monitor and report on compliance status (e.g., which VMs are missing a tag) without automatically modifying resources, such as for initial compliance discovery or auditing purposes.
Why candidates choose this
Candidates may think Audit is sufficient because it detects missing tags, but they overlook the requirement for automatic remediation within minutes.
✗DenyWrong answer — click to see why▾
Why this is wrong here
The Deny effect blocks creation or update of non-compliant resources, but the question states the team does not want to block creation; they want automatic remediation without blocking.
★ When this WOULD be the correct answer
If the governance team required that no virtual machine can be created or updated without a valid 'CostCenter' tag, and they wanted to prevent any non-compliant resource from being provisioned, then Deny would be the correct effect.
Why candidates choose this
Candidates may think Deny is the strongest enforcement, but they overlook the requirement to allow creation and instead automatically add the missing tag.
✗AppendWrong answer — click to see why▾
Why this is wrong here
Append can add tags to existing resources but cannot modify existing tags; it only adds if the tag is missing. The question requires setting a default value even if the tag exists with a different value, which Append cannot do, but Modify can.
★ When this WOULD be the correct answer
Append would be correct if the policy required adding the 'CostCenter' tag only to resources that are missing it entirely, without needing to update existing tags with different values, and if the team did not need to handle cases where the tag exists but is empty or invalid.
Why candidates choose this
Candidates may confuse Append with Modify because both can add tags, but Append is simpler and more commonly known, leading them to overlook that Append cannot replace existing tag values.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
Key term
Azure subscription
An Azure subscription is a logical container in Microsoft Azure that provides billing isolation and access boundaries for your cloud resources and services.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.