AZ-900 Describe Azure management and governance Practice Question
A company wants to ensure that all Azure resources are tagged with metadata such as 'Environment' and 'Department'. They have created an Azure Policy that appends the required tags and their values when a resource is created. However, they notice that some resources created before the policy assignment are missing tags. They want to automatically add those tags without manual effort. What should they do?
⚠ Common exam trap
Many candidates assume a remediation task can be created for any policy, but remediation tasks only work with DeployIfNotExists or Modify effects, not with the 'append' effect used in the scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new policy with DeployIfNotExists effect
The DeployIfNotExists (DINE) policy effect can automatically remediate non-compliant resources, including those created before the policy assignment. When combined with a managed identity, DINE triggers a deployment task that adds the required tags without manual intervention, addressing the gap left by the 'append' effect which only acts on new resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a remediation task for the policy
Why it's wrong here
A remediation task is not a standalone solution; it is a follow-up operation that applies the required change to existing, non-compliant resources after a policy assignment is in place. Remediation is only supported for policies with DeployIfNotExists or Modify effects, not for Append-effect policies, and it does not enforce compliance on new or updated resources by itself. Consequently, while a remediation task may be part of the overall fix, it cannot by itself ensure all resources are tagged unless the appropriate policy definition already exists.
When this WOULD be correct
A company has a DeployIfNotExists policy that deploys a resource (e.g., a network security group) and wants to automatically fix existing non-compliant resources. In that case, creating a remediation task would apply the policy to existing resources.
- ✓
Create a new policy with DeployIfNotExists effect
Why this is correct
A policy with DeployIfNotExists effect is the correct choice because it can deploy an Azure Resource Manager template that adds the required tags to resources when they are created or updated. For already-deployed resources, the policy can be assigned and a remediation task can then be run to initiate the deployment and bring those existing resources into compliance. This gives continuous enforcement plus the ability to retrofit non-compliant resources, which is exactly what 'ensure all Azure resources' requires.
- ✗
Use Azure Resource Graph to query and update
Why it's wrong here
Azure Resource Graph is a read-only query service that gives a fast, aggregated view of resource metadata across subscriptions, so it is useful for identifying which resources are missing tags. However, it cannot directly update or tag resources; any changes would require a separate tool such as Azure PowerShell or CLI to act on the query results. Without that additional scripting and scheduling, Resource Graph alone offers no enforcement or automatic remediation, so it only partially addresses the need to 'ensure' tagging.
When this WOULD be correct
A company needs to audit and report on all Azure resources that are missing specific tags, but does not require automatic remediation. They want to generate a list of non-compliant resources for manual review.
- ✗
Create an Azure Automation runbook
Why it's wrong here
An Azure Automation runbook is a scripted workflow that could tag resources, but it requires manual or scheduled invocation rather than being automatically triggered by Azure Policy on resource creation or change. You would need to separately query Azure Resource Graph to locate untagged resources, run the runbook to apply tags, and then schedule it to run repeatedly — a process that lacks the native, real-time enforcement and remediation capabilities of Azure Policy. This makes it a secondary, non-integrated tool rather than the answer to the compliance requirement.
When this WOULD be correct
A company needs to automatically apply a specific configuration (e.g., enable diagnostics, set firewall rules) to existing and new virtual machines, but the configuration cannot be achieved through Azure Policy effects alone. In this case, an Azure Automation runbook triggered by Azure Policy (e.g., via DeployIfNotExists with a remediation task that calls a runbook) or scheduled to run periodically would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a new policy with DeployIfNotExists effectCorrect answer▾
Why this is correct
A policy with DeployIfNotExists effect is the correct choice because it can deploy an Azure Resource Manager template that adds the required tags to resources when they are created or updated. For already-deployed resources, the policy can be assigned and a remediation task can then be run to initiate the deployment and bring those existing resources into compliance. This gives continuous enforcement plus the ability to retrofit non-compliant resources, which is exactly what 'ensure all Azure resources' requires.
✗Create a remediation task for the policyWrong answer — click to see why▾
Why this is wrong here
Remediation tasks are used with DeployIfNotExists or Modify effect policies to bring non-compliant resources into compliance, but the policy in question uses the 'append' effect, which only applies to new resources and cannot trigger remediation tasks.
★ When this WOULD be the correct answer
A company has a DeployIfNotExists policy that deploys a resource (e.g., a network security group) and wants to automatically fix existing non-compliant resources. In that case, creating a remediation task would apply the policy to existing resources.
Why candidates choose this
Candidates may think remediation tasks can fix any policy non-compliance, but they only work with specific policy effects (DeployIfNotExists, Modify) and not with 'append'.
✗Use Azure Resource Graph to query and updateWrong answer — click to see why▾
Why this is wrong here
Azure Resource Graph can query resources and their tags, but it cannot directly update or remediate tags. It is a query tool, not an enforcement or remediation mechanism.
★ When this WOULD be the correct answer
A company needs to audit and report on all Azure resources that are missing specific tags, but does not require automatic remediation. They want to generate a list of non-compliant resources for manual review.
Why candidates choose this
Candidates may think that because Resource Graph can find untagged resources, it can also be used to update them, confusing query capabilities with remediation actions.
✗Create an Azure Automation runbookWrong answer — click to see why▾
Why this is wrong here
Azure Automation runbooks are used for custom automation tasks, but they are not the native solution for automatically remediating non-compliant resources identified by Azure Policy. The question specifically asks for automatic tag addition without manual effort, and Azure Policy's DeployIfNotExists effect with a remediation task is the designed approach.
★ When this WOULD be the correct answer
A company needs to automatically apply a specific configuration (e.g., enable diagnostics, set firewall rules) to existing and new virtual machines, but the configuration cannot be achieved through Azure Policy effects alone. In this case, an Azure Automation runbook triggered by Azure Policy (e.g., via DeployIfNotExists with a remediation task that calls a runbook) or scheduled to run periodically would be correct.
Why candidates choose this
Candidates may think that any automation (like a runbook) can solve the problem, and they might be familiar with using runbooks for tagging tasks. They overlook that Azure Policy provides a built-in remediation mechanism that is simpler and more integrated for policy-driven compliance.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
Key term
Policy assignment
Policy assignment is the process of attaching a set of rules or permissions to a specific resource, user, or group so that those rules are enforced in a cloud or IT environment.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.