Azure Policy deployIfNotExists for Automatic Remediation
Your organization uses Microsoft Defender for Cloud to protect Azure subscriptions. You need to enforce that all storage accounts must have encryption at rest enabled. You have enabled Azure Policy to audit this configuration. However, you notice that some storage accounts are non-compliant. You need to automatically remediate non-compliant storage accounts. What should you do?
Quick Answer
The correct choice is to add a deployIfNotExists policy assignment, which enables automatic remediation for non-compliant storage accounts by actively deploying the encryption configuration. Unlike an audit-only policy that merely reports non-compliance, deployIfNotExists triggers a remediation task that sets the encryption property to enabled on each non-compliant resource without manual intervention. On the SC-900 exam, this concept tests your understanding of Azure Policy effects and how they enforce security controls in Microsoft Defender for Cloud; a common trap is confusing audit (which only flags issues) with deployIfNotExists (which fixes them). Remember the memory tip: "Audit tells you it's broken, deployIfNotExists fixes it."
⚠ Common exam trap
Candidates often confuse 'deny' (which only blocks future non-compliant resources) with 'deployIfNotExists' (which remediates existing resources), or assume Defender for Cloud recommendations can automatically fix non-compliance without additional policy configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a 'deployIfNotExists' policy to automatically enable encryption on storage accounts.
A 'deployIfNotExists' policy assignment in Azure Policy can automatically remediate non-compliant storage accounts by enabling encryption at rest. This policy effect triggers a remediation task that deploys the required configuration (e.g., setting the 'Encryption' property to 'Enabled' on the storage account resource) without manual intervention. The audit policy only reports non-compliance, while deployIfNotExists actively enforces the desired state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Microsoft Defender for Cloud recommendation to enable encryption.
Why it's wrong here
Recommendations do not automatically remediate.
- ✗
Use the compliance dashboard to manually enable encryption on non-compliant accounts.
Why it's wrong here
This is not automated.
- ✓
Add a 'deployIfNotExists' policy to automatically enable encryption on storage accounts.
Why this is correct
This remediates non-compliant accounts automatically.
- ✗
Change the policy effect from 'audit' to 'deny' to prevent creation of non-compliant accounts.
Why it's wrong here
This does not remediate existing accounts.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all storage accounts have soft delete enabled to protect against accidental deletion. Which policy should you implement?
medium- A.Azure Blueprints
- ✓ B.Azure Policy with a built-in policy for storage accounts
- C.Azure role-based access control (RBAC)
- D.Defender for Cloud security recommendations
Why B: Azure Policy with a built-in policy for storage accounts is correct because it allows you to enforce organizational standards and assess compliance at scale. The built-in policy 'Storage accounts should have soft delete enabled' can be assigned to a subscription or resource group to automatically audit or remediate storage accounts that do not have soft delete configured, ensuring protection against accidental deletion.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.