AZ-104 Question 35
Single answerYou are an Azure Administrator for Contoso. The company requires all resources in a particular subscription to have a 'Department' tag for cost tracking. Additionally, any existing resources missing the 'Department' tag must be automatically tagged. Which Azure Policy effect should you use to meet both requirements in a single policy definition?
- A
Deny
- B
Append
- C
Modify
- D
AuditIfNotExists
Show answer and explanation
Correct answer: C
Explanation
The Modify effect is the correct choice because it not only enforces the 'Department' tag on newly created resources but also remediates existing resources by assigning the tag if they don’t have it.
- A. Incorrect.
Deny will block the creation of resources without the specified tag but will not automatically tag existing resources.
- B. Incorrect.
Append only adds the tag to new or updated resources at creation time without changing existing resources lacking the tag.
- C. Correct.
Modify can apply the tag to new and existing resources, automatically fixing noncompliant resources.
- D. Incorrect.
AuditIfNotExists merely logs resources that lack the tag but does not enforce or remediate it.