AZ-305 Practice Question 52: Policy Tag Remediation Effect
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 6 · question 2 of 10
A company wants every resource in a subscription to carry the CostCenter tag of its parent resource group. Existing resources that lack the tag must be corrected, new deployments must not be blocked when the tag is missing, and the fix must be applied automatically instead of being reported for manual follow-up.
Which Azure Policy design meets these requirements?
Show answer and explanation
Answer:
The Modify effect adds, replaces or removes properties and tags on a resource during creation or update, so new resources are corrected instead of rejected. Policy can also apply it to existing noncompliant resources through a remediation task. The assignment needs a managed identity that holds the roles listed in the definition (such as Tag Contributor) so that it is allowed to change the tags.
Option A only reports. Audit never changes a resource, so every fix stays manual, which the scenario rules out.
Option B blocks deployments that lack the tag, but the requirement says new deployments must not be blocked. Deny also does nothing for resources that already exist.
Option C is close but fails on the existing resources. Append only adds fields to a create or update request as it is evaluated; remediation tasks are available for Modify and DeployIfNotExists, not for Append, so the existing resources would stay untagged.
Reference: Azure Policy definitions effect basics