Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Fixing Existing Noncompliant Resources with Remediation Tasks
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization assigns an Azure Policy definition that uses a Modify effect to automatically add a required CostCenter tag to all resources in a subscription.
While newly created resources receive the tag automatically, an evaluation scan reveals that hundreds of existing resources deployed before the policy assignment are marked as non-compliant because they lack the required tag.
What should the administrator configure in Azure Policy to automatically bring these existing non-compliant resources into compliance?
Explanations
An Azure Advisor recommendation
An Azure Advisor recommendation
What Azure Advisor Is
Azure Advisor is a personalized cloud consultant that analyzes resource telemetry and configurations to provide actionable best-practice recommendations across reliability, security, performance, operational excellence, and cost optimization.
Why It Doesn't Meet the Requirement
Azure Advisor is an advisory service rather than a policy remediation engine:
- Lacks custom policy remediation: Advisor does not automatically execute policy remediation tasks defined by custom organizational tagging rules.
- No bulk modification for policy effects: While Advisor highlights optimization opportunities, it cannot trigger Azure Policy Modify rules across hundreds of untagged resources.
- Advisory, not authoritative governance: Advisor provides guidance based on Microsoft best practices rather than enforcing internal organizational tag schemas.
Key Characteristics and Limitations
- Predefined recommendation rules: Generates recommendations based on built-in telemetry patterns across five core pillars.
- Manual action requirement: Most Advisor recommendations require manual review and intervention rather than declarative policy-driven execution.
- Separate from policy engine: Operates independently of the Azure Policy assignment and evaluation engine.
This Answer Would Be Correct If
The organization wanted actionable recommendations and insights on how to optimize costs, improve high availability, or close common security vulnerabilities.
A policy exclusion
A policy exclusion
What a Policy Exclusion Is
A policy exclusion (or exemption) is a scoping mechanism within Azure Policy that prevents policy rules from being evaluated or enforced on a specific management group, subscription, resource group, or resource.
Why It Doesn't Meet the Requirement
Exclusions are designed to bypass governance evaluation rather than resolve non-compliance:
- Leaves resources untagged: Configuring an exclusion ignores the selected resources during policy evaluation, leaving them without the required CostCenter tag.
- Bypasses standards rather than fixing them: Instead of bringing resources into compliance, an exclusion simply hides or exempts them from compliance reporting.
- Improper governance application: Using exclusions for existing resources violates organizational compliance goals rather than fixing configuration drift.
Key Characteristics and Limitations
- Scope hierarchy: Exclusions apply at a child scope lower than the primary policy assignment scope.
- Non-remediating nature: An exclusion does not modify resource metadata, tags, or deployment templates.
- Administrative overhead: Managing widespread exclusions complicates governance tracking and security posture visibility.
This Answer Would Be Correct If
The organization needed to deliberately excuse legacy systems or third-party testing environments from mandatory tagging rules due to operational or technical constraints.
A resource lock
A resource lock
What a Resource Lock Is
An Azure resource lock is a protection mechanism applied via Azure Resource Manager to prevent unauthorized or accidental deletion and modification of critical cloud resources.
Why It Doesn't Meet the Requirement
Resource locks focus on access protection and change prevention, not automated configuration or policy remediation:
- No remediation capability: A resource lock cannot apply tags, update metadata, or modify resource properties.
- Potential blocker: Applying a ReadOnly lock would actually prevent the policy engine or administrators from adding the missing tag to existing resources.
- Different governance role: Resource locks preserve state, whereas remediation tasks alter state to enforce compliance.
Key Characteristics and Limitations
- Lock types: Available primarily as CanNotDelete (prevents deletion while allowing modifications) and ReadOnly (prevents both modifications and deletion).
- Inheritance: Locks applied at higher scopes (such as subscriptions or resource groups) are automatically inherited by all child resources.
- Independent of compliance: Locks do not evaluate resource attributes against governance definitions.
This Answer Would Be Correct If
The scenario required preventing accidental deletion of production resources by developers or administrators.
A remediation task
A remediation task
What a Remediation Task Is
An Azure Policy remediation task is an automated governance mechanism designed to bring existing non-compliant resources into full alignment with policy definitions. While standard policy enforcement intercepts and alters resource requests during deployment or update cycles, remediation tasks actively evaluate and alter pre-existing resources that fail compliance checks.
How It Meets the Requirements
In this scenario, the organization needs to update hundreds of pre-existing resources without performing tedious manual updates across each individual resource:
- Automated bulk updates: A remediation task evaluates the existing resources against the assigned policy definition and applies the necessary changes at scale.
- Support for modifying effects: For policies using Modify or DeployIfNotExists effects, the remediation task applies the specified tag or configuration template to all declared non-compliant items.
- Managed Identity integration: The remediation task leverages a Managed Identity with role-based access control (RBAC) permissions to securely update resources on behalf of the administrator.
Key Advantages and Capabilities
- Targeted execution: Administrators can remediate an entire subscription, a specific resource group, or individual non-compliant resources.
- Audit trail and reporting: Each remediation task provides granular status reporting showing succeeded, failed, and in-progress resource updates.
- Operational efficiency: Eliminates the need for custom scripts or manual portal modifications across large-scale enterprise environments.
- Continuous alignment: Ensures that historical infrastructure complies with newly introduced organizational governance standards.
Why This Is Optimal
Creating a remediation task directly leverages the native capabilities of Azure Policy to remediate historical non-compliance automatically. It satisfies the requirement without writing external automation scripts or disrupting daily operations.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Initiative Definition
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Allowed Locations Built-In
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Compliance Enforcement
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Read-Access Geo-Redundant Storage (RA-GRS)
Describe redundancy options
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated