A policy must add a tag with a fixed value to a resource request when, and only when, that tag is absent, without altering any other property. Which effect does this?
Show answer and explanation
Answer: A
Append inspects the request and adds the specified field only if it is missing. If the tag is already present, even with a different value, Append leaves it alone, so it never overwrites an existing setting. It applies during create and update of the resource and does not by itself fix resources that already exist; a Modify effect with a remediation task is the usual choice when existing resources must be corrected. Append is therefore the precise fit for filling in a missing default.
Why the other options are wrong
- B. Audit produces a compliance record and an activity log entry. It changes nothing in the request, so the tag would still be missing.
- C. Deny refuses the request entirely. The requirement is to add the missing field, not to reject the deployment.
- D. DeployIfNotExists evaluates a related resource and deploys a template when that resource is absent. It does not insert a tag into the current request.
Exam tip. Append fills a gap; Modify can correct existing values and remediate.