Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The DeployIfNotExists effect evaluates resources for compliance and, when remediation is executed, runs a specified deployment that changes non-compliant resources so they meet the policy requirements (for example, setting the minimum TLS version to 1.2 on an existing storage account). It also ensures any future resources are deployed with the correct configuration by adding a policy deployment at creation time.

The Audit effect only reports non-compliance and cannot remediate. Deny stops the creation or update of non-compliant resources instead of fixing them. Append adds additional settings to new or updated resources but does not change existing resources and cannot perform complex configuration like updating a property on an existing storage account. Therefore, DeployIfNotExists is the only effect that satisfies the requirement to automatically remediate existing resources without blocking deployments.