Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The modify effect can automatically add, replace, or remove properties during the create or update operation without blocking the request. A policy that uses the modify effect can insert the CostCenter tag with the default value if the tag is absent, ensuring the deployment succeeds while enforcing the tagging requirement.

Deny would block the deployment entirely, violating the requirement to allow the resource to be created. Audit only records the absence of the tag but does not change the request. Append can add properties during the request but cannot remediate existing resources and is not used by the built-in "Add a tag to resources" policy; modify is the recommended effect for automatically adding mandatory tags.