Your subscription includes Windows Server 2016 Azure VMs. Each VM must have a custom antimalware VM extension installed. You are authoring an Azure Policy to enforce this. Which policy effect should you include?

The correct answer is DeployIfNotExists. This effect is used to deploy a resource or template if a specified condition is met and the resource does not already exist. In this scenario, if a VM is created without the custom antimalware extension, the policy will automatically deploy it, ensuring compliance. AuditIfNotExists would only report non-compliance without taking corrective action, which doesn't meet the requirement to install the extension. Modify is used to add, update, or remove properties or tags on a resource during creation or update, but not to deploy an entirely new resource like a VM extension. Disabled would prevent the policy from being evaluated, making it ineffective.