A security engineer must configure Azure Policy to enforce that all Azure AI services (Cognitive Services, Azure OpenAI, Azure AI Search) in the organization must disable public network access. Which Azure Policy effect should be used to enforce this requirement on existing and new resources?

C is correct because the Azure Policy 'Modify' effect can automatically change resource properties (such as setting publicNetworkAccess to 'Disabled') on both new resource deployments and existing resources (via remediation tasks). This provides enforcement without completely blocking deployments while ensuring compliance. B is incorrect because Deny only blocks new non-compliant resources; DeployIfNotExists is for deploying additional resources (like diagnostic settings), not for modifying existing resource properties. A is incorrect because Audit-only provides visibility without enforcement, which does not meet the 'enforce' requirement. D is incorrect because Append adds properties to resource requests during deployment but cannot modify existing resources and may not override explicitly set values.