Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped

Setting Minimum TLS Version 1.2 in Storage Account ARM Template

Exhibit

{
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2021-09-01",
      "name": "[parameters('storageName')]",
      "location": "[resourceGroup().location]",
      "kind": "StorageV2",
      "sku": {
        "name": "Standard_LRS"
      },
      "properties": {
        "minimumTlsVersion": "TLS1_2",
        "supportsHttpsTrafficOnly": true
      }
    }
  ]
}

Refer to the exhibit. You are reviewing an ARM template for a storage account. A security audit requires that all storage accounts enforce TLS 1.2 or higher. Does this configuration meet the requirement?

Quick Answer

The answer is yes, because the ARM template sets minimumTlsVersion to TLS1_2, which enforces TLS 1.2 as the minimum version for all client connections to the storage account. This property explicitly overrides the default behavior, ensuring that any request using TLS 1.0 or 1.1 is rejected, thereby meeting the security audit requirement. On the AZ-204 exam, this concept tests your understanding of Azure Storage security settings within ARM templates, often appearing alongside the supportsHttpsTrafficOnly property—a common trap is confusing HTTPS enforcement with TLS version control. Remember, supportsHttpsTrafficOnly only forces HTTPS protocol, not the specific TLS version, so always look for the minimumTlsVersion property to satisfy a TLS 1.2 mandate. A quick memory tip: “TLS version is set by minimumTlsVersion, not by HTTPS-only.”

⚠ Common exam trap

Many candidates confuse `supportsHttpsTrafficOnly` (which only enforces HTTPS, not TLS version) with the `minimumTlsVersion` property, or they assume the property uses a version string like `"1.2"` instead of the correct enum value `TLS1_2`.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Yes, because minimumTlsVersion is set to TLS1_2

The `minimumTlsVersion` property in the ARM template explicitly enforces the minimum TLS version for requests to the storage account. Setting it to `TLS1_2` ensures that only TLS 1.2 or higher connections are accepted, meeting the security audit requirement. The `supportsHttpsTrafficOnly` property only enforces HTTPS but does not control the TLS version, so it alone is insufficient.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
No, because supportsHttpsTrafficOnly does not enforce TLS version
Why it's wrong here
supportsHttpsTrafficOnly enforces HTTPS, not TLS version.
✓
Yes, because minimumTlsVersion is set to TLS1_2
Why this is correct
This property enforces the minimum TLS version.
✗
No, because minimumTlsVersion is not a valid property
Why it's wrong here
It is a valid property for storage accounts.
✗
No, because the property should be minimumTlsVersion: "1.2"
Why it's wrong here
The correct value is 'TLS1_2'.

Go deeper

1 more way this is tested on AZ-204

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. You executed the Azure CLI command to create a storage account. Later, you attempt to connect from an application that uses TLS 1.1. The connection fails. What is the most likely reason?

medium

A.The storage account uses Standard_GRS replication which is not accessible from all clients
B.The storage account is in a different location than the client
C.The storage account kind is StorageV2 which does not support blobs
✓ D.The minimum TLS version is set to 1.2, blocking TLS 1.1

Why D: The Azure CLI command used to create the storage account did not specify a minimum TLS version, so the default value of 1.2 applies. When the application attempts to connect using TLS 1.1, Azure Storage rejects the connection because the service enforces TLS 1.2 or higher. This is a security default in Azure Storage accounts created after a certain date, and it can be overridden by setting the `--min-tls-version` parameter to 1.0 during creation or by updating the account's properties.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.

Setting Minimum TLS Version 1.2 in Storage Account ARM Template

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on AZ-204