Monitor, troubleshoot, and optimize Azure solutions →hardMultiple ChoiceObjective-mapped

AZ-204 Practice Question: Monitor, troubleshoot, and optimize Azure solutions

Exhibit

{
  "name": "mystorageaccount",
  "kind": "StorageV2",
  "properties": {
    "accessTier": "Cool",
    "supportsHttpsTrafficOnly": true,
    "minimumTlsVersion": "TLS1_2",
    "networkAcls": {
      "bypass": "AzureServices",
      "defaultAction": "Deny",
      "ipRules": [
        {
          "value": "203.0.113.0/24",
          "action": "Allow"
        }
      ],
      "virtualNetworkRules": []
    }
  }
}

Refer to the exhibit. You deployed an Azure Storage account with this ARM template. Users outside the allowed IP range receive '403 Forbidden' errors. What is the MOST likely cause?

⚠ Common exam trap

The trap here is that candidates often focus on the IP rule (option C) as the direct cause, but the real issue is the default action being set to 'Deny', which makes the rule an exclusive allow list rather than a permissive one.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The network ACL default action is Deny

The default action for network ACLs in Azure Storage is 'Deny' when no explicit rules match. Since the ARM template only allows traffic from the IP range 203.0.113.0/24, all other IP addresses are implicitly denied, resulting in 403 Forbidden errors for users outside that range.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The access tier is Cool
Why it's wrong here
The access tier (Hot, Cool, Archive) for an Azure Storage account primarily dictates the cost of storage and data retrieval, as well as the immediate availability of data. These tiers do not, however, govern network access permissions or authentication/authorization mechanisms. A 403 Forbidden error indicates an issue with authorization or network access control, entirely separate from the data's storage tier.
✗
The minimum TLS version is set to TLS1_2
Why it's wrong here
Setting a minimum TLS version, such as TLS 1.2, enforces a security standard for encrypted communication with the storage account. If a client attempts to connect using an older, unsupported TLS version, the connection would typically fail at the TLS handshake stage, resulting in a connection reset or a protocol error, not an HTTP 403 Forbidden status code. A 403 specifically signifies that the server understood the request but refused to fulfill it due to insufficient authorization.
✗
The IP rule allows only 203.0.113.0/24
Why it's wrong here
An IP rule that allows only a specific range, like 203.0.113.0/24, defines which network origins are permitted to connect to the storage account. While this rule restricts access, it does not inherently dictate the behavior for traffic originating from IP addresses *outside* this specified range. Without an explicit default action to deny all other traffic, merely defining an allowed IP range does not guarantee a 403 Forbidden error for all other IPs; the default network access policy is the critical factor.
✓
The network ACL default action is Deny
Why this is correct
When the network ACL default action for an Azure Storage account is set to 'Deny', it explicitly blocks all network traffic to the storage account by default. This means that only requests originating from IP addresses or Virtual Network subnets that are explicitly added to the allowed list will be permitted. Any client attempting to access the storage account from an unlisted network source will receive a 403 Forbidden error, as their request is understood but explicitly unauthorized by the network security configuration.

Go deeper

AZ-204 Practice Question: Monitor, troubleshoot, and optimize Azure solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question