Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Network Topology
Refer to the exhibit. You executed the Azure CLI command to create a storage account. Later, you attempt to connect from an application that uses TLS 1.1. The connection fails. What is the most likely reason?
⚠ Common exam trap
The trap here is that candidates may overlook the default minimum TLS version setting in Azure Storage and assume that TLS 1.1 is always supported, or they may incorrectly attribute the failure to replication type, location, or storage account kind.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The minimum TLS version is set to 1.2, blocking TLS 1.1
The Azure CLI command used to create the storage account did not specify a minimum TLS version, so the default value of 1.2 applies. When the application attempts to connect using TLS 1.1, Azure Storage rejects the connection because the service enforces TLS 1.2 or higher. This is a security default in Azure Storage accounts created after a certain date, and it can be overridden by setting the `--min-tls-version` parameter to 1.0 during creation or by updating the account's properties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The storage account uses Standard_GRS replication which is not accessible from all clients
Why it's wrong here
The replication type, such as Standard_GRS (Geo-Redundant Storage), primarily dictates the data durability, availability, and redundancy strategy across Azure regions. It does not, however, influence the network accessibility of the storage account from various clients or dictate the minimum TLS version required for connection. Clients can access a GRS storage account as long as network connectivity is established and the client's TLS capabilities meet the account's security requirements.
- ✗
The storage account is in a different location than the client
Why it's wrong here
The geographical location of an Azure storage account relative to the client primarily impacts network latency and potentially data transfer costs, but it does not inherently cause a TLS version mismatch or prevent connectivity. TLS negotiation is a protocol-level agreement between the client and server; as long as a network path exists, the physical distance does not dictate which TLS versions are supported or enforced by either party. Therefore, a client in a different location would still connect successfully if its TLS version is compatible.
- ✗
The storage account kind is StorageV2 which does not support blobs
Why it's wrong here
The StorageV2 (General-purpose v2) account kind is the recommended and most feature-rich type for Azure Storage, designed to support all Azure Storage services, including blobs, files, queues, and tables. This account type offers advanced features like hierarchical namespaces for Azure Data Lake Storage Gen2 and supports premium performance tiers. Therefore, the assertion that StorageV2 does not support blobs is fundamentally incorrect, as blob storage is a core service it provides.
- ✓
The minimum TLS version is set to 1.2, blocking TLS 1.1
Why this is correct
The Azure CLI command `az storage account update --minimum-tls-version TLS1_2` explicitly configures the storage account to reject any incoming connections that attempt to negotiate a TLS protocol version older than 1.2. If a client application or operating system is configured to use TLS 1.0 or TLS 1.1, the connection will fail during the initial TLS handshake phase, resulting in a connectivity error. This setting directly enforces a higher security standard, blocking older, less secure TLS versions.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.