AZ-204 Implement Azure security Practice Question
Exhibit
{
"type": "Microsoft.Authorization/policyDefinitions",
"properties": {
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Storage/storageAccounts"
},
{
"field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
"equals": "Allow"
}
]
},
"then": {
"effect": "Audit"
}
}
}
}Refer to the exhibit. You have an Azure Policy definition as shown. Your team creates a storage account with network rules set to 'Deny' by default, and then adds an IP rule to allow traffic from a specific IP range. What compliance state will this storage account be reported as?
⚠ Common exam trap
Candidates often assume any policy with 'Deny' in the name will evaluate network rules or resource configuration, but 'DenyAction' only blocks specific operations and does not assess the resource's properties for compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compliant
The Azure Policy definition in the exhibit uses the 'DenyAction' effect, which only denies or audits specific actions (such as 'Microsoft.Storage/storageAccounts/write'). It does not evaluate the configuration of network rules on the storage account. Therefore, the storage account's network rule settings (defaultAction 'Deny' and IP rule) have no bearing on compliance with this policy. The resource is compliant because the policy's condition does not apply to network rules, and the write action was not blocked since the account was created successfully.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Error
Why it's wrong here
Error is not a recognized compliance state within Azure Policy. While policy evaluations can sometimes fail due to misconfigurations, service issues, or invalid resource properties, the resulting compliance state reported for a resource will typically be Compliant, Non-compliant, or Exempt. An Error state might be observed in activity logs or policy assignment details indicating a failure in the evaluation process itself, but it is not a final compliance classification for the resource.
- ✓
Compliant
Why this is correct
This policy definition utilizes the DenyAction effect, which specifically targets 'write' operations on storage accounts. It does not contain any conditions that evaluate the network rule configurations, such as public network access settings. Therefore, if a storage account already exists or is created without violating the 'write' operation conditions (which are not specified in the prompt but implied to be met), its compliance state will be Compliant because the policy's scope does not encompass network access restrictions. The policy only restricts actions, not the inherent configuration of existing resources outside its defined conditions.
- ✗
Exempt
Why it's wrong here
The Exempt compliance state is assigned when a resource or a scope (e.g., a resource group or subscription) has been explicitly excluded from a specific policy assignment through an Azure Policy Exemption. This administrative action allows resources to bypass policy evaluation for a defined period or indefinitely. Since the scenario does not indicate that an exemption has been applied to the storage account or its containing scope, this state is not applicable.
- ✗
Non-compliant
Why it's wrong here
A resource is marked Non-compliant when it violates the conditions defined within an assigned Azure Policy definition. In this specific scenario, the policy uses the DenyAction effect, which restricts specific operations (like 'write') rather than evaluating existing resource configurations. Crucially, the policy definition, as described, does not include any conditions to assess or enforce network rule configurations (e.g., private endpoint requirements or public network access restrictions). Therefore, even if the storage account had public network access, it would not be Non-compliant with this particular policy because its conditions do not evaluate network settings.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.