Design identity, governance, and monitoring solutions →hardMultiple ChoiceObjective-mapped

AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Exhibit

subscriptions:
  - name: sub-prod
    location: eastus
    resourceGroups:
      - name: rg-prod
        resources:
          - type: Microsoft.Storage/storageAccounts
            name: stprod001
            properties:
              accessTier: Hot
              supportsHttpsTrafficOnly: true
              minimumTlsVersion: TLS1_2

Refer to the exhibit. You are reviewing a Bicep template for a storage account. You need to ensure that the storage account is only accessible via HTTPS and uses TLS 1.2. Which property validates this requirement?

⚠ Common exam trap

Candidates often confuse `supportsHttpsTrafficOnly` with a simple boolean toggle and forget that `minimumTlsVersion` is a separate, required property to enforce the specific TLS version, leading them to select an option that only partially addresses the requirement.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

supportsHttpsTrafficOnly: true and minimumTlsVersion: TLS1_2

The `supportsHttpsTrafficOnly` property enforces that all traffic to the storage account must use HTTPS, and the `minimumTlsVersion` property set to `TLS1_2` ensures that only TLS 1.2 or higher is accepted. Together, these two properties satisfy the requirement of HTTPS-only access with TLS 1.2, as defined in the Azure Storage security baseline.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
type: Microsoft.Storage/storageAccounts
Why it's wrong here
The type property in a Bicep template declares the resource provider and resource type, for example Microsoft.Storage/storageAccounts, which instructs Azure Resource Manager on the resource to deploy and its schema. It is a declarative identifier and does not influence the storage account's runtime configuration or transport security settings. Therefore, it neither enforces HTTPS traffic nor specifies a minimum TLS version.
✗
accessTier: Hot
Why it's wrong here
The accessTier property configures the storage account's blob access tier, either Hot or Cool, to optimize cost and performance based on data access patterns. This setting is purely for storage tiering and does not affect the network transport layer or encryption protocols. Since the requirement is about enforcing HTTPS and TLS 1.2, setting accessTier to Hot is irrelevant and would not satisfy the compliance requirement.
✓
supportsHttpsTrafficOnly: true and minimumTlsVersion: TLS1_2
Why this is correct
Configuring supportsHttpsTrafficOnly to true enforces that all client requests to the storage account must be made over HTTPS, causing any HTTP request to be rejected. The minimumTlsVersion property set to TLS1_2 further ensures that connections use at least TLS version 1.2, blocking older protocols such as TLS 1.0 and 1.1. Together, these two properties provide complete transport security enforcement, which is exactly what the requirement asks for.
✗
name: stprod001
Why it's wrong here
The name property assigns a globally unique name to the storage account, which becomes part of the service endpoints such as stprod001.blob.core.windows.net. It serves only as a DNS prefix and does not alter any security controls or network behavior. Setting a specific name has no impact on HTTPS enforcement or the minimum TLS version, so it cannot fulfill the requirement.

Go deeper

AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question