hardMultiple ChoiceObjective-mapped

AZ-400 Practice Question: An Azure Policy is defined as shown in the exhibit

Exhibit

Refer to the exhibit.

```
{
  "properties": {
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Storage/storageAccounts"
          },
          {
            "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
            "equals": "false"
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}
```

An Azure Policy is defined as shown in the exhibit. You attempt to create a storage account with HTTPS traffic only set to false. What will happen?

⚠ Common exam trap

A common mix-up: candidates confuse the 'Deny' effect with 'Audit' or 'Modify', mistakenly thinking the policy will either log the violation or auto-correct the setting, rather than understanding that 'Deny' blocks the operation entirely.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The creation will be denied with an error message

The Azure Policy in the exhibit uses a 'Deny' effect for the condition that storage accounts must have HTTPS traffic enabled. When you attempt to create a storage account with 'HTTPS traffic only' set to false, the policy evaluation detects a non-compliant resource and denies the creation request, returning an error message. This is because the 'Deny' effect blocks the resource deployment entirely, preventing the non-compliant configuration from being provisioned.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy will only apply if the storage account is in a specific resource group
Why it's wrong here
The policy's rule does not include a resourceGroup field or a location condition; it targets all storage accounts within the assignment scope. The condition evaluates only the resource type and the supportsHttpsTrafficOnly property, so it is not restricted to any specific resource group.
✗
The storage account will be created but HTTPS will be enforced
Why it's wrong here
The policy effect is 'deny', not 'modify' or 'deployIfNotExists'. Deny blocks the resource creation request before the storage account is provisioned, so it cannot enforce HTTPS by altering the resource after creation—the request is simply rejected.
✗
The storage account will be created and an audit event will be logged
Why it's wrong here
The policy uses the 'deny' effect, whereas an audit effect only logs compliance information in the activity log. Because this is a deny policy, the resource creation is blocked rather than allowed with an audit event being recorded.
✓
The creation will be denied with an error message
Why this is correct
The policy effect is 'deny', which causes Azure Resource Manager to evaluate the request and, if the storage account does not have supportsHttpsTrafficOnly set to true, reject the creation with a policy violation error message. The resource is never created as a result.

Go deeper

AZ-400 Practice Question: An Azure Policy is defined as shown in the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question