Develop data processing →hardMultiple ChoiceObjective-mapped

DP-203 Develop data processing Practice Question

Exhibit

{
  "name": "Policy to enforce HTTPS on storage accounts",
  "properties": {
    "policyRule": {
      "if": {
        "allOf": [
          { "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
          { "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly", "equals": "false" }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

Refer to the exhibit. You are an Azure data engineer responsible for ensuring that all storage accounts used in data pipelines enforce HTTPS traffic. You apply the Azure Policy definition shown above. Later, a data engineer creates a new storage account with 'Enable secure transfer' set to Disabled. What will happen when the policy is evaluated?

⚠ Common exam trap

Watch out — candidates often confuse the 'Deny' effect with 'Audit' or 'Disabled' effects, mistakenly believing that policy evaluation only happens during periodic compliance scans rather than at resource creation time, leading them to choose Option A or D.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The storage account creation will be denied and the request will fail.

The Azure Policy definition shown in the exhibit uses the 'Deny' effect for the 'Secure transfer to storage accounts should be enabled' policy. When a data engineer attempts to create a storage account with 'Enable secure transfer' set to Disabled, the policy evaluation occurs at resource creation time (before the resource is provisioned). Because the request violates the policy's condition (HTTPS traffic not enforced), Azure Resource Manager denies the creation request and returns a failure, preventing the non-compliant storage account from being created.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The storage account will be created, but the policy will be evaluated later during a compliance scan.
Why it's wrong here
Policies with 'deny' effect are evaluated during creation.
✗
The storage account will be created with HTTPS enabled automatically.
Why it's wrong here
The policy does not modify properties; it denies non-compliant resources.
✓
The storage account creation will be denied and the request will fail.
Why this is correct
The policy denies the creation if the condition is met.
✗
The storage account will be created, but an audit event will be logged.
Why it's wrong here
The effect is 'deny', not 'audit'.

Go deeper

DP-203 Develop data processing Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question