Describe an analytics workload on Azure →hardMultiple ChoiceObjective-mapped

DP-900 Describe an analytics workload on Azure Practice Question

Exhibit

{
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        {
          "field": "Microsoft.Storage/storageAccounts/kind",
          "equals": "StorageV2"
        },
        {
          "field": "Microsoft.Storage/storageAccounts/encryption.keySource",
          "notEquals": "Microsoft.Keyvault"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

Refer to the exhibit. A data engineer wants to ensure that all Azure Storage accounts used for analytics use customer-managed keys. They apply this Azure Policy. What is the outcome?

⚠ Common exam trap

Watch out — candidates often confuse the 'Deny' effect with 'Audit' or 'Append', and mistakenly think the policy only monitors or tags accounts instead of actively blocking non-compliant ones.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy denies creation of StorageV2 accounts that use Microsoft-managed keys

The Azure Policy in the exhibit uses the 'Deny' effect on storage accounts that do not use customer-managed keys (i.e., that use Microsoft-managed keys). This means any attempt to create or update a storage account without customer-managed encryption will be blocked. Option D correctly identifies that the policy denies creation of StorageV2 accounts (or any storage account type covered by the policy scope) that use Microsoft-managed keys.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy audits existing storage accounts for compliance
Why it's wrong here
This policy cannot audit existing storage accounts because its effect is deny, not audit. An audit effect only marks noncompliant resources in the compliance report while allowing the deployment to proceed, but a deny effect rejects the resource creation or update request before it is accepted. Deny does not retroactively change or remove existing resources, so this option mischaracterizes the effect and the scope of the policy.
✗
The policy allows all storage accounts whether they use customer-managed keys or not
Why it's wrong here
The policy does not allow all storage accounts; it explicitly denies any storage account whose encryption keySource is not set to Microsoft.Keyvault. Storage accounts that use Microsoft-managed keys report keySource as Microsoft.Storage, which matches the notEquals condition, causing the deny effect to block the deployment. In practice, the only storage accounts that pass are those configured with customer-managed keys from Azure Key Vault.
✗
The policy only applies to storage accounts with hierarchical namespace enabled
Why it's wrong here
Nothing in the policy rule references the HierarchicalNamespace property or any Data Lake Storage Gen2 setting. Azure Policy evaluates the condition on the storage account resource type and the encryption.keySource alias, so the same requirement applies regardless of whether hierarchical namespace is enabled. Unless the policy definition explicitly filters on the hierarchical namespace field, that feature does not change the policy's applicability.
✓
The policy denies creation of StorageV2 accounts that use Microsoft-managed keys
Why this is correct
The policy denies StorageV2 account creation when the encryption key source is not Microsoft.Keyvault. For StorageV2 accounts using Microsoft-managed keys, the keySource field is set to Microsoft.Storage, which is not equal to Microsoft.Keyvault, so the condition is satisfied and the deny effect blocks the deployment. The result is that a StorageV2 account must use customer-managed keys with Azure Key Vault to be created.

Go deeper

DP-900 Describe an analytics workload on Azure Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question