Describe considerations for working with non-relational data on Azure →mediumMultiple ChoiceObjective-mapped
DP-900 Practice Question: Describe considerations for working with non-relational data on Azure
Exhibit
{
"version": "2019-01-01",
"name": "assignSasPolicy",
"type": "Microsoft.Authorization/policyAssignments",
"properties": {
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/abcd-1234",
"parameters": {
"effect": "deny"
},
"scope": "/subscriptions/12345/resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/storage1"
}
}Refer to the exhibit. An administrator deploys this Azure Policy assignment. What is the most likely effect on storage account 'storage1'?
⚠ Common exam trap
Many exam-takers confuse 'Deny' with 'DeployIfNotExists' or 'Modify' effects, assuming the policy will automatically change settings or delete resources, when in fact 'Deny' only blocks non-compliant requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Public network access will be denied.
The Azure Policy assignment shown in the exhibit denies the creation or update of storage accounts that do not have public network access disabled. Since 'storage1' is subject to this policy, the policy will enforce the 'Deny' effect, preventing any configuration that allows public network access. If 'storage1' already exists and is compliant, it remains; if it is non-compliant, the policy will block changes that would enable public access, effectively denying public network access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Public network access will be denied.
Why this is correct
The Azure Policy assignment uses the `deny` effect, which explicitly blocks any non-compliant create or update request. When a user attempts to deploy a storage account with `publicNetworkAccess` enabled (or leaves it at the default of `Enabled`), policy evaluation returns a 403 Forbidden error and the request fails. This prevents the storage account from ever being provisioned in a state that exposes it to the public internet, thus enforcing the rule that public network access is denied.
- ✗
The storage account will be deleted.
Why it's wrong here
The `deny` effect is a preventive guardrail, not a remediation action. It rejects non-compliant requests at the time of deployment but never issues any delete operations on existing resources. Deleting a storage account would require a separate mechanism such as an Azure Policy `deployIfNotExists` with a linked ARM template that calls the delete API, or manual removal, but this policy has no such scope. Thus, the storage account remains in place and is simply denied from being created or updated with public access.
- ✗
Firewall rules will be added.
Why it's wrong here
This policy is scoped to the `publicNetworkAccess` property of the storage account, not to the `networkAcls` object that controls firewall and virtual network rules. The `deny` effect only blocks non-compliant actions; it does not trigger a separate deployment or mutate the resource to add network ACLs. Adding firewall rules would require a policy with the `deployIfNotExists` effect and a linked template that configures `defaultAction`, IP rules, and virtual network rules—none of which occur here. Therefore, the policy outcome is a denial, not configuration of firewall rules.
- ✗
Soft Delete will be enabled.
Why it's wrong here
Soft Delete for storage blobs/containers is an entirely separate data protection feature controlled by properties like `deleteRetentionPolicy` on the blob service, and it has nothing to do with network access controls. This policy only evaluates `publicNetworkAccess` on the storage account resource itself, so its `deny` effect cannot enable or alter any blob service properties. Furthermore, the `deny` effect is not capable of enabling features—policy effects that modify resources are `modify`, `deployIfNotExists`, or `append`, not `deny`. Enabling Soft Delete would require a different policy assignment or manual configuration, not this one.
Go deeper
Related to this question
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.