easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: A company uses Azure Policy to enforce that all…
A company uses Azure Policy to enforce that all storage accounts must have HTTPS traffic only. They assign a built-in policy to audit this setting. A developer creates a new storage account with HTTP enabled, and the policy reports it as non-compliant. What should the company do to automatically remediate this violation?
⚠ Common exam trap
Candidates often confuse the 'Deny' effect (which only blocks new non-compliant resources) with 'deployIfNotExists' (which remediates existing non-compliant resources), leading them to choose Option B instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new policy assignment with a 'deployIfNotExists' effect that enables HTTPS-only.
The 'deployIfNotExists' effect in Azure Policy can automatically remediate non-compliant resources by deploying a configuration (such as enabling HTTPS-only) when the policy detects a violation. This effect runs a remediation task that modifies the resource to meet the policy requirement, eliminating the need for manual intervention. In this scenario, it would automatically enable HTTPS traffic on the storage account, bringing it into compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Azure Security Center's just-in-time access for storage accounts.
Why it's wrong here
Azure Security Center's just-in-time (JIT) access is scoped to virtual machine management ports (RDP/SSH), reducing the attack surface of those VMs by requiring timed approval. Storage accounts are PaaS resources that do not expose such ports, and JIT cannot modify storage account properties like the supportsHttpsTrafficOnly flag. Therefore, this control is unrelated to enforcing or remediating HTTPS-only settings on storage accounts.
- ✗
Change the policy effect to 'Deny' to prevent creation of non-compliant storage accounts.
Why it's wrong here
Changing the policy effect to 'Deny' will only block new or updated storage accounts that do not meet the HTTPS-only requirement at creation time. It has no effect on existing storage accounts that were already created without the setting, leaving them permanently non-compliant unless someone manually changes them. Since the goal is automatic remediation of all non-compliant resources, Deny alone is insufficient.
- ✗
Ask the developer to manually enable HTTPS-only on the storage account.
Why it's wrong here
Asking the developer to manually enable HTTPS-only provides no automated enforcement, audit trail, or ongoing compliance check. It depends on human action and can be easily missed or delayed, especially across many accounts. The scenario requires a policy-based automatic remediation mechanism, not a one-time manual request.
- ✓
Create a new policy assignment with a 'deployIfNotExists' effect that enables HTTPS-only.
Why this is correct
A policy assignment with the deployIfNotExists effect triggers remediation when Azure Policy evaluates an existing storage account that lacks HTTPS-only. It deploys a nested Microsoft.Storage/storageAccounts resource to set the supportsHttpsTrafficOnly property to true, bringing the account into compliance automatically. This approach, often paired with a remediation task, provides continuous and scalable enforcement for both existing and newly created accounts.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.