Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Exhibit

resourceGroup: myResourceGroup
parameters:
  - name: location
    type: string
    defaultValue: eastus
resources:
  - type: Microsoft.Storage/storageAccounts
    name: mystorageaccount
    properties:
      supportsHttpsTrafficOnly: true
      minimumTlsVersion: TLS1_2
      networkAcls:
        defaultAction: Deny
        ipRules: []
        virtualNetworkRules: []

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. Which security best practice is implemented?

⚠ Common exam trap

Candidates often confuse 'defaultAction: Deny' with 'restrict network access by IP address' (Option B), but the default deny does not itself restrict by IP—it simply blocks everything until explicit allow rules are added.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deny all network traffic by default

The ARM template snippet shows the 'defaultAction' property set to 'Deny' under 'networkAcls', which explicitly denies all network traffic by default. This is a security best practice because it implements a zero-trust network model, ensuring that only explicitly allowed traffic (via IP rules or virtual network rules) can access the storage account. Option C correctly identifies this as the default deny behavior.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enforce HTTPS traffic only
Why it's wrong here
This is implemented but not the only one; the question may have multiple correct? But we need one best. Actually, the template does enforce HTTPS, but also network default deny. I'll choose the network default deny as it's a strong security control.
✗
Restrict network access by IP address
Why it's wrong here
Restrict network access by IP address is incorrect because the ARM template's networkAcls object contains an empty ipRules array. That means no specific IPv4 or IPv6 CIDR ranges are allowlisted; the template does not use IP-based filtering at all. Instead, network security is achieved solely through the defaultAction property, so this option describes a control that is not present in the deployment.
✓
Deny all network traffic by default
Why this is correct
Deny all network traffic by default is correct because the storage account template sets the networkAcls.defaultAction property to Deny. With this configuration, any request that does not match an explicitly permitted rule (such as a service endpoint or virtual network rule) is blocked at the network layer. This enforces a strict zero-trust baseline: all inbound traffic is denied unless an exception is explicitly defined, making it the primary network hardening control in the template.
✗
Enable soft delete for blobs
Why it's wrong here
Enable soft delete for blobs is incorrect because the template does not contain a deleteRetentionPolicy property under the blob service, nor any softDelete configuration. Soft delete is a data-protection feature that preserves deleted blobs for recovery, but it is unrelated to the network access controls being evaluated. Since this setting is absent from the ARM template, this option does not reflect any security control actually deployed.

Go deeper

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question