SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Exhibit
{
"policyRule": {
"condition": {
"allOf": [
{
"field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
"equals": "Allow"
},
{
"field": "Microsoft.Storage/storageAccounts/networkAcls.ipRules",
"exists": "false"
}
]
},
"then": {
"effect": "deny"
}
}
}An Azure Policy definition has a Deny effect that denies storage accounts unless their network ACLs set defaultAction to Deny and include at least one IP rule. An administrator attempts to create a storage account named 'storagedev' with network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules. What will happen when this policy is assigned?
⚠ Common exam trap
Microsoft often tests the distinction between 'Deny' and 'Audit' effects, where candidates mistakenly think a policy that marks non-compliance will still block creation, or that Azure Policy can automatically remediate without a specific 'DeployIfNotExists' or 'Modify' effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The storage account creation will be denied
The Azure Policy definition uses the 'Deny' effect, which explicitly blocks any resource creation that does not meet the specified conditions. Since the storage account 'storagedev' has network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules, it violates the policy's requirement for restricted network access. Therefore, Azure Policy will deny the creation of this storage account, preventing it from being provisioned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The storage account will be created successfully
Why it's wrong here
The deny effect will block creation.
- ✗
The policy will audit the storage account and mark it as non-compliant
Why it's wrong here
The effect is deny, not audit.
- ✓
The storage account creation will be denied
Why this is correct
The policy uses a deny effect, so Azure Resource Manager blocks the deployment request outright when the storage account's network ACLs permit all traffic. Creation fails before the resource exists, rather than being flagged afterwards for remediation.
- ✗
The storage account will be created, but the policy will modify the ACLs
Why it's wrong here
Deny effect blocks, does not modify.
Go deeper
Related to this question
Learn chapter
Attack Surface Reduction Rules
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.