Describe the capabilities of Microsoft security solutions →mediumMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

{
  "policyRule": {
    "condition": {
      "allOf": [
        {
          "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
          "equals": "Allow"
        },
        {
          "field": "Microsoft.Storage/storageAccounts/networkAcls.ipRules",
          "exists": "false"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

Refer to the exhibit. The exhibit shows an Azure Policy definition. A storage account named 'storagedev' is created with network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules. What will happen when this policy is assigned?

⚠ Common exam trap

Microsoft often tests the distinction between 'Deny' and 'Audit' effects, where candidates mistakenly think a policy that marks non-compliance will still block creation, or that Azure Policy can automatically remediate without a specific 'DeployIfNotExists' or 'Modify' effect.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The storage account creation will be denied

The Azure Policy definition shown uses the 'Deny' effect, which explicitly blocks any resource creation that does not meet the specified conditions. Since the storage account 'storagedev' has network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules, it violates the policy's requirement for restricted network access. Therefore, Azure Policy will deny the creation of this storage account, preventing it from being provisioned.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The storage account will be created successfully
Why it's wrong here
The deny effect will block creation.
✗
The policy will audit the storage account and mark it as non-compliant
Why it's wrong here
The effect is deny, not audit.
✓
The storage account creation will be denied
Why this is correct
The policy condition is met, and deny effect blocks creation.
✗
The storage account will be created, but the policy will modify the ACLs
Why it's wrong here
Deny effect blocks, does not modify.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question