Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

{
  "identity": {
    "type": "SystemAssigned"
  },
  "properties": {
    "publicNetworkAccess": "Disabled",
    "minimumTlsVersion": "1.2",
    "networkAcls": {
      "defaultAction": "Deny",
      "ipRules": [
        {
          "value": "10.0.0.0/24",
          "action": "Allow"
        }
      ]
    }
  }
}

Refer to the exhibit. You are reviewing an ARM template for an Azure resource. Assuming the resource is a Key Vault, what is the effect of the networkAcls configuration?

⚠ Common exam trap

Watch out — candidates often assume a single ipRule with a subnet means the Key Vault is accessible from all Azure services or from any network, but the defaultAction of 'Deny' explicitly blocks all traffic except the allowed IP range, and the absence of a bypass setting prevents Azure services from accessing the vault.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Key Vault is accessible only from the 10.0.0.0/24 subnet.

The networkAcls configuration in the ARM template defines IP firewall rules for the Key Vault. By specifying a defaultAction of 'Deny' and a single ipRule with a value of '10.0.0.0/24', the Key Vault is configured to allow traffic only from the 10.0.0.0/24 subnet. All other traffic, including traffic from other networks and Azure services, is denied by default.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Key Vault is accessible from any network.
Why it's wrong here
The Key Vault is not accessible from any network. The "publicNetworkAccess" property is explicitly set to "Disabled," which prevents access from the public internet. Furthermore, the "defaultAction" is configured as "Deny," meaning all network traffic is blocked by default unless an explicit network rule permits it. This combination ensures a highly restricted access posture, not open access.
✓
The Key Vault is accessible only from the 10.0.0.0/24 subnet.
Why this is correct
This statement is correct. The network access configuration includes an "ipRules" entry specifically allowing traffic from the "10.0.0.0/24" subnet. Since the "defaultAction" is set to "Deny," any network traffic originating from outside this explicitly permitted IP range will be blocked. This creates a precise security boundary, restricting access exclusively to the specified subnet.
✗
The Key Vault is accessible from all Azure services.
Why it's wrong here
This is incorrect because the network access configuration does not include a "bypass" rule for "AzureServices." With "defaultAction" set to "Deny" and no explicit rule allowing Azure services, only the traffic matching the defined IP rule (10.0.0.0/24) is permitted. Therefore, the Key Vault is not generally accessible from all Azure services, only from the specified private network range.
✗
The Key Vault is not accessible from any network.
Why it's wrong here
This statement is incorrect. While the "defaultAction" is "Deny" and "publicNetworkAccess" is "Disabled," the network access configuration includes an explicit "ipRules" entry for "10.0.0.0/24." This specific rule creates an exception to the default denial, allowing traffic originating from the 10.0.0.0/24 subnet to access the Key Vault. Thus, it is accessible from at least one network.

Visual reference

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question