SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Exhibit
Refer to the exhibit.
Get-AzStorageAccount -ResourceGroupName RG1 -Name storage1 | fl
...
NetworkRuleSet : Microsoft.Azure.Commands.Management.Storage.Models.PSNetworkRuleSet
DefaultAction : Deny
IpRules : {}
VirtualNetworkRules : {}
...Refer to the exhibit. You run the Azure PowerShell command for a storage account. What is the current network access configuration?
⚠ Common exam trap
Students often mistakenly think that setting `DefaultAction Deny` alone makes the storage account accessible from specific networks or IPs, but they must remember that explicit rules must also be configured for any access to be allowed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The storage account is not accessible from any network.
The Azure PowerShell command `Update-AzStorageAccountNetworkRuleSet -ResourceGroupName 'RG1' -StorageAccountName 'stgacc1' -DefaultAction Deny` sets the default network access rule to Deny. When the default action is Deny, no traffic is allowed unless explicitly permitted by a network rule (e.g., from a specific virtual network or IP address). Since no such rules are shown in the exhibit, the storage account is effectively not accessible from any network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The storage account is accessible only from specific virtual networks.
Why it's wrong here
The VirtualNetworkRules array is empty, indicating that no specific virtual networks have been configured to allow access to this storage account. Therefore, the storage account is neither restricted to, nor accessible from, any particular virtual networks based on these network firewall settings. This configuration does not grant access exclusively via virtual networks.
- ✗
The storage account is accessible from all networks.
Why it's wrong here
The DefaultAction for the storage account's network rules is explicitly set to Deny. This means that all network traffic is blocked by default, unless specifically allowed by an explicit rule. Consequently, the storage account is not accessible from all networks; rather, it is configured to block all access by default.
- ✓
The storage account is not accessible from any network.
Why this is correct
With the DefaultAction set to Deny and both the IpRules and VirtualNetworkRules arrays being empty, there are no explicit rules configured to override the default denial. This combination ensures that all incoming network traffic, regardless of its origin (public internet or Azure virtual networks), is blocked. Therefore, the storage account is effectively inaccessible from any network.
- ✗
The storage account is accessible only from specific IP addresses.
Why it's wrong here
The IpRules array, which is used to specify allowed individual IP addresses or IP ranges, is empty. This absence of any defined IP rules means that no specific IP addresses have been granted permission to access the storage account. Therefore, the storage account is not accessible exclusively from, nor restricted to, any particular IP addresses.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.