Exam AZ-400 topic 4 question 22 discussion

Correct answer is good, the policy is not going to apply to the existing resources, unless you run a remediation task to force the policy to all the existing resources

If storage accounts don't support HTTPS only, then deny. Therefore answer is A, only accepts encrypted traffic.

The correct answer is: B. ensures that all traffic to new Azure Storage accounts is encrypted Why other options are incorrect: A. prevents all HTTP traffic to existing Azure Storage accounts: Incorrect. The policy applies only to new or modified storage accounts because Azure Policies enforce compliance at the resource creation or modification stage, not retroactively. C. prevents HTTPS traffic to new Azure Storage accounts when the accounts are accessed over the Internet: Incorrect. The policy enforces HTTPS traffic, not prevents it. D. ensures that all data for new Azure Storage accounts is encrypted at rest: Incorrect. The policy only concerns HTTPS traffic, not encryption at rest. Azure Storage accounts encrypt data at rest by default.

Answer A is also correct if the remediation is ran. But selecting B for now

B. ensures that all traffic to new Azure Storage accounts is encrypted

answer B That's the cheese!

The code just seems unnecessary and answers just as bad. From what i understand it has 2 negative clauses that would effectively mean the https rule is enforced, so the storage traffic is securely encrypted. Ans: B.

Not equals true then deny is the key here You do not allow traffic if it is not HTTPS Answer is B

All traffic to the Azure Storage Account is encrypted through HTTPS

B is correct answer.

Correct and you can run "remediation task for existing resources.

Selected during exam. B. ensures that all traffic to new Azure Storage accounts is encrypted

This is the reason why the correct answer is B: "During evaluation of existing resources, resources that match a deny policy definition are marked as non-compliant" https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects#deny

Correct answer B. Azure policy wont affect existing resources I think, only the newly created once after policy is enforced are affected.

Correct. Policy denies all future storage accounts that don't support HTTPS. Policies don't affect existing resources, hence A is incorrect.

Word up. It's B, I'm not going to put the same link everyone else provided. This is a well documented answer.

Correct Answer is B