Exam AZ-500 topic 3 question 9 discussion

But "default action" is applied only when no rule is matched. Here the client's IP does match the "allowed networks" rule.

@alou333 Is there simulations in the online exam?

Hello francis, was there any simulation question? Thanks in advance for your response.

the "first rule" you are referring to means what is the default action to allow access. It's set to deny, which is correct, as you would explicitly deny access and then either grant access to a vnet or ip address, like the example shows. The given answers are correct.

"By default, storage accounts accept connections from clients on any network. You can limit access to selected networks or prevent traffic from all networks and permit access only through a private endpoint. You must set the default rule to deny, or network rules have no effect. However, changing this setting can affect your application's ability to connect to Azure Storage. Be sure to grant access to any allowed networks or set up access through a private endpoint before you change this setting." Source: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

Not sure what you mean... the 3rd command shows that Subnet1 is allowed. The range of Subnet1 is 10.0.0.0/24 (10.0.0.0 - 10.0.0.255). Subnet2 10.1.1.0/24 (10.1.1.0 - 10.1.1.255) is not allowed anywhere so the answer is no. Finally, range 193.77.0.0/16 (193.77.0.0 - 193.77.255.255) is allowed, so 193.77.10.2 would be allowed as it is within this range. Hope that helps?