An Azure Policy is assigned to the Tenant root group. What effect does the policy enforce?

Assigning an Azure Policy to the Tenant root group means it applies to all subscriptions and resource groups within that tenant. The policy "Ensures that all traffic to new Azure Storage accounts is encrypted" is a common requirement for security and compliance. This policy would enforce that any new Azure Storage accounts created must have HTTPS required for all traffic, preventing unencrypted HTTP access. Incorrect options: "Prevents all HTTP traffic to existing Azure Storage accounts" is too broad; policies typically apply to new resource creation or modification, not retroactively block existing traffic unless specifically configured for remediation. "Prevents HTTPS traffic to new Azure Storage accounts when the accounts are accessed over the Internet" is incorrect because HTTPS is the secure protocol and is generally encouraged, not prevented. "Ensures that all data for new Azure Storage accounts is encrypted at rest" is a different security control. While important, it refers to data encryption within the storage account (e.g., using Storage Service Encryption), not the encryption of traffic to and from the account.