The correct option is Create and assign an Azure Policy that audits and enforces a minimum TLS 1.2 requirement on storage accounts.

Create and assign an Azure Policy that audits and enforces a minimum TLS 1.2 requirement on storage accounts is the most effective method because Azure Policy can be applied at the subscription or management group level and it continuously evaluates resources for compliance. A policy can both audit existing storage accounts and be configured with remediation to enforce the minimum TLS version on non compliant accounts.

Azure Policy scales across the entire subscription and provides compliance reporting so the operations team does not need to check each storage account individually. It is the native governance tool for enforcing configuration state and it integrates with remediation and alerting to maintain the required setting.

Deploy an Azure Automation runbook that updates all storage accounts to require TLS 1.2 is not ideal because a runbook is typically a one time or scheduled script and it does not provide continuous, policy based compliance reporting. A runbook also requires ongoing maintenance and does not give the same governance visibility as a policy.

Manually change the TLS minimum setting for each storage account using the Azure portal is incorrect because manual changes do not scale and they are error prone when you manage many accounts. The question asks for a method to ensure the requirement across the subscription without checking each account individually.

Apply a Network Security Group rule to allow only TLS 1.2 traffic is incorrect because network security groups filter by IP address and port and they do not inspect or enforce TLS protocol versions. An NSG cannot guarantee that only TLS 1.2 is used to access storage services.

Full AWS Practitioner Certification Question