Examkin

Question

Difficulty: Very hardResource Governance: Resource Groups, Tags, and Resource Locks

Your Azure subscription contains two resource groups:

* `RG-App`, which has the tag `AppID: 9910` and a `CanNotDelete` resource lock.
* `RG-Database`, which has the tag `AppID: 9910` and a `ReadOnly` resource lock.

An Azure Policy is assigned at the subscription scope. The policy denies the deployment of any resources that do not have the `AppID` tag.

You attempt to perform the following operations:

1. Deploy a new virtual machine to `RG-App` while specifying the tag `AppID: 9910` in the deployment template.
2. Change the pricing tier (SKU) of an Azure SQL database located in `RG-Database`.
3. Delete a blob container from a storage account located in `RG-App`.
4. Deploy a new virtual network to `RG-App` without specifying any tags in the deployment template.

Which operations can be completed successfully?

  1. A
    1 only
  2. 1 and 3 onlyAnswer
  3. C
    1, 2, and 3 only
  4. D
    1, 3, and 4 only

Answer

The operations that can be completed successfully are deploying a new virtual machine to the first resource group with the required tag specified, and deleting a blob container from the storage account inside the first resource group.
The option stating '1 and 3 only' is correct. Operation 1 succeeds because a CanNotDelete lock allows the creation of new resources, and the deployment template includes the required tag to satisfy the Azure Policy. Operation 3 succeeds because the CanNotDelete lock on the resource group inherits to the storage account, preventing the storage account itself from being deleted, but it does not block data-plane or sub-resource deletions like removing a blob container.

Step-by-Step Solution

1
Evaluate the impact of locks and policies on Operation 1.
Operation 1 succeeds.
A CanNotDelete lock allows the creation of new resources. Since the deployment template explicitly includes the AppID tag, it satisfies the subscription-level Azure Policy.
2
Evaluate the impact of locks on Operation 2.
Operation 2 fails.
The SQL database inherits the ReadOnly lock from its parent resource group. A ReadOnly lock prevents all write and update operations, including changing the SKU of a database.
3
Evaluate the impact of locks on Operation 3.
Operation 3 succeeds.
The CanNotDelete lock on the parent resource group inherits to the storage account and prevents the deletion of the storage account resource itself. However, it does not restrict data-plane or sub-resource operations, so deleting a blob container is allowed.
4
Evaluate the impact of tag inheritance and policy on Operation 4.
Operation 4 fails.
Azure resources do not inherit tags from their parent resource group automatically. Without explicit tags in the deployment, the new virtual network will lack the AppID tag, causing the subscription's Deny policy to block the deployment.

Key Concept

Resource lock inheritance (ReadOnly vs. CanNotDelete) and tag inheritance behavior under Azure Policy evaluation.
Estimated Time:3m 0s
Rate this question

Topics

Resource Governance: Resource Groups, Tags, and Resource Locks

More questions from this topic