Examkin

Question

Difficulty: MediumResource Governance: Resource Groups, Tags, and Resource Locks

An administrator manages an Azure subscription and configures resource governance. The subscription contains a resource group named `rg-billing-app`. Inside `rg-billing-app`, there are two resources: a Key Vault named `kv-billing-keys` and a Storage Account named `sa-billing-data`.

The administrator configures the following settings:
- A tag named `CostCenter: Finance` and a `ReadOnly` resource lock are applied to `rg-billing-app`.
- A tag named `Environment: Production` and a `CanNotDelete` resource lock are applied directly to `kv-billing-keys`.

Which of the following statements correctly describe the resulting governance state? (Select two.)

  1. The Storage Account `sa-billing-data` has no tags applied and is protected by an inherited `ReadOnly` resource lock.Answer
  2. Authorized users are prevented from creating new secrets in `kv-billing-keys` because the inherited `ReadOnly` lock combined with the direct `CanNotDelete` lock results in the most restrictive lock applying.Answer
  3. C
    The Key Vault `kv-billing-keys` allows the creation of new secrets because the directly applied `CanNotDelete` lock overrides the inherited `ReadOnly` lock.
  4. D
    To prevent deletion of `sa-billing-data` while allowing configuration updates, you must configure a custom RBAC role with an explicit Deny action at the resource group level.

Answer

The Storage Account has no tags applied and is protected by an inherited ReadOnly resource lock, and users are prevented from creating new secrets in the Key Vault because the inherited ReadOnly lock combined with the direct CanNotDelete lock results in the most restrictive lock applying.
The correct statements describe that the storage account inherits the ReadOnly lock but does not inherit the CostCenter tag, and that the Key Vault is subject to the ReadOnly lock because locks are cumulative and the most restrictive lock takes precedence over the less restrictive one.

Step-by-Step Solution

1
Evaluate tag inheritance for the resources.
The Storage Account has no tags applied, and the Key Vault only has the Environment: Production tag applied directly.
Tags applied to a resource group are not inherited by resources within that group.
2
Evaluate lock inheritance for the Storage Account.
The Storage Account inherits the ReadOnly lock from the resource group, preventing deletion and modification.
Resource locks applied at the resource group level automatically inherit to all resources inside the resource group.
3
Evaluate the cumulative lock behavior for the Key Vault.
The Key Vault has both a direct CanNotDelete lock and an inherited ReadOnly lock. The effective lock is ReadOnly.
When multiple locks are applied to a resource (directly or inherited), the most restrictive lock takes precedence. ReadOnly is more restrictive than CanNotDelete.

Key Concept

Resource lock inheritance is cumulative where the most restrictive lock applies, whereas tags applied to resource groups do not inherit to child resources.
Rate this question

Topics

Resource Governance: Resource Groups, Tags, and Resource Locks

More questions from this topic