Examkin

Question

Difficulty: MediumResource Governance: Resource Groups, Tags, and Resource Locks

An administrator deploys a new shipping application. The deployment includes a resource group named rg-shipping-prod that contains an Azure App Service web app and an Azure SQL database. The administrator applies a tag named CostCenter: Shipping and a CanNotDelete resource lock directly to rg-shipping-prod. Which of the following describes the resource governance status of the Azure SQL database?

  1. A
    The database inherits both the CanNotDelete resource lock and the CostCenter: Shipping tag.
  2. B
    The database inherits the CostCenter: Shipping tag, but the CanNotDelete resource lock only applies to the resource group level and does not block the deletion of the database.
  3. The database inherits the CanNotDelete resource lock, preventing its deletion, but does not inherit the CostCenter: Shipping tag.Answer
  4. D
    The database inherits the CanNotDelete resource lock, which prevents authorized users from modifying the configuration of the database or reading its connection strings.

Answer

The database inherits the CanNotDelete resource lock, preventing its deletion, but does not inherit the CostCenter: Shipping tag.
The correct option is that the database inherits the CanNotDelete resource lock, preventing its deletion, but does not inherit the CostCenter: Shipping tag. This is because Resource Manager locks are inherited by all resources within the resource group scope, while resource group tags are not automatically inherited by child resources.

Step-by-Step Solution

1
Evaluate the inheritance behavior of Azure Resource Locks.
Resource locks applied at the resource group scope are inherited by all child resources. Therefore, the Azure SQL database inherits the CanNotDelete lock, which prevents it from being deleted.
Azure Resource Manager (ARM) propagates locks downward from subscriptions and resource groups to child resources.
2
Evaluate the inheritance behavior of Azure Tags.
Tags applied to a resource group are not inherited by the resources contained within it. The database does not inherit the CostCenter: Shipping tag.
Azure does not support automatic tag inheritance from resource groups to individual resources; tag policy or manual assignment must be used instead.
3
Determine the impact of the CanNotDelete lock type.
The CanNotDelete lock allows authorized users to read and modify the resource, but blocks deletion.
Unlike a ReadOnly lock, a CanNotDelete lock allows control plane modifications like configuration updates.

Key Concept

Azure resource locks are inherited by child resources, whereas Azure tags applied to a resource group are not automatically inherited by its resources.
Estimated Time:1m 30s
Rate this question

Topics

Resource Governance: Resource Groups, Tags, and Resource Locks

More questions from this topic