Examkin

Question

Difficulty: Very hardAzure Subscription Management and Cost Control

Your company has an Azure environment with a management group hierarchy. The environment includes an Azure subscription named Sub-Prod that contains a resource group named RG-Core.

A resource lock of type ReadOnly is applied to the Sub-Prod subscription.

A budget named Budget-Prod is configured at the Sub-Prod subscription scope. The budget has an alert threshold set to 90% of the budgeted amount, which is configured to trigger an Azure Monitor action group that executes an Azure Automation Runbook. The runbook is designed to automatically deallocate all virtual machines in RG-Core to minimize costs.

A user named User1 is assigned the Contributor role at the Sub-Prod subscription scope and the User Access Administrator role at the RG-Core resource group scope.

The actual cost of Sub-Prod reaches 95% of the budgeted amount.

When the budget alert triggers, what is the status of the virtual machines in RG-Core, and what action can User1 take regarding the resource lock to resolve any issues?

  1. A
    The virtual machines are successfully deallocated because the ReadOnly lock only prevents resource deletion. User1 can delete the lock at the subscription scope using their Contributor permissions.
  2. B
    The budget alert fails to trigger because Azure Budgets at the subscription scope cannot execute runbooks via action groups. User1 must delete the lock at the resource group level to manually stop the virtual machines.
  3. The virtual machines remain running because the ReadOnly lock prevents deallocation. User1 cannot delete the lock because their User Access Administrator role is scoped to the resource group, not the subscription.Answer
  4. D
    The virtual machines remain running because the ReadOnly lock prevents deallocation. User1 can delete the lock because the User Access Administrator role at the resource group scope inherits upward to allow management of subscription-level locks.

Answer

The virtual machines remain running because the ReadOnly lock prevents deallocation, and User1 cannot delete the lock because their User Access Administrator role is scoped to the resource group, not the subscription.
The correct answer is correct because a ReadOnly lock prevents write operations, which includes stopping or deallocating a virtual machine. Since the lock is applied at the subscription scope, it is inherited by all resources within it, including the virtual machines in the resource group. Furthermore, to delete a lock, a user must have lock deletion permissions at the scope where the lock is applied or higher. The User Access Administrator role grants lock management permissions, but because User1's assignment of this role is scoped only to the resource group, they cannot manage locks at the subscription level. The Contributor role at the subscription level does not include permissions to delete locks.

Step-by-Step Solution

1
Determine the impact of the ReadOnly lock on the virtual machines.
The virtual machines cannot be deallocated (stopped).
A ReadOnly lock prevents all write operations, which includes VM state changes like starting, stopping, or deallocating.
2
Identify the scope at which the ReadOnly lock is applied.
The lock is applied at the Sub-Prod subscription scope and inherited by RG-Core.
Because the lock is applied to the subscription, it is inherited downward by all nested resource groups and resources.
3
Evaluate if User1 can delete the subscription-scope lock.
User1 is blocked from deleting the lock.
To delete a lock, a user needs Microsoft.Authorization/locks/delete permissions at or above the lock's scope. User1's Contributor role lacks authorization permissions, and their User Access Administrator role is scoped only to RG-Core, which does not inherit upward.

Key Concept

Interaction of Azure Resource Locks (ReadOnly), Azure Budgets with Action Groups, and Azure RBAC scope boundaries.
Estimated Time:3m 0s
Rate this question

Topics

Azure Subscription Management and Cost Control

More questions from this topic