Examkin

Question

Difficulty: MediumAzure Subscription Management and Cost Control

Your organization has an Azure subscription that contains a resource group named rg-dev-apps. To control costs, you configure an Azure budget at the subscription scope with a monthly limit of 10,00010,000. You configure a budget alert threshold at 90%90\% that triggers an Action Group. The Action Group is configured to run an Azure Automation runbook that automatically deallocates all virtual machines in rg-dev-apps. You need to ensure that the runbook can successfully deallocate the virtual machines when the budget threshold is met, while still preventing users from accidentally deleting any virtual machines in rg-dev-apps. Which lock configuration should you apply to rg-dev-apps?

  1. Apply a CanNotDelete lock to the rg-dev-apps resource group.Answer
  2. B
    Apply a ReadOnly lock to the rg-dev-apps resource group.
  3. C
    Assign the Reader role at the subscription level to the Azure Automation system-assigned managed identity.
  4. D
    Configure the budget threshold action to use an email notification only, and configure a separate Azure Policy with the Deny effect to prevent virtual machine deletion.

Answer

Apply a CanNotDelete lock to the rg-dev-apps resource group.
Applying a CanNotDelete lock to the resource group prevents the deletion of any resource within it, including virtual machines. However, it still allows authorized users or service principals (such as the Azure Automation managed identity running the runbook) to perform write operations, which includes modifying resource state such as starting, stopping, and deallocating virtual machines.

Step-by-Step Solution

1
Analyze the action performed by the automation runbook when the budget threshold is met.
The runbook deallocates the virtual machines in rg-dev-apps to stop incurring costs.
Understanding the operation type (write/update vs. delete) is necessary to determine which resource lock is compatible.
2
Evaluate the effects of Azure resource locks on virtual machine deallocation.
A ReadOnly lock prevents deallocation because stopping a virtual machine is a state-changing write operation. A CanNotDelete lock allows state changes (write operations) but prevents resource deletion.
To ensure the runbook succeeds while protecting the VMs from deletion, a lock that permits write operations but blocks delete operations must be selected.
3
Identify the resource lock that meets both cost-control automation and resource protection requirements.
Applying a CanNotDelete lock at the rg-dev-apps resource group level prevents deletion of the VMs while allowing the deallocation runbook to run successfully.
This configuration satisfies the dual requirements of preventing accidental deletion and allowing automated deallocation.

Key Concept

The difference between ReadOnly and CanNotDelete resource locks and their impact on automated cost control actions.
Estimated Time:1m 30s
Rate this question

Topics

Azure Subscription Management and Cost Control

More questions from this topic