Examkin

Question

Difficulty: HardResource Governance: Resource Groups, Tags, and Resource Locks

An Azure subscription contains two resource groups named rg-network and rg-data.

The resource groups have the following configurations:
- rg-network: Has a CanNotDelete lock and is tagged with CostCenter value 10011001. It contains a virtual network named vnet-core.
- rg-data: Has a ReadOnly lock and is tagged with CostCenter value 10021002. It contains a storage account named sa-logs.

Neither vnet-core nor sa-logs has any directly applied locks or tags.

Which of the following statements are correct? (Select two.)

  1. The administrator can modify the configuration of vnet-core, but cannot delete it.Answer
  2. The administrator is blocked from retrieving the access keys for sa-logs.Answer
  3. C
    The administrator can retrieve the access keys for sa-logs because locks only affect resource configuration changes.
  4. D
    The sa-logs storage account automatically inherits the CostCenter tag with value 10021002 from rg-data.

Answer

The administrator can modify the configuration of vnet-core, but cannot delete it; and the administrator is blocked from retrieving the access keys for sa-logs.
The CanNotDelete lock on the resource group allows modification of the virtual network configuration while blocking its deletion. Additionally, the ReadOnly lock on the resource group blocks POST operations such as listing the storage account access keys for child resources.

Step-by-Step Solution

1
Evaluate the effect of the CanNotDelete lock on rg-network.
The CanNotDelete lock inherits to vnet-core, preventing its deletion but allowing configuration updates.
Azure Resource Locks inherit from parent scopes (resource groups) to child resources.
2
Evaluate the effect of the ReadOnly lock on rg-data.
The ReadOnly lock inherits to sa-logs, preventing modifications, deletion, and control-plane POST actions like List Keys.
ReadOnly locks restrict control-plane write, delete, and action operations.
3
Evaluate tag inheritance from rg-data to sa-logs.
The CostCenter tag is not applied to sa-logs.
Azure tags do not automatically inherit from resource groups to child resources.

Key Concept

Azure Resource Lock inheritance and Tag inheritance rules
Rate this question

Topics

Resource Governance: Resource Groups, Tags, and Resource Locks

More questions from this topic