Examkin

Question

Difficulty: MediumResource Governance: Resource Groups, Tags, and Resource Locks

An administrator creates an Azure resource group named `rg-hr-prod` and applies a tag named `Environment: Production` and a `ReadOnly` resource lock to the resource group. The administrator then deploys an Azure Storage account named `storeprod` to `rg-hr-prod`. The administrator attempts to view the tags applied to `storeprod` and retrieve the access keys for `storeprod`. What are the results of these actions?

  1. The storage account has no tags applied, and the retrieval of the access keys is blocked.Answer
  2. B
    The storage account has the Environment: Production tag applied, and the retrieval of the access keys is blocked.
  3. C
    The storage account has no tags applied, and the access keys are successfully retrieved.
  4. D
    The storage account has the Environment: Production tag applied, and the access keys are successfully retrieved.

Answer

The storage account has no tags applied, and the retrieval of the access keys is blocked.
The correct answer is that the storage account has no tags applied and the retrieval of the access keys is blocked. This is because tags on resource groups do not propagate to the resources inside them. Furthermore, the ReadOnly lock applies to all resources in the group by inheritance. Listing storage access keys is treated as a POST action by the Azure Resource Manager API, which is blocked by the ReadOnly lock.

Step-by-Step Solution

1
Determine the tag inheritance status of the storage account.
The storage account does not inherit the Environment: Production tag from the resource group.
In Azure, tags applied at the resource group level are not inherited by resources within that resource group. To apply tags from a resource group to its resources, you must use Azure Policy or configure them manually.
2
Determine the effect of the ReadOnly lock on the storage account.
The retrieval of the access keys for the storage account is blocked.
Resource locks are inherited by child resources. A ReadOnly lock applied to a resource group applies to the storage account. Listing or retrieving storage account access keys is a control plane operation that uses a POST request. ReadOnly locks block all write and POST operations (including listKeys), thereby preventing key retrieval.

Key Concept

Resource locks of type ReadOnly block operations that modify resources or invoke POST actions (like listing keys), and tags applied to resource groups do not automatically propagate to child resources.
Estimated Time:1m 30s
Rate this question

Topics

Resource Governance: Resource Groups, Tags, and Resource Locks

More questions from this topic