Examkin

Question

Difficulty: EasyManagement Groups Hierarchies

A financial services company organizes its Azure resources using a Management Group hierarchy. The Root Management Group has a child Management Group named FinanceMG, which contains two Azure subscriptions: Sub-Prod and Sub-Dev. A security administrator assigns the Reader role to a user group at the FinanceMG level and assigns a Policy definition at the Root Management Group level. Additionally, a Resource Lock of type CanNotDelete is applied to a specific resource group inside Sub-Prod. Which of the following statements is true regarding how these settings are applied to the resources within the subscriptions?

  1. Both the Reader role assignment and the policy definition are inherited by all resources within Sub-Prod and Sub-Dev, while the CanNotDelete lock only applies to the specific resource group and its child resources within Sub-Prod.Answer
  2. B
    The policy definition is inherited by both subscriptions, but the Reader role assignment does not inherit down to Sub-Prod and Sub-Dev unless it is explicitly enabled for inheritance at the subscription level.
  3. C
    The Reader role assignment and the Resource Lock are inherited by all resources, but policy definitions assigned at the Root Management Group level do not inherit to child management groups like FinanceMG.
  4. D
    The Reader role assignment and the policy definition are inherited by both subscriptions, and the CanNotDelete lock applied to the resource group in Sub-Prod automatically propagates upward to protect all resources under FinanceMG.

Answer

Both the Reader role assignment and the policy definition are inherited by all resources within Sub-Prod and Sub-Dev, while the CanNotDelete lock only applies to the specific resource group and its child resources within Sub-Prod.
Both Azure RBAC role assignments and Azure Policy definitions inherit downward through the Management Group hierarchy, meaning settings applied at parent management groups affect all child subscriptions and resources. Resource locks, however, only inherit downward from their assignment scope (the resource group) to its child resources, and do not propagate upward or affect other subscriptions.

Step-by-Step Solution

1
Analyze the inheritance of the policy assigned at the Root Management Group level.
The policy is inherited by the child Management Group (FinanceMG), both subscriptions (Sub-Prod and Sub-Dev), and all resource groups and resources beneath them.
Azure policies applied at a higher scope in the hierarchy automatically inherit to all child scopes.
2
Analyze the inheritance of the Reader role assigned at the FinanceMG level.
The Reader role assignment is inherited by both Sub-Prod and Sub-Dev, as well as all resource groups and resources within them.
Azure RBAC role assignments inherit downward through the management group hierarchy to all child subscriptions and resources.
3
Analyze the scope of the Resource Lock applied at the resource group level inside Sub-Prod.
The CanNotDelete lock applies only to that specific resource group and the resources inside it.
Resource locks only inherit downward to child resources within the targeted scope and do not propagate upward or laterally in the hierarchy.

Key Concept

Inheritance behavior of Azure Policies, RBAC role assignments, and Resource Locks in a Management Group hierarchy
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic