Examkin

Question

Difficulty: MediumResource Governance: Resource Groups, Tags, and Resource Locks

An administrator manages an Azure subscription that contains a resource group named `rg-dev-sandbox`. The resource group contains a virtual machine named `vm-sandbox` and a storage account named `stdevsandbox`.

The administrator applies a tag named `Dept: Engineering` and a `CanNotDelete` lock to `rg-dev-sandbox`.

Which statement describes the resulting governance state of the resources in `rg-dev-sandbox`?

  1. The virtual machine and the storage account cannot be deleted, and they do not inherit the tag.Answer
  2. B
    The virtual machine and the storage account automatically inherit the tag, but they can be deleted because the lock only prevents deletion of the resource group.
  3. C
    The virtual machine and the storage account automatically inherit both the lock and the tag.
  4. D
    The virtual machine and the storage account can be deleted by a subscription Owner because resource locks do not restrict users who inherit the Owner role from the subscription.

Answer

The virtual machine and the storage account cannot be deleted, and they do not inherit the tag.
The correct answer states that the virtual machine and the storage account cannot be deleted, and they do not inherit the tag. This is correct because resource locks applied at the resource group level inherit to all child resources, blocking delete operations. However, tags on resource groups are not inherited by child resources.

Step-by-Step Solution

1
Evaluate the inheritance behavior of the resource lock.
The CanNotDelete lock applied to the resource group is inherited by all resources inside the resource group.
Azure Resource Manager propagates resource locks from parent scopes (subscriptions, resource groups) to child resources.
2
Evaluate the inheritance behavior of the tag.
The tag applied to the resource group is not inherited by the child resources.
By default, tags applied to a resource group do not automatically apply to the resources contained within it.
3
Verify if RBAC roles can bypass the lock.
Even subscription Owners are blocked from deletion by the inherited lock.
Locks are enforced at the control plane level for all users, including those with administrative permissions.

Key Concept

Resource lock inheritance and tag non-inheritance behaviors in Azure Resource Manager.
Estimated Time:1m 30s
Rate this question

Topics

Resource Governance: Resource Groups, Tags, and Resource Locks

More questions from this topic