Examkin

Question

Difficulty: MediumResource Governance: Resource Groups, Tags, and Resource Locks

An organization deploys a new compliance auditing environment. The deployment contains an Azure resource group named rg-audit-compliance. Inside the resource group, the operations team creates an Azure Storage account named saauditlogs and an Azure Key Vault named kvauditkeys.

To meet compliance requirements, the team performs the following actions:
1. Applies a resource tag named RegulatoryCompliance: PCI-DSS to rg-audit-compliance.
2. Applies a CanNotDelete resource lock named lock-rg-delete to rg-audit-compliance.

Which of the following statements regarding the governance and lock behaviors of these resources are correct?

  1. The saauditlogs storage account does not automatically inherit the RegulatoryCompliance: PCI-DSS tag.Answer
  2. The CanNotDelete lock applied to rg-audit-compliance prevents the deletion of saauditlogs.Answer
  3. C
    An administrator can delete saauditlogs without removing the lock because resource locks do not inherit to child resources.
  4. D
    An administrator with the Owner role at the subscription level can delete saauditlogs because RBAC privileges override resource locks.

Answer

The correct statements are that the saauditlogs storage account does not automatically inherit the RegulatoryCompliance: PCI-DSS tag, and the CanNotDelete lock applied to rg-audit-compliance prevents the deletion of saauditlogs.
The correct statements are that tags are not inherited from resource groups to resources, and resource locks are inherited from the resource group scope to child resources. This ensures tag inheritance does not happen automatically, while lock inheritance prevents deletion of the storage account.

Step-by-Step Solution

1
Evaluate tag inheritance behavior in Azure.
Tags applied at the resource group level are not inherited by resources within that resource group. Therefore, saauditlogs does not inherit the RegulatoryCompliance: PCI-DSS tag.
Azure Resource Manager does not automatically propagate tags from resource groups to child resources.
2
Evaluate resource lock inheritance behavior in Azure.
Locks applied at the resource group level are inherited by all resources within that group. A CanNotDelete lock on rg-audit-compliance applies to saauditlogs.
Azure Resource Manager propagates resource locks down the resource hierarchy (Subscription -> Resource Group -> Resource).
3
Verify if RBAC roles can bypass resource locks.
Resource locks block operations for all users and roles, including subscription Owners and User Access Administrators.
Locks enforce restriction at the resource level, requiring the lock itself to be deleted by an authorized user before the restricted operation can proceed.

Key Concept

Azure resource tags do not inherit automatically, whereas resource locks inherit down the resource hierarchy and restrict actions for all users regardless of their RBAC roles.
Estimated Time:1m 30s
Rate this question

Topics

Resource Governance: Resource Groups, Tags, and Resource Locks

More questions from this topic