Examkin

Question

Difficulty: MediumResource Locks

An Azure subscription contains a resource group named `rg-corp-networks`. A `ReadOnly` resource lock is applied at the subscription level, and a `CanNotDelete` resource lock is applied directly to `rg-corp-networks`. The resource group contains an Azure Virtual Network named `vnet-prod`.

Which two operations can an administrator successfully perform on `vnet-prod`? Select two.

  1. View the IP address settings of `vnet-prod`Answer
  2. B
    Associate a network security group (NSG) with a subnet in `vnet-prod`
  3. Read the current resource tags of `vnet-prod`Answer
  4. D
    Add a new subnet to `vnet-prod`

Answer

An administrator can view the IP address settings and read the current resource tags of the virtual network.
Resource locks in Azure are inherited from parent scopes (Subscription -> Resource Group -> Resource) and are additive. In this scenario, the subscription has a ReadOnly lock, and the resource group has a CanNotDelete lock. The virtual network inherits both. Because locks are additive, the most restrictive lock (ReadOnly) determines the allowed actions. A ReadOnly lock allows only read operations. Viewing the IP address settings and reading the resource tags are read operations, so they can be performed successfully.

Step-by-Step Solution

1
Determine the inherited locks on the virtual network.
The virtual network inherits the ReadOnly lock from the subscription level and the CanNotDelete lock from the resource group level.
Azure resource locks are inherited from parent scopes down to all child resources.
2
Determine the effective lock behavior by combining the active locks.
The effective restriction is ReadOnly (read operations only, no writes/modifications, no deletions).
Resource locks are additive. When multiple locks are applied at different scopes, the most restrictive lock takes precedence.
3
Evaluate the proposed operations against the effective ReadOnly restriction.
Viewing IP address settings and reading resource tags are allowed read operations. Adding a subnet and associating an NSG are blocked write/modify operations.
A ReadOnly lock blocks all configuration changes (write operations) and deletion, while allowing only read operations.

Key Concept

Resource locks are inherited and additive. A ReadOnly lock restricts all write and delete operations, allowing only read operations.
Estimated Time:1m 30s
Rate this question

Topics

Resource Locks

More questions from this topic