Examkin

Question

Difficulty: HardResource Locks

An administrator manages an Azure subscription that contains a resource group named RG-App. The resource group contains a virtual machine named VM-Web. The administrator applies a ReadOnly lock to the subscription and a CanNotDelete lock to the resource group RG-App. A user who is assigned the Owner role at the subscription level attempts to start VM-Web and then attempts to delete VM-Web. What is the result of these two actions?

  1. Both the attempt to start VM-Web and the attempt to delete VM-Web are blocked.Answer
  2. B
    The user can start VM-Web, but the attempt to delete VM-Web is blocked.
  3. C
    Both the attempt to start VM-Web and the attempt to delete VM-Web are successful because the Owner role has permissions that override resource locks.
  4. D
    The user can delete VM-Web because the resource-group-level CanNotDelete lock overrides the subscription-level ReadOnly lock.

Answer

Both the attempt to start VM-Web and the attempt to delete VM-Web are blocked.
The correct answer is correct because Azure Resource Locks are inherited from higher scopes (subscription) to lower scopes (resource group and resource), and they are additive. The subscription-level ReadOnly lock is inherited by the virtual machine and blocks both write operations (like starting the VM) and delete operations. Furthermore, locks apply to all users, including subscription Owners, meaning they cannot perform these actions without removing the locks first.

Step-by-Step Solution

1
Determine the resource lock inheritance on VM-Web.
VM-Web inherits the ReadOnly lock from the subscription and the CanNotDelete lock from the RG-App resource group.
Azure resource locks are inherited from parent scopes (Subscription -> Resource Group -> Resource).
2
Determine the effective permissions resulting from the combined locks.
The effective state is ReadOnly, which blocks both deletions and modifications/writes.
Locks are additive, meaning the most restrictive combination of all applied and inherited locks is enforced.
3
Evaluate the user's role and the requested operations against the locks.
Both starting the VM (a write/update operation) and deleting the VM are blocked, regardless of the user's Owner role.
Resource locks apply to all users and roles, and cannot be bypassed by RBAC roles like Owner without first removing the lock.

Key Concept

Azure Resource Locks block operations regardless of RBAC roles, are inherited, and are additive (most restrictive applies). A ReadOnly lock prevents starting or stopping a virtual machine.
Rate this question

Topics

Resource Locks

More questions from this topic