Examkin

Question

Difficulty: EasySecurity, Governance, and Manageability

A company deploys several production databases to a cloud environment. The database administrators need to ensure that these critical resources cannot be accidentally deleted by anyone, including administrators, while still permitting standard data modifications. Which of the following governance features should the company apply to the databases?

  1. A
    A custom Azure Role-Based Access Control (RBAC) role
  2. B
    A ReadOnly resource lock
  3. A CanNotDelete resource lockAnswer
  4. D
    An Azure Policy that denies resource modifications

Answer

A CanNotDelete resource lock
A CanNotDelete resource lock prevents authorized users from deleting a resource, but still allows them to read and modify it. This fits the requirement of preventing accidental deletion while permitting standard data modifications.

Step-by-Step Solution

1
Identify the goal: prevent accidental deletion of database resources by any user, including administrators.
Requires a mechanism that applies restriction even to high-privilege users.
Standard permissions (RBAC) do not protect against accidental mistakes by authorized owners or contributors.
2
Identify the constraint: must still permit standard data modifications.
Requires a lock or policy that allows write/update actions but blocks delete actions.
A ReadOnly lock would block all write operations, which violates this constraint.
3
Select the appropriate lock type.
A CanNotDelete resource lock meets both requirements.
It allows reading and modifying resources but prevents deletion.

Key Concept

Resource Locks
Rate this question

Topics

Security, Governance, and Manageability

More questions from this topic