Examkin

Question

Difficulty: MediumResource Locks

An administrator with the Owner role can delete an Azure Key Vault named vault-prod, which is located in a resource group that has an active CanNotDelete resource lock, without first removing the lock.

Answer: Answer

Answer

False
The statement is false because the CanNotDelete lock applied to the resource group is inherited by the Key Vault. The lock must be deleted before any administrator, including an Owner, can delete the Key Vault.

Step-by-Step Solution

1
Analyze the lock inheritance scope.
The CanNotDelete lock applied to the resource group is inherited by all resources inside it, including the Key Vault named vault-prod.
Azure resource locks flow down the resource hierarchy from subscription to resource group to individual resources.
2
Check the permissions enforced by the lock.
The CanNotDelete lock prevents any user or process from deleting the locked resources.
Locks restrict control plane delete operations.
3
Evaluate the bypass rules for administrative roles.
Even users with the Owner role cannot bypass a resource lock.
Resource locks apply to all users, regardless of their Role-Based Access Control permissions, to prevent accidental deletions.

Key Concept

Resource locks are inherited by child resources and apply to all users, including Owners, blocking deletion operations.
Rate this question

Topics

Resource Locks

More questions from this topic