Examkin

Question

Difficulty: Very hardResource Locks

An Azure subscription contains a resource group named RG-Prod. Inside RG-Prod, there is a logical Azure SQL Database server named SQLServer1 and an Azure SQL database named SQLDB1.

An administrator applies a ReadOnly resource lock to the subscription. Later, the administrator applies a CanNotDelete resource lock directly to the resource group RG-Prod.

Which of the following actions can a user perform on these resources?

  1. A
    Scale SQLDB1 to a higher database transaction unit (DTU) limit.
  2. B
    Add a new firewall rule to SQLServer1 to allow client traffic.
  3. Insert new records into a table within SQLDB1.Answer
  4. D
    Delete the CanNotDelete resource lock from the RG-Prod resource group.

Answer

Inserting new records into a table within SQLDB1.
Inserting new records into a table within the database is a data plane operation. Azure Resource Locks only apply to control plane (management) operations managed by Azure Resource Manager (ARM). Therefore, operations like writing data, reading tables, or executing queries inside the database are not blocked by resource locks.

Step-by-Step Solution

1
Evaluate the inheritance of resource locks across the scopes.
The subscription has a ReadOnly lock, and the resource group has a CanNotDelete lock. Resources inside the resource group (SQLServer1 and SQLDB1) inherit both locks.
Resource locks in Azure are inherited from parent scopes (Subscription -> Resource Group -> Resource).
2
Determine the effective lock restriction on the resources.
The ReadOnly lock is more restrictive than the CanNotDelete lock, so the effective lock applied to the resources inside RG-Prod is ReadOnly.
When multiple locks are inherited or applied, the most restrictive lock takes precedence.
3
Distinguish between control plane and data plane operations.
Control plane operations (managed by Azure Resource Manager, such as scaling, modifying firewalls, or deleting resources/locks) are blocked by the ReadOnly lock. Data plane operations (managed by the database engine, such as inserting or querying data) are not affected by resource locks.
Azure Resource Locks only restrict control plane operations and have no effect on data plane operations.
4
Select the only permitted action.
Inserting new records into a database table is a data plane operation and is allowed, while scaling, editing firewall configurations, or deleting locks are control plane operations and are blocked.
Only data plane operations can bypass the inherited control plane ReadOnly lock restriction.

Key Concept

Azure resource locks restrict Azure Resource Manager control plane operations but do not affect data plane operations, with inherited locks combining so that the most restrictive lock applies.
Rate this question

Topics

Resource Locks

More questions from this topic