Examkin

Question

Difficulty: HardResource Locks

An Azure administrator configures a `CanNotDelete` resource lock on an Azure subscription. Within this subscription, another administrator applies a `ReadOnly` resource lock to a resource group named `rg-finance`. Inside `rg-finance`, there is a storage account named `safinance`.

A developer who is assigned the Owner role on the subscription attempts to perform the following operations:
1. Read a blob from a container in `safinance` using a pre-existing Shared Access Signature (SAS) token.
2. Regenerate the access keys for `safinance` using the Azure portal.
3. Update the configuration of `safinance` to disable public blob access.

Which of the operations will be successful?

  1. A
    Operation 2 and Operation 3 only
  2. B
    Operation 1 and Operation 3 only
  3. Operation 1 onlyAnswer
  4. D
    None of the operations

Answer

Operation 1 only
The operation to read a blob from a container using a Shared Access Signature (SAS) token is successful because resource locks apply only to the management plane (control plane) of Azure. They do not block operations on the data plane, such as retrieving blob content. Regenerating access keys and modifying the storage account configuration are management-plane actions and are blocked by the ReadOnly lock inherited from the resource group.

Step-by-Step Solution

1
Determine the resource locks that apply to the storage account.
The storage account inherits the CanNotDelete lock from the subscription scope and the ReadOnly lock from the resource group scope.
Azure resource locks are transitive and automatically apply to all child resources within the locked parent scopes.
2
Determine the effective lock behavior on the storage account.
The effective lock behavior is ReadOnly.
When multiple resource locks are applied, the most restrictive lock (ReadOnly) takes precedence over the less restrictive lock (CanNotDelete).
3
Evaluate the control plane vs. data plane nature of each attempted operation.
Operation 1 is a data-plane read request. Operations 2 and 3 are management-plane (control plane) requests.
Azure resource locks apply strictly to the Azure Resource Manager control plane. They do not block operations that access the actual data stored within a resource.
4
Determine which operations are permitted under the effective ReadOnly lock.
Only Operation 1 is permitted. Operations 2 and 3 are blocked.
The ReadOnly lock blocks all configuration writes and modifications on the control plane (such as changing public access properties or regenerating keys), but does not affect data plane operations (such as reading a blob).

Key Concept

Azure resource locks only restrict management plane (control plane) operations, while data plane operations remain unaffected. A ReadOnly lock is the most restrictive lock and blocks both deletion and configuration changes, regardless of the user's role.
Estimated Time:2m 0s
Rate this question

Topics

Resource Locks

More questions from this topic