Examkin

Question

Difficulty: Very hardResource Locks

An enterprise Azure subscription has a `ReadOnly` lock applied at the subscription level. Within this subscription, a resource group named `RG-CoreServices` contains an Azure Cosmos DB account named `cosmos-orders` and an Azure Storage account named `stbackups`. A `CanNotDelete` lock is applied directly to `RG-CoreServices`.

An administrator with the Owner role at the subscription level needs to perform maintenance. Which two of the following actions can the administrator successfully complete without modifying or removing any resource locks? (Select two.)

  1. Upload a database backup file to an existing blob container in `stbackups` using a pre-existing Shared Access Signature (SAS).Answer
  2. B
    Create a new resource group named `RG-Shared` within the subscription.
  3. C
    Retrieve the primary access keys for `cosmos-orders` using the Azure Portal or Azure CLI.
  4. Delete an existing log file stored as a blob in a container within `stbackups` using direct data plane access.Answer
  5. E
    Add an IP firewall rule to the `cosmos-orders` account to allow traffic from an on-premises network.

Answer

The administrator can upload a database backup file to an existing blob container using a pre-existing Shared Access Signature (SAS), and delete an existing log file stored as a blob using direct data plane access.
The correct options are uploading a backup file and deleting a log file. Both operations are data plane tasks interacting directly with the storage container contents rather than modifying the Azure Resource Manager (ARM) configuration of the resource. Resource locks only restrict control plane operations.

Step-by-Step Solution

1
Determine the scope and inheritance of the applied locks.
The ReadOnly lock applied at the subscription level inherits down to all resource groups and resources in the subscription, making them effectively read-only. The CanNotDelete lock on the resource group prevents deletion of the resource group and its resources.
Resource locks are inherited by all child resources.
2
Distinguish between control plane and data plane operations.
Resource locks apply strictly to the Azure Resource Manager control plane (operations managing resources). They do not restrict data plane operations (reading, writing, or deleting data within the resources).
This determines which operations bypass resource locks.
3
Evaluate each action against the lock restrictions.
Creating a resource group, modifying firewall rules, and listing access keys are all control plane operations blocked by the ReadOnly lock. Uploading a blob and deleting a blob are data plane operations and are permitted.
To identify which actions will succeed without removing the locks.

Key Concept

Azure Resource Locks restrict control plane operations (such as configuration changes and resource deletion) but do not block data plane operations (such as manipulating data inside a storage account or database). ReadOnly locks also block operations that retrieve keys (like listKeys) because keys grant write access.
Rate this question

Topics

Resource Locks

More questions from this topic