Examkin

Question

Difficulty: MediumResource Locks

A cloud engineering team manages resources within an Azure resource group named CoreServices-RG. This resource group contains a virtual network named VNet-Core and a storage account named Storage-Core. The team applies a CanNotDelete resource lock to CoreServices-RG, and a ReadOnly resource lock directly to Storage-Core. Which two statements accurately describe how these locks affect the resources? (Select two.)

  1. Users can modify the configuration of VNet-Core, but they cannot delete the virtual network.Answer
  2. Users cannot regenerate the access keys of Storage-Core.Answer
  3. C
    Users can modify the configuration of Storage-Core because the ReadOnly lock only blocks deletion of the storage account.
  4. D
    The ReadOnly lock on Storage-Core overrides the resource group's CanNotDelete lock, allowing users to delete the storage account.

Answer

Users can modify the configuration of the virtual network but cannot delete it, and users cannot regenerate the access keys of the storage account.
The resource group has a CanNotDelete lock, which is inherited by all resources within it, including the virtual network. A CanNotDelete lock allows authorized users to read and modify a resource, but prevents them from deleting it. Therefore, users can modify the configuration of the virtual network but cannot delete it. Additionally, a ReadOnly lock is applied directly to the storage account. A ReadOnly lock prevents all write and delete operations, which includes configuration changes and control plane actions like regenerating access keys.

Step-by-Step Solution

1
Determine the lock status and inheritance for the virtual network.
The virtual network inherits a CanNotDelete lock from the parent resource group.
Locks applied at the resource group level automatically inherit down to all resource group children.
2
Evaluate the permissions on the virtual network.
Authorized users can modify configuration settings but cannot delete the virtual network.
A CanNotDelete lock allows read and write/update operations but restricts delete actions.
3
Determine the lock status and inheritance for the storage account.
The storage account is subject to both the inherited CanNotDelete lock and a direct ReadOnly lock.
Locks are cumulative, meaning the most restrictive combination of all inherited and direct locks applies.
4
Evaluate the permissions on the storage account.
Users can view settings but cannot delete the resource or perform modify/write actions like key regeneration.
A ReadOnly lock restricts both deletes and writes (including control-plane POST operations such as key rotation).

Key Concept

Azure Resource Locks (CanNotDelete and ReadOnly) prevent accidental deletion or modification of critical Azure resources, applying cumulatively via resource group inheritance.
Rate this question

Topics

Resource Locks

More questions from this topic