Examkin

Question

Difficulty: MediumResource Locks

When a ReadOnly resource lock is applied directly to an Azure resource group, an administrator with Owner permissions on the subscription is blocked from starting any virtual machines located within that resource group.

Answer: Answer

Answer

The statement is true because ReadOnly resource locks apply to all users, including subscription Owners, and prevent starting virtual machines due to the write action required by the control plane.
The statement is correct because a ReadOnly lock prevents all updates and deletions on inherited resources for all users, including Owners. Starting a VM is a write operation at the control plane level and is therefore blocked.

Step-by-Step Solution

1
Determine lock inheritance.
The ReadOnly lock applied at the resource group level is inherited by all resources within it, including the virtual machines.
Azure resource locks are inherited by child resources from their parent scopes (Subscription -> Resource Group -> Resource).
2
Evaluate the effect of a ReadOnly lock on virtual machine operations.
Starting or restarting a virtual machine is blocked.
ReadOnly locks block control plane operations that write or modify resource states (which include starting a VM via a POST request).
3
Assess if the Owner role can bypass the lock.
The Owner is blocked from starting the virtual machine.
Resource locks apply to all users, regardless of their role-based access control (RBAC) permissions. To start the VM, the lock must first be deleted.

Key Concept

Azure resource locks (ReadOnly) prevent all users, including Owners, from modifying resource states, and are inherited by child resources.
Rate this question

Topics

Resource Locks

More questions from this topic