Examkin

Question

Difficulty: MediumResource Locks

An Azure administrator configures a ReadOnly resource lock on a resource group named rg-finance. The resource group contains an Azure Virtual Network named vnet-prod. Another administrator then applies a CanNotDelete lock directly to vnet-prod. Which of the following statements describe the resulting effects of these locks? Select two.

  1. Users are prevented from adding a new subnet to vnet-prod.Answer
  2. Users are prevented from deploying new resources into rg-finance.Answer
  3. C
    Users can add a new subnet to vnet-prod because the directly applied CanNotDelete lock allows modification operations.
  4. D
    Users can deploy new resources into rg-finance as long as those resources do not have locks applied to them.

Answer

Users are prevented from adding a new subnet to vnet-prod and users are prevented from deploying new resources into rg-finance.
The correct statements are that users are blocked from adding a subnet to the virtual network and blocked from deploying new resources to the resource group. This is because a ReadOnly lock is inherited by child resources, and when multiple locks exist, the most restrictive lock (ReadOnly) takes precedence over the less restrictive lock (CanNotDelete). A ReadOnly lock on a resource group also prevents any new resources from being created within that group.

Step-by-Step Solution

1
Determine the inheritance of the resource locks.
The resource group rg-finance has a ReadOnly lock, which is inherited by all resources within it, including the virtual network vnet-prod.
Azure resource locks are inherited from parent scopes (subscriptions, resource groups) to child resources.
2
Evaluate the precedence when multiple locks apply.
vnet-prod has both an inherited ReadOnly lock and a direct CanNotDelete lock. The ReadOnly lock is more restrictive, so it takes precedence.
When multiple locks are applied, the most restrictive lock applies.
3
Determine the impact on resource modification and creation.
Adding a subnet to vnet-prod is blocked due to the active ReadOnly restriction. Additionally, creating new resources in rg-finance is blocked because the resource group itself has a ReadOnly lock.
A ReadOnly lock prevents all write and delete operations, including modifying resources and adding new resources to the locked scope.

Key Concept

Azure resource lock inheritance and precedence rules, specifically how ReadOnly locks restrict both resource modification and the creation of new resources within a resource group.
Estimated Time:1m 30s
Rate this question

Topics

Resource Locks

More questions from this topic