Examkin

Question

Difficulty: MediumResource Locks

A company hosts a web application on an Azure App Service named app-invoices, which is deployed inside a resource group named rg-finance-prod. To protect the resources, an administrator applies a CanNotDelete lock directly to app-invoices. Additionally, a ReadOnly lock is applied to the resource group rg-finance-prod. A developer with Owner permissions attempts to update the configuration settings of app-invoices. What is the outcome of this update attempt?

  1. A
    The update succeeds because the developer holds Owner permissions, which bypass resource locks.
  2. B
    The update succeeds because the lock applied directly to the App Service is CanNotDelete, which allows configuration changes.
  3. The update is blocked because the App Service inherits the ReadOnly lock from the resource group.Answer
  4. D
    The update is blocked because a CanNotDelete lock prevents both resource deletion and configuration modifications.

Answer

The update is blocked because the App Service inherits the ReadOnly lock from the resource group.
The correct answer is correct because resource locks are inherited from parent scopes (the resource group) to child resources (the App Service). Since a ReadOnly lock is more restrictive than a CanNotDelete lock, it takes precedence. Under a ReadOnly lock, all configuration modification and deletion attempts are blocked, regardless of the user's high-privilege RBAC roles.

Step-by-Step Solution

1
Identify the locks and scopes.
A CanNotDelete lock is applied directly to the App Service. A ReadOnly lock is applied to the parent resource group.
Understanding the lock configuration across the resource hierarchy is necessary to determine the net effect.
2
Apply lock inheritance rules.
The App Service inherits the ReadOnly lock from its parent resource group.
In Azure, resource locks applied at a parent scope are automatically inherited by all child resources.
3
Evaluate the cumulative effect of the locks.
The ReadOnly lock takes precedence over the CanNotDelete lock because it is more restrictive.
When multiple locks are applied, the most restrictive lock applies. ReadOnly blocks both deletion and modification, whereas CanNotDelete only blocks deletion.
4
Assess user permissions.
The update is blocked despite the developer having Owner permissions.
Azure resource locks apply to all users and roles, meaning even Owner permissions cannot bypass a lock without first removing it.

Key Concept

Azure Resource Lock inheritance and behavior
Rate this question

Topics

Resource Locks

More questions from this topic