Examkin

Question

Difficulty: MediumResource Locks

An organization hosts a production Azure Cosmos DB account. A ReadOnly resource lock is applied to the resource group containing the database, and a CanNotDelete resource lock is applied to the parent subscription. A cloud administrator with the Contributor role attempts to increase the database throughput and delete an unused database container. What is the outcome of these attempts?

  1. Both the throughput modification and the container deletion will be blocked.Answer
  2. B
    The throughput modification will succeed, but the container deletion will be blocked.
  3. C
    The throughput modification will be blocked, but the container deletion will succeed.
  4. D
    Both the throughput modification and the container deletion will succeed.

Answer

Both the throughput modification and the container deletion will be blocked.
Both actions will be blocked. The Cosmos DB account inherits the ReadOnly lock applied to the resource group. Because a ReadOnly lock is more restrictive than a CanNotDelete lock, it prevents both configuration modifications (such as updating database throughput) and deletions (such as removing a database container). These restrictions apply to all users, including those with Contributor permissions.

Step-by-Step Solution

1
Evaluate lock inheritance and restrictiveness.
The Cosmos DB account inherits both the CanNotDelete lock from the subscription and the ReadOnly lock from the resource group.
Azure resources inherit locks applied at higher scopes (Subscription -> Resource Group -> Resource).
2
Determine the effective lock restriction on the resource.
The ReadOnly lock is the most restrictive lock and takes precedence over the CanNotDelete lock.
When multiple locks are inherited, the most restrictive lock applies to the resource.
3
Assess the impact of the ReadOnly lock on the requested operations.
Both the configuration change (throughput modification) and the deletion (container removal) are blocked.
A ReadOnly lock prevents all updates, modifications, and deletions. These restrictions apply to all users, regardless of their Azure RBAC roles (such as Contributor).

Key Concept

Resource locks prevent modification and deletion of Azure resources, applying to all users regardless of their RBAC roles, with child resources inheriting parent locks.
Rate this question

Topics

Resource Locks

More questions from this topic