Examkin

All practice questions

1186 questions

All types1,186Multiple choice620Multiple select228True / False291Matching47
Question 61Question →

A company is planning a hybrid network architecture to connect their on-premises datacenter to Azure services. Due to strict compliance requirements, all data transferred must be encrypted in transit. The network administrator proposes using a standard Azure ExpressRoute circuit to meet both the high-bandwidth demand and the encryption requirement. True or false: The proposed solution meets the encryption requirement by default.

Show answer & explanation

Answer: False

Answer

False
The proposed solution does not meet the encryption requirement by default. Although Azure ExpressRoute provides a private, high-speed, and low-latency connection that bypasses the public internet, it does not encrypt data in transit by default. To achieve encryption over ExpressRoute, additional configurations like a site-to-site VPN over the circuit or MACsec (for ExpressRoute Direct) must be implemented.

Step-by-Step Solution

1
Analyze the requirements in the scenario.
The requirements are high-bandwidth connectivity and guaranteed encryption in transit for data moving between on-premises and Azure.
Understanding the customer's constraints is the first step in determining the correctness of the proposal.
2
Evaluate the capabilities of a standard Azure ExpressRoute circuit.
ExpressRoute provides high bandwidth, low latency, and a private connection that bypasses the public internet, but it does not encrypt traffic by default.
We must verify if the proposed technology natively satisfies the encryption requirement without additional setup.
3
Determine if the proposed solution meets the encryption requirement by default.
Since standard ExpressRoute does not encrypt traffic in transit by default, the proposed solution does not meet the compliance requirement on its own.
This leads to the final determination that the statement is false.

Key Concept

Azure ExpressRoute provides private, high-bandwidth connectivity to Azure but does not encrypt traffic by default.
Question 62Question →

When deploying containers using Azure Container Instances, you must manually configure and patch the virtual machines that host the workloads.

Show answer & explanation

Answer: False

Answer

False
The statement is false because Azure Container Instances is a serverless container hosting platform. Under the Platform as a Service (PaaS) model, the cloud provider manages and patches the host operating system and virtual machines, allowing users to run containers directly without infrastructure management.

Step-by-Step Solution

1
Analyze the service model of Azure Container Instances.
Azure Container Instances functions as a serverless container hosting service.
Determining the service model helps identify who is responsible for managing the underlying host infrastructure under the shared responsibility model.
2
Evaluate the infrastructure management responsibilities for the service.
Azure handles all host operating system patching, hardware provisioning, and virtualization layers automatically.
This eliminates the requirement for the customer to manually configure or patch the underlying virtual machines.

Key Concept

Azure Container Instances provides serverless container execution, removing the administrative overhead of managing, configuring, or patching host virtual machines.
Question 63Question →

A team is establishing a connection between their physical office and an Azure Virtual Network. They require a connection that does not traverse the public internet. Is the following statement true? A VPN Gateway connection is the correct choice to meet this requirement.

Show answer & explanation

Answer: False

Answer

False
The correct answer is False because a VPN Gateway establishes an encrypted tunnel over the public internet. The requirement specifically demands a connection that does not traverse the public internet, which can only be satisfied by using ExpressRoute.

Step-by-Step Solution

1
Analyze the connectivity requirements specified in the scenario.
The scenario requires a connection between a physical office and Azure that does not travel over the public internet.
This helps identify which network services are eligible.
2
Evaluate how VPN Gateway routes network traffic.
A VPN Gateway creates an encrypted tunnel, but this tunnel runs over the public internet.
To determine if the statement is true or false.
3
Compare with ExpressRoute capabilities.
ExpressRoute provides a private, dedicated connection that bypasses the public internet entirely.
To confirm that ExpressRoute, not VPN Gateway, is the correct service.

Key Concept

Azure VPN Gateway routes traffic over the public internet, whereas ExpressRoute bypasses it.
Question 64Question →

Determine if the following statement is true or false: An Azure ExpressRoute connection routes network traffic between an on-premises network and Azure resources over the public internet using built-in IPsec encryption.

Show answer & explanation

Answer: False

Answer

False
The statement is false. Azure ExpressRoute provides a private connection to Microsoft services via dedicated circuits. Therefore, traffic does not traverse the public internet, and it is not encrypted by default.

Step-by-Step Solution

1
Analyze the transmission medium described in the statement.
ExpressRoute utilizes private, dedicated WAN links provided by a partner connectivity provider.
This establishes that ExpressRoute traffic does not travel over the public internet.
2
Analyze the default encryption state of ExpressRoute.
ExpressRoute does not encrypt traffic by default.
While customers can configure encryption over ExpressRoute, it is not built-in or enabled by default.

Key Concept

ExpressRoute provides a private, dedicated, and unencrypted-by-default connection that bypasses the public internet.
Question 65Question →

An Azure administrator configures resource locks in a Microsoft Azure subscription. The administrator applies a ReadOnly lock to a resource group named RG-Production. Within RG-Production, there is an Azure Virtual Machine named VM-App1. The administrator then applies a CanNotDelete lock directly to VM-App1.

Which of the following statements describe the combined effects of these locks on VM-App1? Select two.

Select all that apply

Show answer & explanation

Answer: Authorized users are prevented from deleting VM-App1.; Authorized users are prevented from starting or stopping VM-App1.

Answer

Authorized users are prevented from deleting the virtual machine, and they are also prevented from starting or stopping the virtual machine.
Resource locks are inherited from parent scopes to child resources. When multiple locks are applied, they are additive, meaning the most restrictive lock settings apply. The ReadOnly lock from the resource group prevents any modifications or control operations (such as starting or stopping the virtual machine), while both locks prevent the deletion of the resource.

Step-by-Step Solution

1
Analyze lock inheritance rules in Azure.
Resource locks applied at the resource group level are inherited by all resources within that resource group. Therefore, the ReadOnly lock applies to VM-App1.
To determine which locks are active on VM-App1.
2
Determine the combined effect of multiple locks.
Locks are additive. Since VM-App1 has both a ReadOnly lock (inherited) and a CanNotDelete lock (directly applied), the most restrictive lock rules apply. ReadOnly is more restrictive than CanNotDelete.
To evaluate how the two lock types interact.
3
Evaluate the capabilities allowed by the active locks.
The ReadOnly lock prevents deletion and any modifications, including operations like starting and stopping the virtual machine. The CanNotDelete lock also prevents deletion.
To identify the correct statements regarding the effects on the virtual machine.

Key Concept

Resource locks are inherited, additive, and the ReadOnly lock prevents both deletion and configuration updates (including stopping or starting virtual machines).
Question 66Question →

An organization needs to prevent the accidental deletion of a production database account in Azure. However, administrators must still be able to modify the database configuration settings and scale its throughput as needed. Which resource lock should be applied to meet these requirements?

Show answer & explanation

Answer: A CanNotDelete lock

Answer

A CanNotDelete lock
A CanNotDelete lock blocks the deletion of a resource, but allows users to read and modify its configuration. This satisfies the requirement to protect the database from deletion while allowing administrators to modify settings and scale throughput.

Step-by-Step Solution

1
Analyze the requirements to determine the allowed and blocked actions.
Deletion must be blocked, but modifications and updates (such as scaling throughput) must be permitted.
This helps determine the specific lock behavior needed.
2
Evaluate the difference between Azure resource lock types.
A ReadOnly lock blocks both modifications and deletion, whereas a CanNotDelete lock only blocks deletion and allows modifications.
This ensures the selected lock type does not disrupt normal administrative tasks.
3
Select the lock type that permits updates but denies deletion.
A CanNotDelete lock satisfies all constraints of the scenario.
It successfully prevents accidental deletion while leaving configuration and scaling controls active.

Key Concept

Azure Resource Locks prevent accidental deletion or modification of resources. A CanNotDelete lock allows read and update operations but blocks deletion, whereas a ReadOnly lock blocks both modifications and deletion.
Estimated Time:45s
Question 67Question →

A company hosts a web application on an Azure App Service named app-invoices, which is deployed inside a resource group named rg-finance-prod. To protect the resources, an administrator applies a CanNotDelete lock directly to app-invoices. Additionally, a ReadOnly lock is applied to the resource group rg-finance-prod. A developer with Owner permissions attempts to update the configuration settings of app-invoices. What is the outcome of this update attempt?

Show answer & explanation

Answer: The update is blocked because the App Service inherits the ReadOnly lock from the resource group.

Answer

The update is blocked because the App Service inherits the ReadOnly lock from the resource group.
The correct answer is correct because resource locks are inherited from parent scopes (the resource group) to child resources (the App Service). Since a ReadOnly lock is more restrictive than a CanNotDelete lock, it takes precedence. Under a ReadOnly lock, all configuration modification and deletion attempts are blocked, regardless of the user's high-privilege RBAC roles.

Step-by-Step Solution

1
Identify the locks and scopes.
A CanNotDelete lock is applied directly to the App Service. A ReadOnly lock is applied to the parent resource group.
Understanding the lock configuration across the resource hierarchy is necessary to determine the net effect.
2
Apply lock inheritance rules.
The App Service inherits the ReadOnly lock from its parent resource group.
In Azure, resource locks applied at a parent scope are automatically inherited by all child resources.
3
Evaluate the cumulative effect of the locks.
The ReadOnly lock takes precedence over the CanNotDelete lock because it is more restrictive.
When multiple locks are applied, the most restrictive lock applies. ReadOnly blocks both deletion and modification, whereas CanNotDelete only blocks deletion.
4
Assess user permissions.
The update is blocked despite the developer having Owner permissions.
Azure resource locks apply to all users and roles, meaning even Owner permissions cannot bypass a lock without first removing it.

Key Concept

Azure Resource Lock inheritance and behavior
Question 68Question →

A business needs to establish a dedicated connection between its local office and an Azure virtual network. The business requires high reliability and fast speeds, so they deploy Azure ExpressRoute. Which of the following describes how network traffic is routed through this connection?

Show answer & explanation

Answer: Traffic travels over a private connection without using the public internet.

Answer

Traffic travels over a private connection without using the public internet.
The correct option is correct because Azure ExpressRoute establishes a private connection to Microsoft's cloud infrastructure that does not traverse the public internet, ensuring high speeds and low latency.

Step-by-Step Solution

1
Identify the primary network routing mechanism of Azure ExpressRoute.
Determine that Azure ExpressRoute utilizes a private, dedicated physical connection provided by a connectivity partner.
This is the defining architectural feature of ExpressRoute that differentiates it from VPN connectivity.
2
Examine how this mechanism interacts with the public internet.
Confirm that all traffic routing via ExpressRoute bypasses the public internet entirely.
Bypassing the public internet ensures lower latency, higher security, and predictable performance.

Key Concept

Azure ExpressRoute private routing
Estimated Time:45s
Question 69Question →

An organization is setting up an Azure environment and needs to delegate resource management for a development team. A deployment specialist must be able to create, modify, and delete virtual machines within a specific resource group named ProjectX-RG. However, the specialist must not be allowed to delegate access permissions to other users or manage resource locks on ProjectX-RG. Which of the following options should you configure to meet these requirements?

Show answer & explanation

Answer: Assign the Contributor role to the specialist at the resource group scope

Answer

Assign the Contributor role to the specialist at the resource group scope
Assigning the Contributor role at the resource group scope allows the specialist to create and manage virtual machines within the specified resource group. The Contributor role does not grant permissions to manage access controls (which requires Owner or User Access Administrator) or change resource locks, satisfying all constraints.

Step-by-Step Solution

1
Analyze the access control requirements for the specialist, which are managing virtual machines (create, modify, delete) without the ability to delegate access or manage locks.
Identified that the role must allow resource modification but restrict authorization/management tasks.
This establishes the scope of permissions needed.
2
Evaluate Azure Role-Based Access Control (RBAC) built-in roles.
The Contributor role grants full access to manage resources but does not allow assigning roles in Azure RBAC, which perfectly matches the requirements.
This distinguishes between Contributor and Owner roles.
3
Verify that Azure Policy and Resource Locks cannot be used to grant user permissions in this scenario.
Azure Policy regulates resource properties, and a ReadOnly lock would block all modifications.
This rules out non-RBAC options that would block the required actions.

Key Concept

Azure Role-Based Access Control (RBAC) manages access by assigning roles (like Owner and Contributor) at specific scopes, while Azure Policy enforces compliance and Resource Locks prevent accidental changes.
Question 70Question →

An organization needs to deploy a containerized application that requires secure access to on-premises resources over a private connection. Is the statement true or false that Azure Container Instances (ACI) supports deployment directly into a delegated subnet of an Azure Virtual Network (VNet) to enable this secure connection?

Show answer & explanation

Answer: True

Answer

The statement is true because Azure Container Instances supports virtual network integration via delegated subnets.
The statement is correct because Azure Container Instances supports virtual network integration using subnet delegation, allowing private communication with on-premises resources.

Step-by-Step Solution

1
Identify the networking requirements of the scenario.
The scenario requires a containerized application to securely access on-premises resources over a private connection (typically via an Azure Virtual Network and a VPN or ExpressRoute connection).
Understanding the networking requirements helps determine if the selected service supports virtual network integration.
2
Evaluate the capabilities of Azure Container Instances regarding virtual network deployment.
Azure Container Instances supports deploying container groups into a delegated subnet of an Azure Virtual Network.
Delegated subnet integration enables containers in the container group to communicate privately with on-premises networks and other virtual network resources.

Key Concept

Azure Container Instances Virtual Network Integration
Question 71Question →

Azure Role-Based Access Control (RBAC) is used to enforce resource compliance rules, such as restricting the deployment of virtual machines to specific allowed sizes.

Show answer & explanation

Answer: False

Answer

The statement is false because Azure RBAC manages user access permissions, whereas restricting resource configurations like virtual machine sizes is managed by Azure Policy.
The statement is false. Azure RBAC is used to manage user authorization and control access to Azure resources (who can access what). Enforcing resource compliance rules, such as restricting virtual machine sizes or allowed locations, is managed by Azure Policy.

Step-by-Step Solution

1
Analyze the action described in the statement: restricting virtual machine deployments to specific sizes.
This is a configuration compliance rule.
To determine which Azure service handles this constraint.
2
Recall the purpose of Azure RBAC.
Azure RBAC authorizes user actions (e.g., who can create a virtual machine). It does not inspect or restrict the properties of the resource being created (e.g., size or region).
To verify if RBAC can enforce the specified rule.
3
Recall the purpose of Azure Policy.
Azure Policy evaluates and enforces compliance rules on resource properties, such as allowed SKU sizes or deployment regions.
To identify the correct tool for the described scenario.

Key Concept

Difference between Azure Role-Based Access Control (RBAC) and Azure Policy
Estimated Time:45s
Question 72Question →

A company is planning to deploy a complex microservices application to Azure. The application architecture requires advanced orchestration capabilities, including automated horizontal pod autoscaling, rolling updates, and built-in service discovery across dozens of container groups. A cloud consultant suggests that using Azure Container Instances (ACI) is the best solution because it natively provides all of these advanced container orchestration and cluster management capabilities without requiring any additional services. Is this statement regarding the native capabilities of Azure Container Instances (ACI) true or false?

Show answer & explanation

Answer: False

Answer

The statement is false.
The correct answer is false. Azure Container Instances (ACI) is designed for quick, isolated container hosting and does not support native orchestration features such as horizontal pod autoscaling, automated rolling updates, or service discovery across multiple groups. A service like Azure Kubernetes Service (AKS) is required to fulfill those requirements.

Step-by-Step Solution

1
Analyze the application requirements.
The application requires advanced orchestration capabilities: automated horizontal pod autoscaling, rolling updates, and built-in service discovery.
These requirements indicate a need for a container orchestrator rather than just a container hosting environment.
2
Evaluate the capabilities of Azure Container Instances (ACI).
ACI is a Platform-as-a-Service (PaaS) offering that allows you to run containers on-demand without managing virtual machines. It lacks native orchestration features like rolling updates, built-in service discovery, or automatic horizontal pod scaling.
This determines whether ACI satisfies the architectural constraints natively.
3
Compare ACI with Azure Kubernetes Service (AKS).
AKS is a fully managed Kubernetes service that provides cluster management, rolling upgrades, horizontal pod autoscaling, and service discovery natively.
Understanding the division of features between ACI and AKS helps verify which service fits the scenario.

Key Concept

Distinction between Azure Container Instances (ACI) basic hosting and Azure Kubernetes Service (AKS) container orchestration capabilities.
Question 73Question →

A retail company is migrating its inventory management system to Azure. The database must track relationships between products, suppliers, and orders, enforcing referential integrity through foreign keys and supporting complex multi-table joins. The systems architect proposes deploying Azure Cosmos DB to host this relational workload. Is the systems architect's proposal correct?

Show answer & explanation

Answer: False

Answer

The correct answer is False.
The correct answer is False because the requirements describe a relational database workload (foreign keys, referential integrity, and complex joins), whereas Azure Cosmos DB is a non-relational (NoSQL) database service.

Step-by-Step Solution

1
Analyze the workload requirements: tracking relationships (products, suppliers, orders), referential integrity (foreign keys), and complex joins.
Identify that the system requires a relational database management system.
Foreign keys and complex joins are standard features of relational databases.
2
Evaluate the proposed Azure service: Azure Cosmos DB.
Identify that Azure Cosmos DB is a non-relational (NoSQL) database service.
Cosmos DB is built for non-relational, schema-free data models.
3
Assess the fit of Azure Cosmos DB for the relational workload.
Conclude that Cosmos DB is not suitable for a workload that relies on native relational constraints and multi-table joins, making the proposal incorrect.
Azure Cosmos DB is not a relational database, so the proposal is False.

Key Concept

Azure Cosmos DB is a non-relational (NoSQL) database service, which is not designed to natively handle relational workloads requiring strict referential integrity (foreign keys) and complex multi-table joins.
Question 74Question →

When utilizing Azure Cosmos DB with the API for NoSQL, developers can query JSON documents using structured query language (SQL) syntax, and the database service automatically enforces relational integrity constraints, such as foreign keys, across multiple containers.

Show answer & explanation

Answer: False

Answer

False
The correct answer is False because Azure Cosmos DB is a non-relational database. The API for NoSQL allows querying JSON data using structured query language (SQL) syntax, but it does not support or enforce relational database constraints like foreign keys across different containers.

Step-by-Step Solution

1
Analyze the database service and query API specified in the statement: Azure Cosmos DB using the API for NoSQL.
Identify that Azure Cosmos DB is a non-relational (NoSQL) database engine, and the API for NoSQL acts as a document query interface using SQL-like syntax.
Understanding the underlying architecture of the service is required to evaluate its capabilities.
2
Evaluate the statement's claim that the database service automatically enforces relational integrity constraints (like foreign keys) across containers.
Recognize that NoSQL document databases do not enforce relational schema constraints or foreign keys across collections/containers.
This tests whether the query syntax capabilities are being conflated with schema constraint enforcement.
3
Determine the correct truth value of the statement.
Since the service does not enforce relational constraints across containers, the statement is false.
To complete the evaluation and state the final answer.

Key Concept

Azure Cosmos DB is a non-relational database service that supports SQL querying but does not enforce relational database schema constraints like foreign keys.
Question 75Question →

An organization has configured an Azure ExpressRoute circuit as their primary hybrid connection and a Site-to-Site VPN as a backup to the same Azure Virtual Network. Is the statement true or false that Azure automatically routes traffic to the Site-to-Site VPN gateway if the ExpressRoute circuit fails, without requiring any custom User-Defined Routes (UDRs) to be configured?

Show answer & explanation

Answer: True

Answer

True
The statement is true because Azure natively supports coexistence of ExpressRoute and VPN gateways. BGP advertisements manage the routing hierarchy, automatically directing traffic to the VPN connection if the primary ExpressRoute path is lost, without any need for User-Defined Routes (UDRs).

Step-by-Step Solution

1
Understand the coexistence setup of Azure ExpressRoute and Site-to-Site VPN on the same Virtual Network.
Both connections advertise on-premises network ranges to Azure, but ExpressRoute has a higher default routing weight/preference.
This establishes ExpressRoute as the primary path and VPN as the backup path.
2
Analyze what happens during an ExpressRoute link failure.
The ExpressRoute routes are withdrawn from the Azure routing table.
BGP dynamically updates the route table when the physical path becomes unavailable.
3
Evaluate the routing decision made by Azure after ExpressRoute route withdrawal.
Azure falls back to the Site-to-Site VPN route that is already propagated via BGP.
No manual route injection or User-Defined Routes (UDRs) are needed because BGP handles the path failover dynamically.

Key Concept

ExpressRoute and Site-to-Site VPN Gateway coexistence and automatic failover
Question 76Question →

An organization is planning to deploy Azure ExpressRoute to connect its local corporate office to an Azure virtual network. Which of the following is a key characteristic of this connection?

Show answer & explanation

Answer: It routes traffic over a dedicated, private connection that does not traverse the public internet.

Answer

It routes traffic over a dedicated, private connection that does not traverse the public internet.
The correct option correctly states that Azure ExpressRoute routes traffic over a dedicated, private connection that does not traverse the public internet, providing lower latency and higher reliability than typical internet-based connections.

Step-by-Step Solution

1
Analyze the requirements for Azure ExpressRoute.
Identify that ExpressRoute is designed for high-speed, reliable, private hybrid cloud connectivity.
This establishes the core function of the service.
2
Distinguish ExpressRoute from VPN connections and cloud model definitions.
Confirm that ExpressRoute bypasses the public internet entirely using a dedicated line, which distinguishes it from VPNs (which use the public internet) and supports a hybrid cloud model.
This isolates the correct choice from common misconceptions.

Key Concept

Azure ExpressRoute characteristics and comparison with VPN options
Question 77Question →

A company is evaluating database options in Azure. They require a fully managed database service that supports semi-structured NoSQL data and provides global scale. Which statement accurately describes the characteristics of the recommended database service?

Show answer & explanation

Answer: The recommended service is a NoSQL database where Microsoft automatically manages the database engine and operating system patching.

Answer

The recommended service is a NoSQL database where Microsoft automatically manages the database engine and operating system patching.
The correct option states that the recommended service is a NoSQL database where Microsoft manages the database engine and operating system patching. Azure's NoSQL service is a PaaS offering, meaning the cloud provider handles maintenance, patching, and hardware management.

Step-by-Step Solution

1
Analyze the application requirements.
The requirements specify 'semi-structured NoSQL data' and 'global scale', which points to Azure's non-relational database services.
This helps rule out relational database services.
2
Determine the management model and responsibility for patching.
Fully managed Azure database services operate under the Platform as a Service (PaaS) model, where Microsoft manages the underlying OS, hardware, and database engine maintenance.
This identifies the correct division of management responsibility.

Key Concept

Distinguishing relational from non-relational Azure databases and understanding the PaaS shared responsibility model.
Estimated Time:45s
Question 78Question →

A logistics firm is deploying a customer-facing portal packaged as a containerized application. The deployment must satisfy the following operational requirements:

- Automatically scale the container count in response to web traffic fluctuations.
- Require zero management of container orchestrators, ingress controllers, or pods.
- Delegate all host operating system patching and infrastructure maintenance to Microsoft.

Which Azure service should the firm select to host the portal?

Show answer & explanation

Answer: Azure App Service

Answer

Azure App Service
Azure App Service is correct because it allows hosting containerized web applications (Web App for Containers) while providing a fully managed Platform as a Service (PaaS) environment. Microsoft handles host OS patching, and the service supports native, automated scaling configurations based on HTTP traffic (request count) and cpu usage, requiring no Kubernetes or orchestrator configuration.

Step-by-Step Solution

1
Analyze the hosting requirements for the portal.
The application is containerized, requires auto-scaling based on HTTP traffic, needs zero orchestrator management overhead, and requires Microsoft to manage OS patching.
This identifies the constraints that the chosen Azure compute service must satisfy.
2
Evaluate the candidates against the OS patching requirement.
Azure Virtual Machines is eliminated as it is an IaaS solution where OS patching is the customer's responsibility.
Eliminating IaaS services ensures we only look at PaaS or serverless offerings where Microsoft handles OS maintenance.
3
Evaluate the remaining container options against the management overhead constraint.
Azure Kubernetes Service is eliminated because it introduces orchestration complexity (pods, ingress controllers, Kubernetes manifests) which contradicts the 'zero orchestrator management' constraint.
Ensures the solution aligns with the team's operational simplicity requirements.
4
Compare the remaining candidates, Azure Container Instances and Azure App Service, for web traffic scaling.
Azure App Service (specifically Web App for Containers) is chosen because it natively supports autoscaling based on HTTP request volume and built-in load balancing, whereas Azure Container Instances is designed for isolated container runs and lacks native HTTP-based autoscaling out of the box.
Matches the specific scaling requirement with the capabilities of the compute hosting service.

Key Concept

Selecting container hosting services in Azure based on management overhead and scaling requirements
Estimated Time:2m 0s
Question 79Question →

A CanNotDelete resource lock is applied to an Azure resource group.

Authorized users can modify the configuration settings of the resources inside this resource group.

Is this statement true or false?

Show answer & explanation

Answer: True

Answer

True
A CanNotDelete resource lock restricts only the deletion of resources. Authorized users remain fully able to modify and update configuration settings on resources within the locked scope.

Step-by-Step Solution

1
Identify the type of resource lock applied.
The applied lock is a CanNotDelete lock.
The stem specifies that a CanNotDelete resource lock is applied to the resource group.
2
Determine the rules and constraints of a CanNotDelete lock.
It prevents deletion of resources but permits read and modification operations.
By definition, a CanNotDelete lock only restricts the delete action, allowing authorized users to make changes to configurations.
3
Evaluate the statement based on the lock rules.
The statement is true.
Since the lock permits modifications, authorized users are allowed to modify resource configuration settings.

Key Concept

Azure Resource Locks prevent accidental deletion or modification. A CanNotDelete lock restricts only deletion, allowing authorized users to read and modify resources.
Question 80Question →

An Azure subscription named Sub-Corp has a CanNotDelete resource lock applied. Within Sub-Corp, there is a resource group named RG-Data that has a ReadOnly resource lock applied. RG-Data contains a storage account named sa-logs and a virtual network named vnet-prod. An administrator with Owner permissions on the subscription attempts to perform various tasks. Which of the following actions are blocked by the resource locks? Select two.

Select all that apply

Show answer & explanation

Answer: Retrieving the access keys for the storage account sa-logs; Deleting the virtual network vnet-prod

Answer

The actions that are blocked by the resource locks are retrieving the access keys for the storage account sa-logs, and deleting the virtual network vnet-prod.
The correct options are the ones stating that retrieving the access keys for the storage account sa-logs and deleting the virtual network vnet-prod are blocked. Retrieving the access keys is a control plane POST request, which is blocked by the ReadOnly lock on the resource group. Deleting the virtual network is blocked because it is located inside the resource group with the ReadOnly lock and inherits the CanNotDelete lock from the subscription.

Step-by-Step Solution

1
Analyze the scope and type of the resource locks applied.
The subscription has a CanNotDelete lock (prevents deletion, allows modification). The resource group RG-Data has a ReadOnly lock (prevents modification and deletion).
Understanding lock types is necessary to evaluate which operations are blocked at each scope.
2
Determine the lock status inherited by each resource.
Resources in RG-Data (sa-logs and vnet-prod) inherit the ReadOnly lock. Resources outside RG-Data but inside Sub-Corp (like RG-App) only inherit the CanNotDelete lock.
Resource locks are inherited by child resources, so their effective lock level depends on where they are in the hierarchy.
3
Evaluate the attempted actions against control plane and data plane rules.
Retrieving storage keys is a control plane POST operation, which is blocked by the ReadOnly lock. Deleting the virtual network is blocked by both locks. Modifying tags on RG-App is allowed because CanNotDelete does not block edits. Uploading a blob is a data plane operation and is not blocked by resource locks.
This step distinguishes between management operations and data operations, as well as the specific limitations of each lock type.

Key Concept

Azure Resource Locks prevent accidental deletion or modification of resources. They are inherited from parent scopes (subscriptions, resource groups) to child resources. CanNotDelete prevents deletion but allows updates, while ReadOnly prevents both deletion and updates (including control plane POST requests like listing storage keys), but does not affect data plane operations.
Estimated Time:2m 0s
PreviousPage 4 / 60Next
All practice questions — Microsoft Azure Fundamentals (AZ-900) | Examkin