Examkin

Describe Azure Management and Governance

399 questions

All types399Multiple choice204Multiple select81True / False100Matching14
Question 1Question →

An enterprise administrator is designing a governance and access strategy for a newly created Azure subscription. The strategy must satisfy two requirements:

1. A security compliance team must be able to view all resource configurations and inspect active role assignments, but they must not be allowed to modify resources or alter permissions.
2. A development team must be permitted to create and manage virtual machines within a resource group named RG-Web, but they must be prevented from deploying any virtual machines that lack a 'Department' tag.

Which solution should the administrator implement?

Show answer & explanation

Answer: Assign the Reader role to the security compliance team at the subscription scope; assign the Virtual Machine Contributor role to the development team at the resource group scope; and assign an Azure Policy that requires the 'Department' tag on virtual machines.

Answer

Assign the Reader role to the security compliance team at the subscription scope; assign the Virtual Machine Contributor role to the development team at the resource group scope; and assign an Azure Policy that requires the 'Department' tag on virtual machines.
The correct solution uses the Reader role to grant the security compliance team read-only access to resource configurations and permissions at the subscription level. It uses the Virtual Machine Contributor role to grant the development team the ability to manage virtual machines within the specific resource group (RG-Web). Finally, it uses Azure Policy to enforce the presence of the 'Department' tag on virtual machines, separating access control from resource compliance.

Step-by-Step Solution

1
Analyze the access requirement for the security compliance team.
The team must view resource settings and role assignments but cannot modify them or change permissions. The built-in Reader role provides read-only access to resources and permissions at the assigned scope.
Choosing the Reader role prevents unauthorized modifications or permission alterations while satisfying the auditing requirement.
2
Analyze the resource management requirement for the development team.
The team needs to create and manage virtual machines inside a specific resource group (RG-Web). The built-in Virtual Machine Contributor role allows managing virtual machines without granting access to the underlying virtual network or storage account, or the ability to manage permissions.
Using a scoped role like Virtual Machine Contributor at the resource group level ensures the principle of least privilege is followed.
3
Analyze the governance requirement to block virtual machines without a specific tag.
Enforcing resource properties or compliance rules (like requiring a 'Department' tag) must be done using Azure Policy.
Azure RBAC manages identity-based access, whereas Azure Policy controls the properties of the resources being deployed.

Key Concept

Azure RBAC roles (Reader, Virtual Machine Contributor) manage access permissions based on identities and scope, while Azure Policy enforces compliance and resource properties.
Estimated Time:2m 0s
Question 2Question →

An Azure administrator needs to prevent users from accidentally deleting a virtual machine named VM-Prod. However, users must still be able to start, stop, and resize the virtual machine. Which configuration should the administrator apply to VM-Prod?

Show answer & explanation

Answer: A CanNotDelete resource lock

Answer

A CanNotDelete resource lock
The configuration utilizing a CanNotDelete resource lock is correct because it prevents users from deleting the virtual machine while still permitting them to modify its state (such as starting, stopping, or resizing).

Step-by-Step Solution

1
Identify the goal of the configuration, which is to block the deletion of the virtual machine while allowing modifications like starting, stopping, and resizing.
The requirement matches the behavior of the CanNotDelete resource lock.
Azure resource locks provide a way to restrict actions on resources. Specifically, CanNotDelete allows modifications but prevents deletion.
2
Evaluate the ReadOnly resource lock alternative.
The ReadOnly lock is ruled out because it blocks both deletion and modifications (including starting and stopping the VM).
ReadOnly prevents any updates to the resource, which violates the requirement to allow users to change its size or status.

Key Concept

Azure Resource Locks prevent accidental deletion or modification of critical Azure resources.
Question 3Question →

An IT department is implementing a governance and monitoring strategy for their Azure cloud infrastructure. They need to configure appropriate health monitoring tools to distinguish between global Azure outages, service-level issues affecting their subscriptions, and specific resource failures. Which two of the following statements correctly describe the capabilities of the Azure Service Health suite?

Select all that apply

Show answer & explanation

Answer: Azure Service Health provides a personalized dashboard that tracks service issues, planned maintenance, and health advisories affecting only the Azure services and regions used by your subscription.; Azure Resource Health provides details about the health of your individual resource instances, such as a specific virtual machine, and helps you diagnose whether an issue is due to a platform outage or a user configuration.

Answer

Azure Service Health provides a personalized dashboard that tracks service issues, planned maintenance, and health advisories affecting only the Azure services and regions used by your subscription; and Azure Resource Health provides details about the health of your individual resource instances, such as a specific virtual machine, and helps you diagnose whether an issue is due to a platform outage or a user configuration.
The correct options accurately define the functions of the Azure Service Health suite. Specifically, the option describing a personalized dashboard for service issues, planned maintenance, and advisories represents the core capability of Azure Service Health. The option detailing diagnostic information for specific resource instances represents Azure Resource Health. Together, these form the pillars of the Azure Service Health suite along with the global Azure Status page.

Step-by-Step Solution

1
Identify the component of the Azure Service Health suite that provides personalized notifications for subscription-level impact.
Determine that Azure Service Health provides a filtered, personalized view of issues, planned maintenance, and advisories for the specific services and regions used by the subscription.
This confirms the personalized, service-level nature of Azure Service Health.
2
Identify the component that monitors individual resource instances.
Determine that Azure Resource Health is responsible for diagnosing issues with specific resource instances (like a virtual machine or SQL database) and identifying whether the problem is on the Azure platform side or due to client configuration.
This verifies the function of Azure Resource Health within the suite.
3
Evaluate the incorrect options that refer to global status or resource telemetry.
Identify that global status is handled by Azure Status (which is not personalized), and application/infrastructure metrics/logs are collected by Azure Monitor rather than Azure Service Health.
This filters out distractors based on the target misconception of confusing Azure Service Health with Azure Monitor or Azure Status.

Key Concept

Azure Service Health suite components (Azure Status, Service Health, Resource Health) vs Azure Monitor functions
Estimated Time:1m 30s
Question 4Question →

An administrator is configuring resource tags in an Azure subscription to manage and track department expenditures. Is the statement that resource tags can be used to split a single Azure subscription's billing into multiple separate invoices true or false?

Show answer & explanation

Answer: False

Answer

The statement is false because resource tags cannot be used to split a single Azure subscription's billing into multiple separate invoices.
The correct answer is false because resource tags do not have the capability to alter the billing structure or split a subscription's bill into separate invoices. Invoices are generated at the subscription or billing profile level.

Step-by-Step Solution

1
Examine the role of Azure resource tags in cost management.
Resource tags are key-value pairs applied to resources to help organize and report cost data within tools like Azure Cost Analysis.
Understanding the functional capabilities of resource tags helps determine if they can modify billing documents.
2
Determine the billing and invoice boundary in Azure.
Invoices are generated based on subscription boundaries and billing profiles, not resource-level tags.
Comparing the tag functionality against billing capabilities clarifies whether tags can split invoices.

Key Concept

Resource tags are metadata used for categorization and reporting but do not alter billing boundaries or invoice generation.
Question 5Question →

An organization hosts a customer database on an Azure SQL Database instance. The database administrator wants to track the database's real-time CPU consumption to ensure there is enough processing capacity. Which Azure service should the administrator use to collect and visualize these resource-level performance metrics?

Show answer & explanation

Answer: Azure Monitor

Answer

Azure Monitor
Azure Monitor is the correct service because it is specifically designed to collect, analyze, and visualize telemetry data, such as real-time CPU utilization metrics and diagnostic logs, from individual Azure resources like Azure SQL Database.

Step-by-Step Solution

1
Determine the monitoring requirement.
The requirement is to collect, track, and visualize real-time CPU performance telemetry for a specific database resource hosted inside Azure.
Identifying the scope of monitoring (individual resource performance vs. global service status) helps isolate the correct management service.
2
Evaluate the capabilities of the primary monitoring service.
Azure Monitor collects numeric performance metrics and logs from Azure resources, enabling administrators to analyze trends and set up alerts.
This matches the requirement to monitor and visualize database CPU consumption.
3
Rule out alternative management and governance services.
Azure Service Health tracks platform-wide events, Azure Policy enforces compliance standards, and Azure Arc handles hybrid resource management.
Ensures that other management tools are not confused with telemetry collection services.

Key Concept

Using Azure Monitor to collect and visualize performance metrics of Azure resources.
Question 6Question →

A company has virtual machines running on-premises and on a third-party cloud platform. The company wants to apply Azure governance and management tools, such as Azure Policy, to these external virtual machines. Which Azure service should the company use to meet this requirement?

Show answer & explanation

Answer: Azure Arc

Answer

Azure Arc is the correct service because it is designed to extend Azure management, security, and governance to resources that live outside of Azure.
Azure Arc is specifically designed to extend Azure management, governance, and services to hybrid and multi-cloud environments. By registering external servers with Azure Arc, they appear as resource objects inside Azure, allowing the use of Azure Resource Manager, Azure Policy, and guest configuration tools.

Step-by-Step Solution

1
Analyze the company's requirement: managing and governing virtual machines that are running on-premises and on a third-party cloud platform using Azure services.
The target resources are located outside of Azure's native cloud environment.
Identifying the location of the resources helps select the correct hybrid management tool.
2
Evaluate which Azure service acts as a bridge to extend Azure Resource Manager (ARM) and Azure Policy to non-Azure resources.
Azure Arc is identified as the service that projects external resources into Azure as native ARM resources.
This matches the requirement of applying Azure management and governance to external virtual machines.

Key Concept

Azure Arc is a service that simplifies governance and management by delivering a consistent multi-cloud and on-premises management platform, projecting non-Azure resources into Azure Resource Manager.
Question 7Question →

An Azure administrator applies a ReadOnly resource lock to an Azure resource group. Which of the following describes the effect of this lock on the resources inside the resource group?

Show answer & explanation

Answer: Authorized users can read the resource configurations, but they cannot modify or delete the resources.

Answer

Authorized users can read the resource configurations, but they cannot modify or delete the resources.
Applying a ReadOnly lock to a resource group prevents any changes to the configurations of the resources within that group, and also prevents the resources from being deleted. Authorized users can still read and view the resource settings.

Step-by-Step Solution

1
Identify the type of resource lock applied.
The lock is a ReadOnly lock applied at the resource group level.
Understanding the lock type is necessary to determine the specific restrictions enforced.
2
Analyze how locks are inherited.
The lock is inherited by all resources within the resource group.
Azure resource locks applied at a parent scope (like a resource group) apply to all resources contained within that scope.
3
Determine the restrictions of a ReadOnly lock.
A ReadOnly lock prevents all delete and write/update operations.
This matches the definition of a ReadOnly lock, which is more restrictive than a CanNotDelete lock.

Key Concept

Azure Resource Locks (ReadOnly vs CanNotDelete)
Question 8Question →

Your company has an Azure subscription containing a resource group named Dev-RG. You need to grant a junior administrator the ability to create and manage all resources within Dev-RG. The junior administrator must not be allowed to assign roles or grant permissions to other users. Which of the following should you assign to the junior administrator's account for Dev-RG?

Show answer & explanation

Answer: The Contributor role

Answer

The Contributor role
The Contributor role allows the user to manage all resources within the specified scope, including creating and deleting resources, but it does not allow the user to assign roles in Azure RBAC or grant permissions to others. This perfectly aligns with the security requirements of the scenario.

Step-by-Step Solution

1
Analyze the access control requirements for the junior administrator.
The administrator needs permissions to create and manage all resources within the specific resource group (Dev-RG) but must be restricted from delegating access or assigning roles to other users.
This establishes the scope (Resource Group) and the required actions (create and manage resources, but no access management).
2
Evaluate the capabilities of Azure Role-Based Access Control (RBAC) roles against the requirements.
The Contributor role allows managing all resources but prevents role assignment. The Owner role allows both resource management and role assignment. The Reader role only allows viewing resources.
This matches the requirements to the correct built-in Azure RBAC role.
3
Differentiate between Azure RBAC and Azure Policy.
Azure Policy regulates resource configuration compliance rather than user permissions, making it unsuitable for granting access.
This eliminates the policy-related distractor.

Key Concept

Azure Role-Based Access Control (RBAC) built-in roles and scope
Estimated Time:1m 0s
Question 9Question →

An administrator applies a ReadOnly resource lock to an Azure subscription. A database administrator with Owner permissions at the resource group level attempts to scale up an Azure SQL Database located in a resource group within that subscription. Which of the following describes the outcome of this action?

Show answer & explanation

Answer: The operation is blocked because the database inherits the ReadOnly lock from the subscription level, which prevents modifying resource configurations.

Answer

The operation is blocked because the database inherits the ReadOnly lock from the subscription level, which prevents modifying resource configurations.
The correct option is that the operation is blocked because the database inherits the ReadOnly lock from the subscription level. In Azure, resource locks applied at a parent scope (like a subscription) are inherited by all child resources. Furthermore, a ReadOnly lock prevents any modification to resource configurations, including scaling operations.

Step-by-Step Solution

1
Identify the scope and inheritance of the resource lock.
The ReadOnly lock is applied at the subscription level, which means all resource groups and resources within that subscription inherit this lock.
Azure resource locks are inherited by child resources from parent scopes.
2
Determine the restriction level of a ReadOnly lock.
A ReadOnly lock prevents all write and delete operations, meaning no configurations can be modified and no resources can be deleted.
A ReadOnly lock is more restrictive than a CanNotDelete lock, which only blocks deletion but allows updates.
3
Evaluate the interaction between RBAC roles (Owner) and resource locks.
The Owner role's permissions are restricted by the resource lock. The lock must be removed before any modification can occur.
Resource locks apply to all users, even those with administrative or owner privileges.

Key Concept

Resource Locks Inheritance and ReadOnly Restrictions
Question 10Question →

An administrator assigns the Reader role to a user at the Azure subscription level. The subscription contains a resource group named RG1, which contains a virtual machine named VM1. Which of the following describes the user's permissions for VM1?

Show answer & explanation

Answer: The user can view VM1 but cannot modify or delete it.

Answer

The user can view VM1 but cannot modify or delete it.
Assigning the Reader role at the subscription level automatically propagates permissions down the Azure resource hierarchy. This means the user inherits Reader permissions on the resource group and the virtual machine, allowing them to view the virtual machine's configurations but preventing them from modifying or deleting it.

Step-by-Step Solution

1
Identify the scope where the Azure RBAC role is assigned.
The Reader role is assigned at the subscription level.
Permissions in Azure RBAC propagate down the hierarchy from management groups, to subscriptions, to resource groups, and finally to resources.
2
Determine the inheritance of the Reader role for the resources inside the subscription.
The user inherits the Reader role for all resource groups (like RG1) and resources (like VM1) within that subscription.
Since inheritance is automatic and cannot be blocked at lower levels, the subscription-level Reader role applies to VM1.
3
Evaluate the capabilities of the Reader role on the target resource.
The user has view-only permissions for VM1 and cannot modify or delete it.
The built-in Reader role allows users to view resources but does not grant permissions to make changes or manage access.

Key Concept

Azure RBAC permissions inherit automatically from higher scopes (such as subscriptions) to lower scopes (such as resource groups and resources).
Question 11Question →

An administrator manages an Azure subscription that contains a resource group named RG-App. The resource group contains a virtual machine named VM-Web. The administrator applies a ReadOnly lock to the subscription and a CanNotDelete lock to the resource group RG-App. A user who is assigned the Owner role at the subscription level attempts to start VM-Web and then attempts to delete VM-Web. What is the result of these two actions?

Show answer & explanation

Answer: Both the attempt to start VM-Web and the attempt to delete VM-Web are blocked.

Answer

Both the attempt to start VM-Web and the attempt to delete VM-Web are blocked.
The correct answer is correct because Azure Resource Locks are inherited from higher scopes (subscription) to lower scopes (resource group and resource), and they are additive. The subscription-level ReadOnly lock is inherited by the virtual machine and blocks both write operations (like starting the VM) and delete operations. Furthermore, locks apply to all users, including subscription Owners, meaning they cannot perform these actions without removing the locks first.

Step-by-Step Solution

1
Determine the resource lock inheritance on VM-Web.
VM-Web inherits the ReadOnly lock from the subscription and the CanNotDelete lock from the RG-App resource group.
Azure resource locks are inherited from parent scopes (Subscription -> Resource Group -> Resource).
2
Determine the effective permissions resulting from the combined locks.
The effective state is ReadOnly, which blocks both deletions and modifications/writes.
Locks are additive, meaning the most restrictive combination of all applied and inherited locks is enforced.
3
Evaluate the user's role and the requested operations against the locks.
Both starting the VM (a write/update operation) and deleting the VM are blocked, regardless of the user's Owner role.
Resource locks apply to all users and roles, and cannot be bypassed by RBAC roles like Owner without first removing the lock.

Key Concept

Azure Resource Locks block operations regardless of RBAC roles, are inherited, and are additive (most restrictive applies). A ReadOnly lock prevents starting or stopping a virtual machine.
Question 12Question →

An Azure subscription contains a resource group named RG-Prod. Inside RG-Prod, there is a logical Azure SQL Database server named SQLServer1 and an Azure SQL database named SQLDB1.

An administrator applies a ReadOnly resource lock to the subscription. Later, the administrator applies a CanNotDelete resource lock directly to the resource group RG-Prod.

Which of the following actions can a user perform on these resources?

Show answer & explanation

Answer: Insert new records into a table within SQLDB1.

Answer

Inserting new records into a table within SQLDB1.
Inserting new records into a table within the database is a data plane operation. Azure Resource Locks only apply to control plane (management) operations managed by Azure Resource Manager (ARM). Therefore, operations like writing data, reading tables, or executing queries inside the database are not blocked by resource locks.

Step-by-Step Solution

1
Evaluate the inheritance of resource locks across the scopes.
The subscription has a ReadOnly lock, and the resource group has a CanNotDelete lock. Resources inside the resource group (SQLServer1 and SQLDB1) inherit both locks.
Resource locks in Azure are inherited from parent scopes (Subscription -> Resource Group -> Resource).
2
Determine the effective lock restriction on the resources.
The ReadOnly lock is more restrictive than the CanNotDelete lock, so the effective lock applied to the resources inside RG-Prod is ReadOnly.
When multiple locks are inherited or applied, the most restrictive lock takes precedence.
3
Distinguish between control plane and data plane operations.
Control plane operations (managed by Azure Resource Manager, such as scaling, modifying firewalls, or deleting resources/locks) are blocked by the ReadOnly lock. Data plane operations (managed by the database engine, such as inserting or querying data) are not affected by resource locks.
Azure Resource Locks only restrict control plane operations and have no effect on data plane operations.
4
Select the only permitted action.
Inserting new records into a database table is a data plane operation and is allowed, while scaling, editing firewall configurations, or deleting locks are control plane operations and are blocked.
Only data plane operations can bypass the inherited control plane ReadOnly lock restriction.

Key Concept

Azure resource locks restrict Azure Resource Manager control plane operations but do not affect data plane operations, with inherited locks combining so that the most restrictive lock applies.
Question 13Question →

An organization has an Azure subscription named Sub1 that contains a resource group named RG-Web. You need to configure the environment to meet the following requirements:

* A security auditor named Taylor must be able to assign roles and manage access permissions for other users on all resources inside RG-Web, but Taylor must not be able to create, modify, or delete any resources.
* All resources deployed within Sub1 must be restricted to a specific list of approved Azure regions.

Which configuration should you implement to meet these requirements?

Show answer & explanation

Answer: Assign the User Access Administrator role to Taylor at the RG-Web scope, and assign an Azure Policy definition at the Sub1 scope.

Answer

Assign the User Access Administrator role to Taylor at the RG-Web scope, and assign an Azure Policy definition at the Sub1 scope.
Assigning the User Access Administrator role at the RG-Web scope grants the permissions to manage user access and role assignments on all resources inside that resource group, but does not allow creating or deleting the resources themselves. Assigning an Azure Policy at the Sub1 scope ensures that all resources deployed within the subscription comply with the specified regional restrictions, as policies are inherited by child resource groups and resources.

Step-by-Step Solution

1
Determine the appropriate Azure RBAC role and scope for the security auditor.
Identify the User Access Administrator role assigned at the RG-Web resource group level.
This role grants the required permission to assign roles and manage access for others without granting permissions to write, delete, or modify the underlying resources. Assigning it at the RG-Web scope follows the principle of least privilege.
2
Select the correct mechanism to restrict resource deployment regions.
Identify Azure Policy as the compliance enforcement mechanism.
Azure Policy is designed to enforce compliance and resource properties, such as restricting allowed deployment regions. Azure RBAC controls authorization/access, while resource locks block deletions or modifications entirely.
3
Determine the proper scope for the regional restriction.
Apply the Azure Policy definition at the Sub1 subscription level.
The requirement specifies that all resources deployed within the subscription must be restricted. Assigning the policy at the subscription level ensures that all existing and future resource groups and resources under it inherit and enforce the policy.

Key Concept

Understanding the difference between Azure RBAC (access control) and Azure Policy (resource compliance/properties), along with resource group hierarchy rules.
Estimated Time:2m 0s
Question 14Question →

A retail company has several physical stores, each running Windows and Linux servers on-premises. The company wants to manage and monitor these on-premises servers alongside their Azure resources using a single control plane.

Statement: The company can use Azure Arc to project these on-premises physical servers into Azure Resource Manager as hybrid machines.

Show answer & explanation

Answer: True

Answer

True
Azure Arc allows organizations to project physical and virtual servers running on-premises or in other clouds into Azure Resource Manager, representing them as hybrid machines that can be managed from the Azure portal.

Step-by-Step Solution

1
Identify the organization's goal to extend Azure's centralized management to physical servers located outside of Azure's cloud infrastructure.
The organization needs a way to bridge non-Azure on-premises servers with Azure Resource Manager.
This establishes the hybrid environment context for the question.
2
Determine if Azure Arc is the service designed to extend Azure Resource Manager to external resources.
Azure Arc functions specifically to project external resources, including on-premises Windows and Linux servers, into Azure Resource Manager as hybrid machines.
This verifies the validity of the statement.

Key Concept

Azure Arc extends the Azure control plane (Azure Resource Manager) to secure and govern infrastructure and applications outside of Azure, including on-premises and multi-cloud servers.
Question 15Question →

An enterprise administrator is designing access controls for an Azure environment. A system auditor, User1, needs to inspect all resources across an Azure subscription named 'Subscription1'. Additionally, User1 must be able to perform management operations (such as starting, stopping, and restarting) on virtual machines within a specific resource group named 'RG-Prod'. However, User1 must not be allowed to modify permissions or assign roles to other users in any scope.

Which of the following configurations correctly implements these requirements?

Show answer & explanation

Answer: Assign User1 the Reader role at the Subscription1 scope, and assign User1 the Virtual Machine Contributor role at the RG-Prod scope.

Answer

Assign User1 the Reader role at the Subscription1 scope, and assign User1 the Virtual Machine Contributor role at the RG-Prod scope.
Assigning the Reader role at the Subscription1 scope and the Virtual Machine Contributor role at the RG-Prod scope correctly grants the ability to view all resources in the subscription, while also allowing virtual machine management within the specific resource group. Since neither role includes permissions to write role assignments, the security requirement of not allowing delegation is fully satisfied.

Step-by-Step Solution

1
Evaluate the requirement to inspect all resources across Subscription1.
Assigning the Reader role at the Subscription1 scope enables User1 to view all resources in the subscription and inherits down to all resource groups.
Ensures complete inspection capability across the target scope.
2
Evaluate the requirement to manage virtual machines within RG-Prod.
Assigning the Virtual Machine Contributor role at the RG-Prod scope grants permissions to perform VM operations (start, stop, restart) within that resource group.
Allows virtual machine management specifically within the required resource group without granting full contributor access to other resource types.
3
Verify the constraint preventing User1 from assigning roles or modifying permissions.
Neither the Reader role nor the Virtual Machine Contributor role has permission to write role assignments (Microsoft.Authorization/roleAssignments/write).
Guarantees that User1 cannot delegate permissions to other users.

Key Concept

Azure Role-Based Access Control (RBAC) role assignment, inheritance, and separation from Azure Policy and Resource Locks.
Estimated Time:3m 0s
Question 16Question →

An administrator assigns a user the Reader role at the scope of an Azure subscription. Determine if the following statement is true or false: The user will automatically have read access to all resources within that subscription due to role inheritance.

Show answer & explanation

Answer: True

Answer

True
Assigning a role at the subscription level automatically propagates those permissions to all child resource groups and resources due to the hierarchical inheritance model of Azure RBAC.

Step-by-Step Solution

1
Identify the scope at which the role assignment is made.
The Reader role is assigned at the subscription scope, which sits above resource groups and individual resources in the Azure resource hierarchy.
Understanding where the permission is applied is key to determining how it propagates.
2
Apply the Azure RBAC inheritance rules.
Permissions assigned at a parent scope (like a subscription) are inherited by all child scopes (like resource groups and resources).
This is a fundamental mechanism of Azure's governance structure.
3
Evaluate the user's access to the resources within the subscription.
Because of inheritance, the user automatically receives Reader access to all resources in all resource groups under that subscription.
Determines the truth value of the target statement.

Key Concept

Azure RBAC scope inheritance
Estimated Time:45s
Question 17Question →

An Azure resource group contains a virtual machine. A ReadOnly resource lock is applied to this resource group. Which of the following statements describe the effects of this lock on the virtual machine? (Select two.)

Select all that apply

Show answer & explanation

Answer: Authorized users can view the configuration settings of the virtual machine.; Authorized users are prevented from deleting the virtual machine.

Answer

Authorized users can view the configuration settings of the virtual machine, and authorized users are prevented from deleting the virtual machine.
The correct options are that authorized users can view the configuration settings and are prevented from deleting the virtual machine. This is because a ReadOnly lock applied at the resource group level is inherited by the virtual machine, allowing only read operations (viewing configurations) and blocking all write or delete operations.

Step-by-Step Solution

1
Determine lock inheritance.
The ReadOnly lock applied at the resource group level is inherited by all resources within it, including the virtual machine.
Azure Resource Locks are inherited by child resources.
2
Evaluate the permissions allowed by a ReadOnly lock.
ReadOnly locks allow read operations (like viewing configuration) but block write/modify and delete operations.
This is the primary function of a ReadOnly lock.
3
Identify which actions are allowed and which are blocked.
Viewing configuration is allowed. Deleting, resizing, and starting/stopping are blocked because resizing and starting/stopping require write operations.
Starting/stopping a VM modifies its state and is therefore blocked.

Key Concept

Azure Resource Locks prevent accidental deletion or modification of resources. A ReadOnly lock allows only read operations and blocks all write, modify, and delete operations.
Question 18Question →

An Azure administrator configures resource locks in a Microsoft Azure subscription. The administrator applies a ReadOnly lock to a resource group named RG-Production. Within RG-Production, there is an Azure Virtual Machine named VM-App1. The administrator then applies a CanNotDelete lock directly to VM-App1.

Which of the following statements describe the combined effects of these locks on VM-App1? Select two.

Select all that apply

Show answer & explanation

Answer: Authorized users are prevented from deleting VM-App1.; Authorized users are prevented from starting or stopping VM-App1.

Answer

Authorized users are prevented from deleting the virtual machine, and they are also prevented from starting or stopping the virtual machine.
Resource locks are inherited from parent scopes to child resources. When multiple locks are applied, they are additive, meaning the most restrictive lock settings apply. The ReadOnly lock from the resource group prevents any modifications or control operations (such as starting or stopping the virtual machine), while both locks prevent the deletion of the resource.

Step-by-Step Solution

1
Analyze lock inheritance rules in Azure.
Resource locks applied at the resource group level are inherited by all resources within that resource group. Therefore, the ReadOnly lock applies to VM-App1.
To determine which locks are active on VM-App1.
2
Determine the combined effect of multiple locks.
Locks are additive. Since VM-App1 has both a ReadOnly lock (inherited) and a CanNotDelete lock (directly applied), the most restrictive lock rules apply. ReadOnly is more restrictive than CanNotDelete.
To evaluate how the two lock types interact.
3
Evaluate the capabilities allowed by the active locks.
The ReadOnly lock prevents deletion and any modifications, including operations like starting and stopping the virtual machine. The CanNotDelete lock also prevents deletion.
To identify the correct statements regarding the effects on the virtual machine.

Key Concept

Resource locks are inherited, additive, and the ReadOnly lock prevents both deletion and configuration updates (including stopping or starting virtual machines).
Question 19Question →

An organization needs to prevent the accidental deletion of a production database account in Azure. However, administrators must still be able to modify the database configuration settings and scale its throughput as needed. Which resource lock should be applied to meet these requirements?

Show answer & explanation

Answer: A CanNotDelete lock

Answer

A CanNotDelete lock
A CanNotDelete lock blocks the deletion of a resource, but allows users to read and modify its configuration. This satisfies the requirement to protect the database from deletion while allowing administrators to modify settings and scale throughput.

Step-by-Step Solution

1
Analyze the requirements to determine the allowed and blocked actions.
Deletion must be blocked, but modifications and updates (such as scaling throughput) must be permitted.
This helps determine the specific lock behavior needed.
2
Evaluate the difference between Azure resource lock types.
A ReadOnly lock blocks both modifications and deletion, whereas a CanNotDelete lock only blocks deletion and allows modifications.
This ensures the selected lock type does not disrupt normal administrative tasks.
3
Select the lock type that permits updates but denies deletion.
A CanNotDelete lock satisfies all constraints of the scenario.
It successfully prevents accidental deletion while leaving configuration and scaling controls active.

Key Concept

Azure Resource Locks prevent accidental deletion or modification of resources. A CanNotDelete lock allows read and update operations but blocks deletion, whereas a ReadOnly lock blocks both modifications and deletion.
Estimated Time:45s
Question 20Question →

A company hosts a web application on an Azure App Service named app-invoices, which is deployed inside a resource group named rg-finance-prod. To protect the resources, an administrator applies a CanNotDelete lock directly to app-invoices. Additionally, a ReadOnly lock is applied to the resource group rg-finance-prod. A developer with Owner permissions attempts to update the configuration settings of app-invoices. What is the outcome of this update attempt?

Show answer & explanation

Answer: The update is blocked because the App Service inherits the ReadOnly lock from the resource group.

Answer

The update is blocked because the App Service inherits the ReadOnly lock from the resource group.
The correct answer is correct because resource locks are inherited from parent scopes (the resource group) to child resources (the App Service). Since a ReadOnly lock is more restrictive than a CanNotDelete lock, it takes precedence. Under a ReadOnly lock, all configuration modification and deletion attempts are blocked, regardless of the user's high-privilege RBAC roles.

Step-by-Step Solution

1
Identify the locks and scopes.
A CanNotDelete lock is applied directly to the App Service. A ReadOnly lock is applied to the parent resource group.
Understanding the lock configuration across the resource hierarchy is necessary to determine the net effect.
2
Apply lock inheritance rules.
The App Service inherits the ReadOnly lock from its parent resource group.
In Azure, resource locks applied at a parent scope are automatically inherited by all child resources.
3
Evaluate the cumulative effect of the locks.
The ReadOnly lock takes precedence over the CanNotDelete lock because it is more restrictive.
When multiple locks are applied, the most restrictive lock applies. ReadOnly blocks both deletion and modification, whereas CanNotDelete only blocks deletion.
4
Assess user permissions.
The update is blocked despite the developer having Owner permissions.
Azure resource locks apply to all users and roles, meaning even Owner permissions cannot bypass a lock without first removing it.

Key Concept

Azure Resource Lock inheritance and behavior
Page 1 / 20Next