Examkin

Soru

Zorluk: ZorResource Governance: Resource Groups, Tags, and Resource Locks

An Azure subscription contains a resource group named `rg-prod-data`. You apply a tag named `Environment: Production` and a `ReadOnly` resource lock to `rg-prod-data`. The resource group contains an Azure Storage account named `storage1`. An administrator with owner permissions attempts to access `storage1`. Which of the following describes the governance behavior for `storage1`?

  1. The administrator can read blob data in `storage1` using Microsoft Entra ID credentials, but is blocked from retrieving the storage account access keys and modifying the resource tags.Cevap
  2. B
    The administrator is blocked from reading the blob data in `storage1` because the ReadOnly lock inherits to child resources and blocks both control plane and data plane operations.
  3. C
    The administrator can retrieve the storage account access keys since it is a read operation, but is blocked from modifying the tags because they are automatically inherited from the resource group.
  4. D
    The administrator can modify the tags on `storage1` because tags are not affected by resource locks, but is blocked from reading the blob data in `storage1`.

Cevap

The administrator can read blob data in `storage1` using Microsoft Entra ID credentials, but is blocked from retrieving the storage account access keys and modifying the resource tags.
The correct option is correct because Azure Resource Locks apply only to the control plane (Azure Resource Manager). Thus, reading data plane blobs using Microsoft Entra ID credentials is not blocked by a ReadOnly lock. However, retrieving storage account access keys requires a POST request (`Microsoft.Storage/storageAccounts/listKeys/action`), which is blocked by a ReadOnly lock. Furthermore, modifying tags requires a write operation on the resource, which is also blocked by the inherited ReadOnly lock.

Adım Adım Çözüm

1
Analyze the impact of the ReadOnly lock on control plane operations.
The ReadOnly lock applied to the resource group inherits to `storage1`. It blocks all write operations (like modifying tags) and POST actions (like listing storage keys).
ReadOnly locks prevent any configuration modifications and block actions requiring POST request methods.
2
Analyze the impact of the ReadOnly lock on data plane operations.
Data plane operations, such as reading or writing blobs in `storage1`, remain allowed for users with correct RBAC data plane permissions (e.g., Storage Blob Data Reader).
Azure Resource Locks only apply to control plane (Azure Resource Manager) actions, not data plane access.
3
Evaluate tag inheritance behavior.
The `Environment: Production` tag on the resource group is not inherited by `storage1` automatically.
In Azure, tags applied at the resource group level do not inherit to resources within that resource group.

Anahtar Kavram

Azure Resource Locks block control plane actions (including POST operations like listing keys) and inherit down the hierarchy, while data plane operations and tag inheritance are unaffected by locks and resource groups respectively.
Bu soruyu puanla

Konular

Resource Governance: Resource Groups, Tags, and Resource Locks

Bu konudan daha fazla soru