Examkin

Soru

Zorluk: OrtaResource Governance: Resource Groups, Tags, and Resource Locks

A company's Azure environment includes a resource group named `rg-analytics-prod`. The resource group contains an Azure Cosmos DB account named `cosmos-prod-db`.

An administrator performs the following tasks:
- Assigns a tag named `CostCenter: 4002` to `rg-analytics-prod`.
- Configures a `ReadOnly` lock named `rg-lock` on `rg-analytics-prod`.
- Configures a `CanNotDelete` lock named `db-lock` on `cosmos-prod-db`.

Which of the following describes the final governance state and administrative permissions for `cosmos-prod-db`?

  1. The database account does not inherit the CostCenter tag, and administrators cannot modify the database account's settings.Cevap
  2. B
    The database account automatically inherits the CostCenter tag, and administrators can modify but not delete the database account.
  3. C
    The database account does not inherit the CostCenter tag, and administrators can modify the database account's settings because the ReadOnly lock applies only to the resource group itself.
  4. D
    The database account does not inherit the CostCenter tag, and subscription Owners can modify the database account because Owner permissions bypass resource locks.

Cevap

The database account does not inherit the CostCenter tag, and administrators cannot modify the database account's settings.
The correct option is that the database account does not inherit the CostCenter tag, and administrators cannot modify the database account's settings. Azure tags are not inherited from resource groups to resources. Additionally, resource locks inherit down the resource hierarchy. The ReadOnly lock applied to the resource group is inherited by the Cosmos DB account. Since a ReadOnly lock prevents all write and delete operations, administrators are blocked from modifying the settings of the Cosmos DB account, regardless of the local CanNotDelete lock.

Adım Adım Çözüm

1
Evaluate tag inheritance.
The Cosmos DB account does not receive the `CostCenter: 4002` tag.
Tags applied to a resource group do not automatically inherit to the resources inside it.
2
Evaluate resource lock inheritance.
The Cosmos DB account inherits the `ReadOnly` lock from the resource group.
Resource locks applied at a parent scope (like a resource group) are inherited by all child resources.
3
Combine the effects of the locks.
The Cosmos DB account is blocked from deletion and modification.
A `ReadOnly` lock prevents both deletion and configuration modifications. Although the Cosmos DB account has a local `CanNotDelete` lock, the inherited `ReadOnly` lock is more restrictive and takes precedence, preventing any modifications.

Anahtar Kavram

Resource lock inheritance and tag non-inheritance in Azure
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Resource Governance: Resource Groups, Tags, and Resource Locks

Bu konudan daha fazla soru