An organization's Azure environment is structured with the following hierarchy:
- Tenant Root Group
- Corporate-MG (Management Group)
- Production-MG (Management Group)
- Azure Subscription A
- Resource Group: RG-Shared-01
The following configurations are implemented:
1. A CanNotDelete resource lock is applied to RG-Shared-01.
2. A user is assigned the Owner role at the Corporate-MG level.
3. The administrator assigns the same user a custom RBAC role at the RG-Shared-01 level. The custom role contains a NotActions statement for deleting resources.
The user attempts to delete an Azure storage account that resides inside RG-Shared-01.
What is the outcome of the user's deletion attempt?
- The deletion attempt fails because the resource lock applied at the resource group level is inherited by the storage account, preventing deletion regardless of the user's RBAC permissions.Cevap
- BThe deletion attempt succeeds because the user's Owner role inherited from the Corporate-MG level overrides the resource lock.
- CThe deletion attempt succeeds because resource locks applied at the resource group level do not inherit to nested child resources.
- DThe deletion attempt fails because the custom RBAC role assigned at the resource group level overrides the user's inherited Owner role.
Cevap
The deletion attempt fails because the resource lock applied at the resource group level is inherited by the storage account, preventing deletion regardless of the user's RBAC permissions.
The correct option is the one stating that the deletion attempt fails due to resource lock inheritance. Resource locks applied at the resource group scope are inherited by all resources within that group. A CanNotDelete lock prevents any user—including those with Owner or Contributor permissions—from deleting the resource. Therefore, the user cannot delete the storage account.
Adım Adım Çözüm
Anahtar Kavram
Resource locks take precedence over RBAC permissions and are inherited down the resource hierarchy.
Tahmini Süre:1m 30s