Soru

Zorluk: OrtaManagement Groups Hierarchies

An organization's Azure environment is structured with the following hierarchy:
- Tenant Root Group
- Corporate-MG (Management Group)
- Production-MG (Management Group)
- Azure Subscription A
- Resource Group: RG-Shared-01

The following configurations are implemented:
1. A CanNotDelete resource lock is applied to RG-Shared-01.
2. A user is assigned the Owner role at the Corporate-MG level.
3. The administrator assigns the same user a custom RBAC role at the RG-Shared-01 level. The custom role contains a NotActions statement for deleting resources.

The user attempts to delete an Azure storage account that resides inside RG-Shared-01.

What is the outcome of the user's deletion attempt?

  1. The deletion attempt fails because the resource lock applied at the resource group level is inherited by the storage account, preventing deletion regardless of the user's RBAC permissions.Cevap
  2. B
    The deletion attempt succeeds because the user's Owner role inherited from the Corporate-MG level overrides the resource lock.
  3. C
    The deletion attempt succeeds because resource locks applied at the resource group level do not inherit to nested child resources.
  4. D
    The deletion attempt fails because the custom RBAC role assigned at the resource group level overrides the user's inherited Owner role.

Cevap

The deletion attempt fails because the resource lock applied at the resource group level is inherited by the storage account, preventing deletion regardless of the user's RBAC permissions.
The correct option is the one stating that the deletion attempt fails due to resource lock inheritance. Resource locks applied at the resource group scope are inherited by all resources within that group. A CanNotDelete lock prevents any user—including those with Owner or Contributor permissions—from deleting the resource. Therefore, the user cannot delete the storage account.

Adım Adım Çözüm

1
Determine the user's effective RBAC permissions down the hierarchy.
The user has the Owner role inherited from Corporate-MG. The custom role with NotActions at the resource group level does not restrict this access because Azure RBAC is additive.
Understanding inheritance and the additive nature of RBAC is required to evaluate permissions.
2
Evaluate the impact of the resource lock.
The CanNotDelete lock is applied to RG-Shared-01. It inherits to the storage account.
Locks take precedence over RBAC user permissions and prevent deletion for all users.
3
Combine RBAC and resource lock effects to determine the final outcome.
The deletion fails due to the inherited resource lock.
Confirming that locks block write/delete operations even for subscription Owners.

Anahtar Kavram

Resource locks take precedence over RBAC permissions and are inherited down the resource hierarchy.
Tahmini Süre:1m 30s
Bu soruyu puanla