Examkin

Soru

Zorluk: ZorResource Governance: Resource Groups, Tags, and Resource Locks

During a post-migration audit, an Azure administrator creates a resource group named `rg-finance-billing` to house audit data. The administrator applies the following configurations to the resource group:
- A tag named `CostCenter: Finance-101`
- A ReadOnly resource lock named `lock-finance-ro`

Subsequently, the administrator deploys a Storage Account named `safinanceaudit` into `rg-finance-billing`.

The administrator then attempts to perform the following operations:
1. View a cost report in Azure Cost Management filtered by the `CostCenter: Finance-101` tag to analyze the costs of `safinanceaudit`.
2. Retrieve the access keys for `safinanceaudit` using the Azure portal.
3. Upload a CSV file to a blob container named `audit-logs` inside `safinanceaudit` using Azure Storage Explorer.

Which of the operations will succeed?

  1. Operation 3 onlyCevap
  2. B
    Operation 2 and Operation 3 only
  3. C
    Operation 1 and Operation 3 only
  4. D
    None of the operations

Cevap

Only Operation 3 will succeed because resource locks restrict only management plane (control plane) operations, allowing data-plane actions like uploading a blob. Operation 1 fails because tags are not automatically inherited by child resources. Operation 2 fails because retrieving keys is a control-plane POST operation blocked by the inherited ReadOnly lock.
The correct answer is the option stating that only Operation 3 will succeed. Uploading a blob to a storage account container is a data-plane action. Since Azure resource locks only restrict control-plane operations managed by Azure Resource Manager, data-plane operations are not blocked. Operation 1 fails because tags applied to a resource group are not inherited by resources within that group. Operation 2 fails because retrieving storage account keys uses the listKeys action, which is a control-plane POST operation and is blocked by the inherited ReadOnly lock.

Adım Adım Çözüm

1
Evaluate the tag inheritance rule for Operation 1.
The tag applied to the resource group is not inherited by the storage account.
Azure resource tags do not inherit from resource groups to resources automatically. Thus, filtering by the tag will not show the storage account's costs.
2
Evaluate the lock inheritance rule for Operation 2.
The storage account inherits the ReadOnly lock applied to the resource group.
Resource locks are inherited by all child resources in the resource group scope.
3
Determine the impact of the ReadOnly lock on retrieval of access keys in Operation 2.
The key retrieval operation is blocked.
Listing storage account access keys requires a POST request to the control plane, which is blocked by a ReadOnly lock.
4
Determine the impact of the ReadOnly lock on uploading a blob in Operation 3.
The blob upload operation succeeds.
Uploading a blob is a data-plane operation, and Azure resource locks only restrict control-plane (management) operations.

Anahtar Kavram

Resource lock inheritance and distinction between control-plane and data-plane operations, combined with tag inheritance behavior.
Bu soruyu puanla

Konular

Resource Governance: Resource Groups, Tags, and Resource Locks

Bu konudan daha fazla soru