An organization has an Azure subscription containing a resource group named rg-shipping-prod. A CanNotDelete lock is applied directly to the rg-shipping-prod resource group. An administrator with the Owner role needs to update the configuration of an Azure App Service plan named asp-shipping and delete an unused Azure Storage account named stshippinghistory, both of which are located inside rg-shipping-prod.
Which of the following statements correctly describes the outcome of these actions?
- The update to the App Service plan is permitted, but the deletion of the Storage account is blocked.Cevap
- BBoth the update to the App Service plan and the deletion of the Storage account are blocked.
- CBoth the update to the App Service plan and the deletion of the Storage account are permitted because the administrator has the Owner role.
- DThe update to the App Service plan is blocked, but the deletion of the Storage account is permitted.
Cevap
The update to the App Service plan is permitted, but the deletion of the Storage account is blocked.
The correct answer is that the update to the App Service plan is permitted, but the deletion of the Storage account is blocked. A CanNotDelete lock allows authorized users to read and modify a resource but blocks its deletion. Since locks are inherited by child resources, both resources in the resource group are subject to this restriction, meaning the Storage account cannot be deleted while the App Service plan can be successfully updated.
Adım Adım Çözüm
Anahtar Kavram
Azure Resource Locks restrict actions on resources regardless of user permissions. A CanNotDelete lock allows read and modify operations but blocks deletion, and is inherited by all child resources.