Examkin

Soru

Zorluk: Çok zorResource Locks

An enterprise Azure subscription has a `ReadOnly` lock applied at the subscription level. Within this subscription, a resource group named `RG-CoreServices` contains an Azure Cosmos DB account named `cosmos-orders` and an Azure Storage account named `stbackups`. A `CanNotDelete` lock is applied directly to `RG-CoreServices`.

An administrator with the Owner role at the subscription level needs to perform maintenance. Which two of the following actions can the administrator successfully complete without modifying or removing any resource locks? (Select two.)

  1. Upload a database backup file to an existing blob container in `stbackups` using a pre-existing Shared Access Signature (SAS).Cevap
  2. B
    Create a new resource group named `RG-Shared` within the subscription.
  3. C
    Retrieve the primary access keys for `cosmos-orders` using the Azure Portal or Azure CLI.
  4. Delete an existing log file stored as a blob in a container within `stbackups` using direct data plane access.Cevap
  5. E
    Add an IP firewall rule to the `cosmos-orders` account to allow traffic from an on-premises network.

Cevap

The administrator can upload a database backup file to an existing blob container using a pre-existing Shared Access Signature (SAS), and delete an existing log file stored as a blob using direct data plane access.
The correct options are uploading a backup file and deleting a log file. Both operations are data plane tasks interacting directly with the storage container contents rather than modifying the Azure Resource Manager (ARM) configuration of the resource. Resource locks only restrict control plane operations.

Adım Adım Çözüm

1
Determine the scope and inheritance of the applied locks.
The ReadOnly lock applied at the subscription level inherits down to all resource groups and resources in the subscription, making them effectively read-only. The CanNotDelete lock on the resource group prevents deletion of the resource group and its resources.
Resource locks are inherited by all child resources.
2
Distinguish between control plane and data plane operations.
Resource locks apply strictly to the Azure Resource Manager control plane (operations managing resources). They do not restrict data plane operations (reading, writing, or deleting data within the resources).
This determines which operations bypass resource locks.
3
Evaluate each action against the lock restrictions.
Creating a resource group, modifying firewall rules, and listing access keys are all control plane operations blocked by the ReadOnly lock. Uploading a blob and deleting a blob are data plane operations and are permitted.
To identify which actions will succeed without removing the locks.

Anahtar Kavram

Azure Resource Locks restrict control plane operations (such as configuration changes and resource deletion) but do not block data plane operations (such as manipulating data inside a storage account or database). ReadOnly locks also block operations that retrieve keys (like listKeys) because keys grant write access.
Bu soruyu puanla

Konular

Resource Locks

Bu konudan daha fazla soru