Examkin

Soru

Zorluk: ZorResource Locks

An organization has a production Azure subscription containing a resource group named RG-Backend. A ReadOnly resource lock is applied at the subscription level, and a CanNotDelete resource lock is applied directly to the RG-Backend resource group. Inside RG-Backend, there is an Azure App Service web app named WebApp-Prod and an Azure SQL database. An administrator with Owner role permissions needs to scale up the App Service plan for WebApp-Prod, delete the SQL database, and retrieve the publishing profile for WebApp-Prod. Which of the following describes the outcome of these three attempted actions?

  1. All three actions are blocked because the ReadOnly lock applied at the subscription level is inherited by all resources, preventing updates, deletions, and credential retrieval.Cevap
  2. B
    Only the deletion of the SQL database is blocked, while scaling up the App Service plan and retrieving the publishing profile are allowed because Owner permissions override resource locks.
  3. C
    Scaling up the App Service plan and deleting the SQL database are blocked, but retrieving the publishing profile is allowed because it is a read-only operation.
  4. D
    Only the scaling up of the App Service plan is blocked, while the SQL database can be deleted because the CanNotDelete lock on the resource group is less restrictive than the subscription lock.

Cevap

All three actions are blocked because the ReadOnly lock applied at the subscription level is inherited by all resources, preventing updates, deletions, and credential retrieval.
The correct option is correct because resource locks in Azure are inherited from parent scopes to child resources. Since a ReadOnly lock is applied at the subscription level, all resource groups and resources within that subscription inherit this lock. A ReadOnly lock prevents deleting resources, updating configurations (like scaling up an App Service plan), and performing POST operations such as retrieving publishing credentials or access keys.

Adım Adım Çözüm

1
Determine the effective locks on the resources.
Both the subscription-level ReadOnly lock and the resource group-level CanNotDelete lock apply to the resources inside the resource group due to inheritance.
Azure resource locks are inherited from parent scopes (Subscription -> Resource Group -> Resource) and are additive.
2
Evaluate the permissions of the Owner role against the locks.
The Owner role cannot bypass the locks.
Resource locks apply to all users and roles, regardless of their Azure RBAC permissions.
3
Analyze the impact of the ReadOnly lock on the attempted actions.
Scaling up the App Service plan (update) is blocked, deleting the SQL database (delete) is blocked, and retrieving the publishing profile (POST action) is blocked.
A ReadOnly lock prevents all delete and update operations, and specifically blocks API POST operations that retrieve sensitive keys or credentials.

Anahtar Kavram

Azure Resource Lock inheritance and the restrictions of ReadOnly locks on control plane operations.
Bu soruyu puanla

Konular

Resource Locks

Bu konudan daha fazla soru