Examkin

Soru

Zorluk: ZorResource Locks

An Azure subscription named Sub-Corp has a CanNotDelete resource lock applied. Within Sub-Corp, there is a resource group named RG-Data that has a ReadOnly resource lock applied. RG-Data contains a storage account named sa-logs and a virtual network named vnet-prod. An administrator with Owner permissions on the subscription attempts to perform various tasks. Which of the following actions are blocked by the resource locks? Select two.

  1. Retrieving the access keys for the storage account sa-logsCevap
  2. Deleting the virtual network vnet-prodCevap
  3. C
    Uploading a new blob to a container inside the storage account sa-logs
  4. D
    Modifying the tags of a resource group named RG-App that is located outside RG-Data but inside Sub-Corp

Cevap

The actions that are blocked by the resource locks are retrieving the access keys for the storage account sa-logs, and deleting the virtual network vnet-prod.
The correct options are the ones stating that retrieving the access keys for the storage account sa-logs and deleting the virtual network vnet-prod are blocked. Retrieving the access keys is a control plane POST request, which is blocked by the ReadOnly lock on the resource group. Deleting the virtual network is blocked because it is located inside the resource group with the ReadOnly lock and inherits the CanNotDelete lock from the subscription.

Adım Adım Çözüm

1
Analyze the scope and type of the resource locks applied.
The subscription has a CanNotDelete lock (prevents deletion, allows modification). The resource group RG-Data has a ReadOnly lock (prevents modification and deletion).
Understanding lock types is necessary to evaluate which operations are blocked at each scope.
2
Determine the lock status inherited by each resource.
Resources in RG-Data (sa-logs and vnet-prod) inherit the ReadOnly lock. Resources outside RG-Data but inside Sub-Corp (like RG-App) only inherit the CanNotDelete lock.
Resource locks are inherited by child resources, so their effective lock level depends on where they are in the hierarchy.
3
Evaluate the attempted actions against control plane and data plane rules.
Retrieving storage keys is a control plane POST operation, which is blocked by the ReadOnly lock. Deleting the virtual network is blocked by both locks. Modifying tags on RG-App is allowed because CanNotDelete does not block edits. Uploading a blob is a data plane operation and is not blocked by resource locks.
This step distinguishes between management operations and data operations, as well as the specific limitations of each lock type.

Anahtar Kavram

Azure Resource Locks prevent accidental deletion or modification of resources. They are inherited from parent scopes (subscriptions, resource groups) to child resources. CanNotDelete prevents deletion but allows updates, while ReadOnly prevents both deletion and updates (including control plane POST requests like listing storage keys), but does not affect data plane operations.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Resource Locks

Bu konudan daha fazla soru