Question 810 A team wants to prevent accidental deletion of a production resource but still permit supported configuration updates. Which Azure resource lock fits? CanNotDelete lock ReadOnly lock as a perfect equivalent for all changes A Cost Management budget An Azure tag named Protected Explanation Correct Answer A:CanNotDelete blocks management-plane deletion while allowing other operations as permitted. Incorrect Answers B:ReadOnly is broader and can block management updates. C:Spend monitoring doesn't protect ARM deletion. D:Tags cannot stop deletion.
Question 811 An auditor wants a resource's ARM configuration frozen against both modification and deletion. Which Azure resource lock is more restrictive? Use an Azure RBAC Reader assignment as though it made all resources immutable ReadOnly lock An Environment=Prod tag CanNotDelete lock alone Explanation Correct Answer B:A read-only lock restricts management-plane writes, including delete operations. Incorrect Answers A:Reader grants access limitations to that principal; a ReadOnly lock constrains management operations more broadly. C:A tag is not write protection. D:It may permit updates, so it isn't an update freeze.
Question 812 A resource-group-level CanNotDelete lock protects several child resources. Why might a child resource deletion fail? Apply a lock only to one VM and assume every resource-group sibling inherits it Resource locks can be inherited by resources under the locked scope Azure storage redundancy performs the lock Every resource has its own independent global password copied from the group Explanation Correct Answer B:Locks apply at resource, group or subscription scope and affect descendants. Incorrect Answers A:Inheritance follows actual lock scope, not all peers of an individually locked resource. C:Replica placement is unrelated to ARM management locks. D:Locks aren't user credentials.
Question 813 A platform administrator places a ReadOnly lock on a subscription for a compliance freeze. What operational risk should they anticipate? The lock increases subscription billing currency precision Supported management write operations on descendant resources may be blocked Assume a management-plane lock can never affect a service's operational automation All resources will be immediately scaled to zero Explanation Correct Answer B:A high-scope ReadOnly lock can disrupt normal deployment and configuration workflows. Incorrect Answers A:Billing doesn't follow lock scope. C:ReadOnly locks can block management API operations that a dependent workflow needs to perform. D:A lock isn't an autoscaling command.
Question 814 An Azure subscription Owner tries to delete a resource with a CanNotDelete lock and receives an error. What explains the result? A VM guest administrator is the only person allowed to remove ARM locks Azure resource locks can block management actions despite the user's broad RBAC role Owner identity means the delete should always ignore every lock A resource tag contains an invalid password Explanation Correct Answer B:Owner permission doesn't silently bypass an applicable lock. Incorrect Answers A:Guest OS admin is not Azure management authorization. C:Locks are separate control planes. D:Tags aren't what blocks this delete.
Question 815 An operator needs to remove a resource lock during approved maintenance. What authorization principle matters? The Blob access tier of the locked resource Knowledge of the VM guest OS password alone Appropriate management permissions to modify or delete the lock at its scope Use resource data-plane access alone to remove a management lock Explanation Correct Answer C:Locks can be managed by authorized principals through Azure management operations. Incorrect Answers A:Data tier doesn't authorize management operations. B:Guest credentials don't grant resource lock administration. D:Managing Azure locks requires appropriate control-plane authorization, not merely reading service data.
Question 816 A storage account has a CanNotDelete lock, and the team assumes it can recover any overwritten blob. What is missing? A VM scale-set image can restore the storage blobs automatically More resource locks always recreate older data bytes Blob versioning, retention or backup controls for data recovery Deleting the resource group and recreating it restores the content Explanation Correct Answer C:A resource lock doesn't preserve historical versions of each stored object. Incorrect Answers A:VM images aren't object recovery points. B:Management locks are not backups. D:Deletion can worsen data loss.
Question 817 A storage account has a ReadOnly ARM resource lock, and operations expects it to prevent every data-plane blob operation in all circumstances. What should they verify? All Blob data-plane writes are always denied solely by a CanNotDelete lock A resource lock automatically enables immutable retention policies on blobs The lock's management-plane scope versus storage data-plane behavior All resource locks are passwords for object APIs Explanation Correct Answer C:ARM locks generally govern management operations and aren't universal object-level access controls. Incorrect Answers A:A lock isn't a complete Blob authorization or immutability solution. B:Data retention requires separate features. D:Locks aren't data-plane credentials.
Question 818 A team sets a ReadOnly lock on an App Service resource and then deployment automation fails to change application settings. What should it investigate? The backup region-pair name The App Service plan's storage access tier The application hostname's number of dots The lock's impact on management-plane updates used by the deployment Explanation Correct Answer D:ReadOnly can block supported app configuration write operations. Incorrect Answers A:Regional placement isn't the deployment lock. B:Web hosting plan isn't a Blob tier. C:DNS spelling isn't what blocks ARM settings.
Question 819 An automation deletes unused resource groups nightly, and one group contains a CanNotDelete lock. What should engineers expect? The lock makes deletion complete faster The cleanup script automatically receives global admin rights The resources are converted to archived blobs The locked resource or group can block the cleanup deletion until the lock is managed appropriately Explanation Correct Answer D:Cleanup automation must handle protected resources and approved exceptions. Incorrect Answers A:A lock is intended to restrict deletes. B:Automation permissions remain separate. C:Locking doesn't change resource type.
Question 820 A CanNotDelete lock is applied at subscription level, while a resource has no direct lock. Can the resource still be protected? No, resource locks work only on a single VM Yes, because the resource's public IP becomes private Yes, a higher-scope lock can affect descendants Apply the lock only to a resource tag and assume it protects all subscription descendants Explanation Correct Answer C:Direct resource-level configuration isn't the only applicable lock scope. Incorrect Answers A:Azure management locks support larger scopes. B:Network addressing isn't the mechanism. D:Tags do not create Azure resource locks or their hierarchical management effects.
