Question 820 A CanNotDelete lock is applied at subscription level, while a resource has no direct lock. Can the resource still be protected? No, resource locks work only on a single VM Yes, because the resource's public IP becomes private Yes, a higher-scope lock can affect descendants Apply the lock only to a resource tag and assume it protects all subscription descendants Explanation Correct Answer C:Direct resource-level configuration isn't the only applicable lock scope. Incorrect Answers A:Azure management locks support larger scopes. B:Network addressing isn't the mechanism. D:Tags do not create Azure resource locks or their hierarchical management effects.
Question 821 An administrator can upload a blob but cannot delete its Azure storage account resource. What distinction can explain that? Any Blob upload permission guarantees account deletion Grant a user Blob Data Reader and assume it can override the storage account deletion lock A Blob's access tier determines management Owner rights Blob data-plane access and storage-account ARM delete may be governed differently, including by a lock Explanation Correct Answer D:Object operations and account lifecycle actions use different authorization/control paths. Incorrect Answers A:Data and management privileges are separate. B:A data read permission does not remove a management-plane resource lock. C:Data temperature isn't Azure RBAC.
Question 822 An operations team adds a ReadOnly lock for safety and later cannot apply a needed security configuration update. What trade-off is illustrated? A ReadOnly lock is a database transaction isolation setting A lock automatically patches all security settings itself Removing all identity audit logs is required to change settings A restrictive management lock can impede legitimate maintenance until handled through approved change control Explanation Correct Answer D:Safety controls need carefully chosen scope and operating procedures. Incorrect Answers A:ARM lock scope isn't data transaction semantics. B:Locks don't perform updates. C:Audit logs aren't the lock removal process.
Question 823 Two operators have the same Contributor role, but one resource is locked and another isn't. Why do management actions differ? RBAC roles cease to exist when a lock is created The lock is an additional resource-level control beyond RBAC authorization The VM OS version controls every subscription role Assume contributor access always bypasses every management lock Explanation Correct Answer B:Roles permit actions but locks may restrict their execution. Incorrect Answers A:Roles and locks coexist. C:Guest software doesn't grant ARM management rights. D:RBAC management permissions and a resource lock are separate checks; applicable locks can still block an operation.
Question 824 An engineer locks a single resource but believes its entire subscription is now protected against deletion. What should be corrected? A tag named LockScope can protect all other groups A lock applies at its configured scope and inherited descendants, not automatically to every sibling Every resource-level lock automatically becomes subscription-wide An availability set extends locks to all regional VMs Explanation Correct Answer B:Protecting one resource does not lock unrelated siblings. Incorrect Answers A:Tags don't enforce locks. C:That would exceed its assignment. D:Compute placement doesn't propagate management locks.
Question 825 A resource has a CanNotDelete lock, and a team wants to change a non-destructive tag. What general behavior should it expect? Tag changes always remove CanNotDelete automatically Apply a CanNotDelete lock and assume it also prevents every permitted property update CanNotDelete always blocks every tag update identically to ReadOnly CanNotDelete normally permits management updates that don't delete the locked resource Explanation Correct Answer D:The lock is targeted at deletion, not all configuration changes. Incorrect Answers A:Editing metadata doesn't silently delete the lock. B:A delete lock blocks deletion but does not have the full write-deny behavior of a ReadOnly lock. C:These lock types have different restrictions.
Question 826 A service operator can read a locked VM's properties but cannot start or stop it through some management operations. Which lock may be responsible? ReadOnly lock limiting ARM write-like management actions Use a cost budget alert as a substitute for management-operation write restrictions A VM size naming convention An Azure Cost Management budget Explanation Correct Answer A:Some operational commands use management POST or write paths and can be restricted by ReadOnly. Incorrect Answers B:Budget alerts monitor spending thresholds, not direct write attempts against protected resources. C:Size labels don't enforce immutable ARM actions. D:Budget alerts don't usually block VM power operations.
Question 827 A team uses resource locks to stop accidental deletion and assumes that also prevents unauthorized users from reading sensitive data. What separate control is needed? A cost budget named Confidential More CanNotDelete locks as user authentication factors Identity-based access control and data protection permissions A larger Azure VM to prevent reads Explanation Correct Answer C:Locks constrain management changes but don't replace confidentiality controls. Incorrect Answers A:Billing labels don't grant privacy. B:Locks don't log a user into data APIs. D:CPU size doesn't restrict authorization.
Question 828 A team plans to delete an old resource group but a resource inside is under a higher-scope CanNotDelete lock. What should the deletion checklist include? Identify inherited/direct locks and obtain approved changes before deletion Assume group deletion always overrides all child locks Delete the locked dependency without reviewing downstream Azure resource requirements Increase the management VM disk capacity Explanation Correct Answer A:Protected dependencies can block a group-level delete request. Incorrect Answers B:Locks may prevent the group deletion. C:Removing a resource can break services that depend on it; safety requires checking relationships before changing protection. D:Unrelated disk size doesn't authorize deletes.
Question 829 A security lead says CanNotDelete makes a resource invulnerable to all attackers. What limitation should be documented? A lock reduces accidental ARM deletion risk but isn't a universal compromise-prevention control A lock makes malware unable to execute inside VM guests A lock automatically encrypts all network traffic A lock grants global read-only status to every user Explanation Correct Answer A:Identity security, network access and data protection remain essential. Incorrect Answers B:Guest processes are outside the lock's primary scope. C:Management locks aren't transport encryption. D:It doesn't replace access permissions.
Question 830 A compliance team wants to block unapproved resource configurations and accidental deletion. Which combination addresses both requirements? Only Azure Cost Management budgets Treat an Azure Policy audit assignment as exactly equivalent to a CanNotDelete lock Only a tag named Protected Azure Policy for configuration rules and resource locks for management deletion protection Explanation Correct Answer D:Policy and locks have complementary governance functions. Incorrect Answers A:Budgets notify on spend but don't enforce those two controls. B:Policy evaluation and deletion protection are different controls with different triggers and effects. C:Metadata isn't enforceable configuration or delete protection.
