Resource locks (delete, read-only) in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Effect of Delete Lock on Resource Deletion

You have applied a Delete lock on an Azure Storage Account. What happens if you try to delete this storage account?

A The resource is deleted but all its data is retained for 30 days automatically.

B The deletion proceeds normally without any warnings or errors.

C The deletion is blocked and an error is returned preventing the resource from being deleted.

D The deletion is allowed but a notification email is sent to the subscription owner.

💡 Hint

Think about what a Delete lock is designed to prevent.

A Delete lock prevents the resource from being deleted. Any attempt to delete the resource will fail with an error, protecting it from accidental deletion.

❓ service_behavior

intermediate

Effect of Read-Only Lock on Resource Modification

You apply a Read-Only lock on an Azure Virtual Machine. Which of the following actions will be blocked?

A Only deleting the VM will be blocked; starting and stopping are allowed.

B Modifying the VM's configuration or deleting it will be blocked, but starting and stopping are allowed.

C No actions are blocked; the lock only prevents reading the VM's properties.

D Starting, stopping, or deleting the VM will be blocked.

💡 Hint

Consider what Read-Only lock means for resource changes.

A Read-Only lock prevents any modifications or deletions of the resource. However, operations like starting or stopping the VM, which do not change the resource's configuration, are allowed.

❓ Architecture

advanced

Best Practice for Protecting Critical Resources

You manage a production Azure environment with critical resources. Which lock strategy is best to prevent accidental deletion but still allow necessary updates?

A Apply a <strong>Delete</strong> lock on critical resources to block deletion but allow updates.

B Apply a <strong>Read-Only</strong> lock on critical resources to block all changes including updates.

C Do not apply any locks; rely on role-based access control (RBAC) only.

D Apply both <strong>Delete</strong> and <strong>Read-Only</strong> locks on all resources.

💡 Hint

Think about allowing updates but preventing deletion.

A Delete lock prevents accidental deletion but allows updates and modifications. A Read-Only lock blocks all changes, which may be too restrictive for production resources that need updates.

❓ security

advanced

Impact of Locks on Role-Based Access Control (RBAC)

If a user has Owner role on a resource but a Read-Only lock is applied, what is the effective permission for that user?

A The user can read the resource but cannot modify or delete it due to the lock.

B The user can delete the resource but cannot modify it.

C The user cannot access the resource at all because the lock overrides RBAC.

D The user can perform all Owner actions ignoring the lock.

💡 Hint

Consider how locks and RBAC permissions interact.

Resource locks apply on top of RBAC permissions. Even if a user has Owner role, a Read-Only lock prevents modifications and deletions, effectively limiting the user's actions.

🧠 Conceptual

expert

Lock Scope and Inheritance Behavior

You apply a Delete lock at the resource group level. Which statement is true about the lock's effect on resources inside that group?

A The lock applies only to resources tagged with a specific tag matching the resource group.

B The lock only applies to the resource group itself, not to individual resources inside it.

C The lock applies only to new resources created after the lock was applied.

D The lock applies to all resources within the resource group, preventing their deletion unless the lock is removed.

💡 Hint

Think about how locks propagate in Azure hierarchy.

Locks applied at a parent scope like a resource group inherit down to all child resources, preventing deletion of any resource inside until the lock is removed.

Practice

1. What does a CanNotDelete resource lock do in Azure?

easy

A. Allows all actions without restrictions

B. Prevents all changes including reading the resource

C. Allows deletion but prevents modifications

D. Prevents deletion but allows modifications to the resource

Solution

1. Step 1: Understand the purpose of CanNotDelete lock

   The CanNotDelete lock is designed to stop accidental deletion of a resource but still allows changes to it.

2. Step 2: Compare with other lock types

   Unlike ReadOnly, which blocks all changes, CanNotDelete only blocks deletion but permits modifications.

3. Final Answer:

   Prevents deletion but allows modifications to the resource -> Option D

4. Quick Check:

   CanNotDelete = Prevent deletion, allow changes [OK]

Hint: CanNotDelete stops delete, ReadOnly stops all changes [OK]

Common Mistakes:

• Confusing CanNotDelete with ReadOnly lock
• Thinking CanNotDelete blocks all changes
• Assuming CanNotDelete allows deletion

2. Which of the following is the correct JSON snippet to create a ReadOnly lock on a resource in Azure?

easy

A. { "lockLevel": "ReadOnly", "notes": "Block all changes" }

B. { "level": "CanNotDelete", "notes": "Prevent deletion" }

C. { "level": "ReadOnly", "notes": "Block all changes" }

D. { "lock": "ReadOnly", "notes": "Block all changes" }

Solution

1. Step 1: Identify the correct property name for lock level

   The correct property to specify the lock type is "level" with values like "ReadOnly" or "CanNotDelete".

2. Step 2: Match the correct JSON structure

   { "level": "ReadOnly", "notes": "Block all changes" } uses "level": "ReadOnly" which is the correct syntax to create a ReadOnly lock.

3. Final Answer:

   { "level": "ReadOnly", "notes": "Block all changes" } -> Option C

4. Quick Check:

   Lock level property = "level" with value "ReadOnly" [OK]

Hint: Use "level": "ReadOnly" to set read-only lock [OK]

Common Mistakes:

• Using incorrect property names like lockLevel or lock
• Confusing CanNotDelete with ReadOnly in JSON
• Missing quotes around property names or values

3. If a resource has a ReadOnly lock applied, what will happen when you try to update its configuration via Azure Portal?

medium

A. The update will fail with a permission error

B. The update will be queued for later processing

C. The update will succeed but deletion will be blocked

D. The update will succeed without any restrictions

Solution

1. Step 1: Understand ReadOnly lock behavior

   A ReadOnly lock blocks all changes to the resource, including updates, but allows reading.

2. Step 2: Predict the outcome of an update attempt

   Trying to update a resource with ReadOnly lock will cause a permission error and the update will fail.

3. Final Answer:

   The update will fail with a permission error -> Option A

4. Quick Check:

   ReadOnly lock blocks updates = update fails [OK]

Hint: ReadOnly blocks all changes, so updates fail [OK]

Common Mistakes:

• Assuming updates succeed with ReadOnly lock
• Confusing ReadOnly with CanNotDelete lock
• Thinking updates are queued instead of blocked

4. You applied a CanNotDelete lock on a storage account but still accidentally deleted it. What is the most likely reason?

medium

A. The lock was applied at the resource group level, not the storage account

B. The lock was not saved or applied correctly

C. The lock was applied as ReadOnly instead of CanNotDelete

D. The user had Owner role which bypasses locks

Solution

1. Step 1: Understand CanNotDelete lock effect

   CanNotDelete lock prevents deletion of the resource it is applied to.

2. Step 2: Analyze why deletion still happened

   If deletion occurred, the lock was likely not applied or saved correctly on the storage account.

3. Final Answer:

   The lock was not saved or applied correctly -> Option B

4. Quick Check:

   Lock must be properly applied to prevent deletion [OK]

Hint: Ensure lock is saved and applied on correct resource [OK]

Common Mistakes:

• Assuming Owner role bypasses locks (it does not)
• Confusing lock scope levels
• Thinking ReadOnly lock prevents deletion

5. You want to protect a critical Azure VM from accidental deletion but allow configuration changes. You also want to prevent any changes to a storage account except reading. How should you apply resource locks?

hard

A. Apply CanNotDelete lock on VM and ReadOnly lock on storage account

B. Apply ReadOnly lock on VM and CanNotDelete lock on storage account

C. Apply CanNotDelete lock on both VM and storage account

D. Apply ReadOnly lock on both VM and storage account

Solution

1. Step 1: Determine lock for VM to prevent deletion but allow changes

   Use CanNotDelete lock on VM to block deletion but allow configuration changes.

2. Step 2: Determine lock for storage account to block all changes except reading

   Use ReadOnly lock on storage account to block all changes but allow reading.

3. Final Answer:

   Apply CanNotDelete lock on VM and ReadOnly lock on storage account -> Option A

4. Quick Check:

   CanNotDelete = block delete, ReadOnly = block all changes [OK]

Hint: Use CanNotDelete for delete protection, ReadOnly for full lock [OK]

Common Mistakes:

• Swapping lock types between resources
• Using ReadOnly lock where changes are needed
• Applying same lock to both resources without need