Hotspot Question You have an Azure subscription that contains a resource group named RG1. You need to prevent administrators from inadvertently modifying the resources in RG1. How should you…

Question

Exhibit

Answer Area

• PowerShell CommandNew-AzResourceLock
  Lock-AzRmStorageContainerImmutabilityPolicyNew-AzResourceLockSet-AzResourceSet-AzAppConfigurationLock
• Lock LevelReadOnly
  CanNotDeleteFalseDeleteResourcesReadOnly

Explanation

This question tests knowledge of Azure Resource Locks using PowerShell to prevent accidental modification of resources in a resource group. The correct approach uses the New-AzResourceLock cmdlet with a ReadOnly or CanNotDelete lock level applied to RG1.

Approach. To prevent administrators from inadvertently modifying resources in RG1, you should use the PowerShell cmdlet 'New-AzResourceLock' with the '-LockLevel' parameter set to 'ReadOnly' and '-LockName' set to a descriptive name, targeting the resource group using '-ResourceGroupName RG1'. A ReadOnly lock prevents any modifications (create, update, delete) to the resources, while a CanNotDelete lock only prevents deletion but still allows modifications. The full command would look like: New-AzResourceLock -LockName 'RG1Lock' -LockLevel ReadOnly -ResourceGroupName 'RG1'. This ensures administrators cannot accidentally modify resources while still being able to read them.

Concept tested. Azure Resource Locks using PowerShell - specifically the New-AzResourceLock cmdlet with appropriate LockLevel (ReadOnly vs CanNotDelete) applied at the resource group scope to prevent inadvertent modifications.

Reference. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

No community discussion yet for this question.