Hotspot Question You have an Azure subscription that contains the virtual machines shown in the following table. You create the Azure policies shown in the following table. You create the resource…

This question tests understanding of how Azure Policies and Resource Locks interact with virtual machines across different resource groups and subscriptions. The key is understanding policy scope/enforcement, lock inheritance, and what actions each lock type (ReadOnly vs…

Submitted by thandi_sa· Mar 6, 2026Develop a security and compliance plan

Question

Hotspot Question You have an Azure subscription that contains the virtual machines shown in the following table. You create the Azure policies shown in the following table. You create the resource locks shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

Answer Area

You can start VM1.
You can start VM2.
You can create a virtual machine in RG2.

Explanation

Approach. Azure Resource Locks (ReadOnly and CanNotDelete) are inherited by child resources from parent resource groups or subscriptions. A ReadOnly lock prevents any modifications including start/stop/restart of VMs and changing configurations, while CanNotDelete only prevents deletion but allows modifications. Azure Policies with 'Deny' effect block non-compliant resource creation or modification at the assigned scope (subscription or resource group level). When evaluating each statement, check: (1) which lock applies to the VM's resource group or parent scope, (2) whether the lock type restricts the attempted action, and (3) whether any Deny policy at the relevant scope would block the action. ReadOnly locks on a resource group prevent stopping/starting VMs because those are write operations, while CanNotDelete locks allow start/stop but prevent deletion. Policies assigned at the subscription level apply to all resource groups unless excluded.

Concept tested. Azure Resource Locks (ReadOnly vs CanNotDelete) and Azure Policy enforcement - understanding scope inheritance, lock behavior on virtual machine operations, and how Deny policies interact with resource management actions across resource groups and subscriptions.

Reference. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources and https://learn.microsoft.com/en-us/azure/governance/policy/overview

Topics

#Azure Policy#resource locks#policy evaluation#VM management

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice