Exam AZ-500 topic 1 question 21 discussion

Correct answer is B and D, When you will create a virtual machine in ResGroup2 it will give you error "The selected resource group is read only"

B and D for sure. When you create a new VM and select a read-only resource group you get a "The selected resource group is read only"

Statement B is true: The Read-only lock on VirMac1 prevents it from being started.​ Statement D's validity depends on the specific configuration of the Allowed resource types policy in ResGroup2. If virtual machines are not permitted by the policy, then Statement D is true; otherwise, it is false.

A read-only lock on a resource group that contains a virtual machine prevents all users from starting or restarting a virtual machine. These operations require a POST method request

Answer should be BD. if a resource group has a read-only lock, you won’t be able to start a virtual machine (VM) that is in a Stopped (Deallocated) state. A read-only lock prevents any changes to the resources within the resource group, including starting or stopping VMs.

B and C A Read only lock on RG doesn't prevent to create new resources

B - You cannot start Mac1 because starting a VM involves a POST request, which will not be done while the resource is Read-only D - for the same reason.

Read-only lock on a resource prevents all write operations, including changing the state of the VM (such as starting or stopping it)

For virtual machine Virmac1 we have read only lock which will not allow to start stop delete it so the answer for the VirMac1 will be B . For the resource group - ResGroup2 we also have same Read only which basically will not allow to do anyything else besides current config then answer for this will be D. Correct answer will be here BD but keep in mind that question says Read Only lock there can be also CanNotDelete lock as well in the other question then we can start machine for example but can not delete machine. Please refer this link for more information but here answer is BD. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

You will be able to start VirMac1. TRUE: Read-only locks don't affect starting a virtual machine; they only prevent modifications or deletions. You will NOT be able to start VirMac1. NOT TRUE: Read-only locks don't restrict starting a virtual machine; they only prevent modifications or deletions. You will be able to create a virtual machine in ResGroup2. TRUE: The policy for ResGroup2 allows virtual machine creation, and read-only locks only prevent modifications, not creations. You will NOT be able to create a virtual machine in ResGroup2. NOT TRUE: The policy for ResGroup2 permits virtual machine creation, and read-only locks only prevent modifications, not creations. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#considerations-before-applying-your-locks

Correct answer is B and D, When you will create a virtual machine in ResGroup2 it will give you error "The selected resource group is read only"

Azure Policy focuses on pre-deployment compliance, while Resource Locks safeguard resources post-deployment against accidental changes. Given a scenario where VM is allowed policy and resource lock both are working on RG level then according to pre deployment compliance you are able to create a VM in that RG but according to post deployment protection through resource lock you wont be able to make any write activity( restarting or changing disk etc ) on existing VM in that RG.

i can't understand what is the relation here between the azure policy and azure locks ?!!! cause the question indicate two different things !

I just tested in the lab and BD are the correct answers. B: You can't start the VM that has read only lock, you will be getting this error: Failed to start virtual machine 'WinServer1'. Error: The scope 'WinServer1' cannot perform write operation because following scope(s) are locked: '/subscriptions/be739432-1223-4cbf-bc85-1287e4269fe6/resourceGroups/TestLAB/providers/Microsoft.Compute/virtualMachines/WinServer1'. Please remove the lock and try again. D: Setting the resource group to read only will prevent you from creating virtual machines. You will get an error that the resource group is read only.

B: A read-only lock on a resource group that contains a virtual machine prevents all users from starting or restarting a virtual machine. These operations require a POST method request D: A read-only lock on a resource group prevents users from moving any new resource into that resource group. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#considerations-before-applying-your-locks

Mistyped, I can't remove or change my comments I will go with BD

I will go with BC