Exam AZ-500 topic 3 question 56 discussion

D: Azure Blueprint Reference: "How blueprint locks work" https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking

Sounds like an Azure Resource Manager (ARM) Template makes the most sense in this case. It allows for the consistency needed for the locks without manually creating locks each time for each of the standard development environments. Also, since they're all standard development environments, they will most likely be the same for each team.

The correct answer is: D. an Azure blueprint Azure Blueprints are designed specifically to help you orchestrate the deployment of various Azure resources and configurations in a repeatable, consistent, and governed manner. This includes: Resource locks (e.g., CanNotDelete, ReadOnly) Role assignments Policy assignments ARM templates Why the others are not ideal for this scenario: A. Azure policy Azure Policy is excellent for enforcing rules (like tagging, allowed SKUs, regions) but does not create or enforce resource locks directly. B. Azure Resource Manager template ARM templates can deploy resources and locks, but do not enforce governance or standardization across multiple environments the way Blueprints do. C. Management group A management group helps organize and apply policies at scale, but does not create or enforce resource locks directly.

Azure Blueprints are designed to help you set up and enforce a repeatable set of resources and policies that are applied consistently across multiple environments. Blueprints can include Azure Policy, Resource Manager templates, Role-Based Access Control (RBAC) assignments, and resource locks. In this case, the requirement is to enforce resource locks consistently across development environments. Azure Blueprints can include the configuration of resource locks, ensuring that the locks are consistently applied every time a new environment is deployed for each team.

i would go with "A". ARM and blue print provides the options, but when it comes to enforcement it is "policy". Policy with ARM or blue print. Consider if someone created resources without using available ARM or bluprint option.

Today Azure Resource Manager (ARM) Template is the best choice to achieve this https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

112. Azure Blueprint has the ability to create a standard and replicable ENVIRONMENT, including resources, policies, Locks, role assignments, and other configurations. The doubt that may arise is regarding the use of Azure Police, which in theory would have the same properties. To help you decide which one to use, just remember that Azure Police works at the subscription level, resource group, or individual resources, more globally. Azure Blueprint is aimed at a specific environment, such as a DEV environment, which can be replicated to another DEV team. So when the issue involves standardizing consistent environments, the ideal is to choose the use of Azure Blueprint.

D. an Azure blueprint Most Voted

I would go for D (blueprints). "You plan to create a standard development environment that will be deployed for each team." so you will probably use blueprint. Using blueprints resource locks in that case is great because "you can protect newly deployed resources from being tampered with, even by an account with the Owner role". https://learn.microsoft.com/en-us/azure/governance/blueprints/tutorials/protect-new-resources But if you use another deployment method for environment, or if developers have to create resources which will need to have enforced resources locks, then you will need to use azure policies, as blueprint resource locks only applies on New resources deployed by the blueprint https://learn.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking.

Correct Answer: D

D is the answer. https://learn.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking The creation of consistent environments at scale is only truly valuable if there's a mechanism to maintain that consistency. This article explains how resource locking works in Azure Blueprints.

D is the answer. https://learn.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking The creation of consistent environments at scale is only truly valuable if there's a mechanism to maintain that consistency. This article explains how resource locking works in Azure Blueprints.

D. an Azure blueprint

AI: To enforce resource locks across the development environments and ensure that the locks are applied in a consistent manner, I would recommend using an Azure Policy. Azure Policy allows you to enforce organizational standards and ensure compliance with corporate governance policies. You can use Azure Policy to define and enforce resource locks for all resources within a specified scope. Resource locks can help prevent accidental deletion or modification of critical resources. Using Azure Policy, you can define a policy that enforces resource locks for all resources within a subscription, resource group, or individual resource. The policy can be assigned to a management group, which will ensure that it is applied consistently across all development environments.

Both ARM template and blueprint can deploy locks on the resouces. However, when they do not enforces the "lock", they just deploys it.. So i guess A..?

I agree with sadako : Blueprint

Vote for B - Azure Resource Manager. Reference: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?source=recommendations&tabs=json I think the 'consistent manner' is the key here. ARM has lock inheritance function: When you apply a lock at a parent scope, all resources within that scope inherit the same lock. Even resources you add later inherit the same parent lock. The most restrictive lock in the inheritance takes precedence.