Exam AZ-500 topic 4 question 47 discussion

Question 1 is Blueprints Question 2: Azure blueprint locking won't affect existing resources, RG1 already exists A resource lock will either make RG1 read only or prevent deletion, not just stopping permission changes, not the best solution. The only good answer is RBAC role assignment at the RG level.

Azure blueprint with locks for sure is the answer to 2nd part. I think the whole question is derived from this article - https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking#overriding-locking-states It's typically possible for someone with appropriate Azure role-based access control (Azure RBAC) on the subscription, such as the 'Owner' role, to be allowed to alter or delete any resource. This access isn't the case when Azure Blueprints applies locking as part of a deployed assignment. If the assignment was set with the Read Only or Do Not Delete option, not even the subscription owner can perform the blocked action on the protected resource. This security measure protects the consistency of the defined blueprint and the environment it was designed to create from accidental or programmatic deletion or alteration.

#2 must be "Azure Blueprint assignments in locking mode" because "A resource lock" won't fly, there's only "read-only-lock" or "cannot-delete-lock" but no "cannot-modify-permissions-lock" An RBAC role assignment also won't help because there you can't create DENY permissions. Everybody who has a role that can modify permissions on the subscription can modify permissions on resource groups in it. The only way to achieve the result, prevent modification of permissions with whatever means but not block anything else, is Azure Blueprints in locking mode.

Answer: A Explanation: Reference: https://docs.microsoft.com/en-us/azure/governance/policy/overview https://4sysops.com/archives/apply-gov ernance-policy-to-multiple-azure-subscriptions-with-management-groups/

Question 1: Blueprints. Question 2: - RBAC is not the solution: it doesn't have Deny assignments, and we need to have the Owners of RG1 deployed, so we cannot just remove all owners.. - If it is a typo issue and the meaning is "not change the permissions INTO RG1", I would go with blueprint locks. - But if not a typo issue and as RG1 already exists and blueprint resource locks only affects New resources, I would go with resource lock on RG1 instead. This is the only solution, but not ideal as it will block any modification in and within (inheritance) RG1, not only permissions. if it's a typo issue and means "

1. Azure Blueprints 2. A Resource lock

Anyone who has bothered to test will know that #2 is a resource lock

blueprint wouldn't help, since the resources already exist. So the only possible option for two is "Resource Lock" https://learn.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking#overriding-locking-states

Tested in LAB. 1- Blueprints 2- Resource lock

Key word here is PERFENT if we use RBAC, then we can change the permissions, we need to use Blueprint, with blueprint even the owner can't change the permissions Answer: 1- Blueprint 2- Azure Blueprint assignment in locking mode

Tested in Lab. Unable to make changes in the RBAC of the resource groups after applying resource lock. So for the 2nd question Resource lock is right option.

https://learn.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking B is - locking mode ''Azure Blueprints applies locking as part of a deployed assignment'

The answer for Ques.2 should be Azure Blueprint assignment in locking mode at management level, so that even the owner won't be able to remove resource or the lock.

Question 1 is correct but question 2 is wrong. Owner with RBAC role can modify, therefore answer to question 2 is wrong. To override owner permission Resource lock should be the answer. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

## In Exam 12/10/2021

TESTED! Question1 - Blueprints Question2 - Resource Locks

i will go with Resource Lock in the second box because Resource locks deployed by Azure Blueprints are only applied to non-extension resources deployed by the blueprint assignment. Existing resources, such as those in resource groups that already exist, don't have locks added to them. Ref https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking