Exam AZ-104 topic 5 question 49 discussion

Correct Answer: Box 1: IP1, VNET2, and storage1 Box 2: IP2, VNET2, and storage2 Locks are designed for any update or removal. In this case we want to move only, we are not deleting, and we are not changing anything in the resource.

Don't see a table with IP1, storage1 and VNET1. To test anyway, I created storage2, VNET2 and IP2 in RG1. Then I applied the locks as stated in the tables. I was able to move all resources from RG1 to RG2. After that I could also move all resources from RG2 back to RG1. So based on the current information, I go for answer: IP1, VNET2, and storage1 IP2, VNET2, and storage2

Is it me, or is there no storage1 in RG1? Question states, below are the resources in RG1. No storage1 is mentioned. Only storage2. So how can 'ip1 and storage1 only' be true when the resource doesn't exist in RG1?

The answer is: Box 1: IP1, VNET2 and storage 1 Box 2: None Its based on where the lock is. See this from Microsoft: A read-only lock on a resource group prevents you from moving existing resources in or out of the resource group. But note that a resource with read-only lock can be moved to another resource group.

WRONG IP1, VNET2, and storage1 IP2, VNET2, and storage2

Moving a resource only moves it to a new resource group or subscription. It doesn't change the location of the resource. Note You can't move Azure resources to another resource group or another subscription if there's a read-only lock, whether in the source or in the destination. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription

ET Admin After paying 65dollars, it is frustrating to see questions like this one and many more and many incorrect answers.Kindly request you to update the contents in the AZ-104 to the best possible accuracy or make it a free access so that I don't need raise any concerns

If you look closely, you can see that the READ ONLY lock is applied to VNET1 and VNET2, not to RG1 or RG2, which should not prevent you moving the VNETs to another RG.

Box 2: IP2 and storage2 only A read-only lock on a resource group prevents you from moving existing resources in or out of the resource group. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#:~:text=A%20read%2Donly%20lock%20on%20a%20resource%20group%20prevents%20you%20from%20moving%20existing%20resources%20in%20or%20out%20of%20the%20resource%20group.

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json A read-only lock on a resource group prevents you from moving existing resources in or out of the resource group.

Box 1: IP1, VNET2, and storage1 Box 2: IP2, VNET2, and storage2

"A read-only lock on a resource group prevents you from moving existing resources in or out of the resource group." https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

A similar question was on my exam, but there was also a virtual machine in RG1. However, you should be able to move all resources to both resource groups.

I love how there are two comments next to each other, one month apart, saying that they tested it and then one says you can move everything, the other says you can move nothing. One of them is lying. From what i'm reading in https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json quote: A read-only lock on a resource group that contains a virtual machine prevents users from moving the VM out of the resource group. A read-only lock on a resource group prevents users from moving any new resource into that resource group. This implies that if the read-only lock is set up at RG level, the RG becomes read-only and no resources can be moved in or out. The question is a mess, because it says RG1, then gives a table with <...>2 resources. and misses the table completely with <..>1 resources. (1/2)

Read-Only only impacts services if you try to move/update/create something INSIDE them. Therefore if a RG have a Read-Only lock, you can't move somethin inside it, otherwise you CAN. Resource lock on VNET, IP or SG doesn't affect it when trying to moving them from on RG to another since we don't change the content. Based on first table(where both RG doesn't have Read-Only locks), we can move any resource from RG1 to RG2 and vice versa.

I have just tested in lab same scenario, all 3 resources were moved to the RG2 from RG1. Even though the documentation says that you cannot modify a resource with a lock "read-only" which is my understanding meaning that you cannot move the resource as well. All resources can be moved both ways. So mlantonis is right as always.

Oct 9, 2023 : This question is missing some information but I'll try to give some pointers. 1) I created a new RG test1 and test2. Added Read only lock to RG test1 and Delete lock to test2. 2) Created StorageAccts in both RGs. SG1 in RG test1 and SG2 in RG Test2. I tried to move the SG1, from RG1 to RG2 => Operation Failed Then tried to move SG2, from RG2 to RG1 => Operation Failed. As long as locks are enabled, we cannot move any resources. Hope this helps.