Module 5bb - Identity, Governance, Privacy and Compliance - Build a Cloud Governance Strategy, Resource Locks, Tags

Question 1

What is a Resource Lock?

Answer 1

It’s a mechanism used to prevent the accidental deletion or manipulation of a Resource

Question 2

Where do you manage Resource Locks

Answer 2

You can manage locks from the usual places: Azure Portal, Powershell, Azure CLI (az.exe) or from an ARM Template

In Azure Portal, go to any details page for a resource and click on Settings

Question 3

What are the three (3) levels can you apply Locks to?

Answer 3

Subscription, Resource Group or an individual Resource

Question 4

What two (2) types of Locks can be applied?

Answer 4

CanNotDelete - authorized can read and modify but cannot delete without removing the lock first

ReadOnly - authorized can only read, no modify, no delete. Equivalent to restricting everyone to “Reader” Role in RBAC

Question 5

What’s the process for changing or deleting a locked Resource

Answer 5

1. Remove the lock
2. Do whatever your account has permission to do

The extra step helps to keep your Resource secure even from Administrator actions

Question 6

Resource Locks adhere to RBAC permissions, so if you are the designated Owner of a Resource, you can override any Lock on that Resource (T/F)?

Answer 6

False! Locks apply to everyone even if you are the Owner!

Question 7

When locking a Resource Group, you prevent the Resource Group from being deleted, but not any of its contained Resources (T/F)?

Answer 7

False. Locking a Resource Group is transitive to all its internal Resources

Question 8

What are Tags?

Answer 8

Tags allow you to easily add Metadata to your Resources.

Question 9

What scenarios make Tags useful?

Answer 9

Organizing Resources by Tags make them much easier to manage and filter should you need to:

• Group Resources that may or may not be within the same Resource Group, to associate them to specific business needs, workflows, etc.
• Cost Reporting
• Group by SLA
• Group by security level classification (Azure Gov)
• Group by specific Governance or Regulatory Compliance requirements

Question 10

How can you manage/apply/remove Resource Tags?

Answer 10

The usual! Azure Portal, Azure CLI, Azure PowerShell, ARM Templates or REST API

Question 11

When applying a Tag to a Resource Group, it applies to ALL Resources within that Resource Group (similar to Locking) (T/F)?

Answer 11

False. Tags do NOT auto-apply to child Resources by default. This is opposite of Resource Group locking, where the lock applies to all child Resources…