AZ-104 Manage Azure Identities and Governance Practice Question
A change-freeze requires that no one can modify the settings of a subscription's resource group for six hours. Deletion is not the main concern; the priority is to block changes to existing resources during the freeze. Which lock should you apply?
⚠ Common exam trap
Candidates often confuse Azure RBAC roles (like Reader) with resource locks, as both can restrict changes but locks are applied at the resource scope and override all permissions, while RBAC roles are identity-based and can be bypassed by privileged users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ReadOnly
The ReadOnly lock prevents any modification to existing resources, including configuration changes, while still allowing read operations. This directly satisfies the change-freeze requirement to block changes for six hours, as it denies all write operations at the resource group scope.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CanNotDelete
Why it's wrong here
The CanNotDelete lock only prevents the deletion of a resource, but it still allows modifications, including changes to configuration, settings, and management operations. Because the requirement explicitly prohibits modifying settings, CanNotDelete is insufficient—users could still alter the resource's configuration. To fully freeze changes, the lock must also block update operations, which only the ReadOnly lock accomplishes.
When this WOULD be correct
A question where the primary concern is preventing accidental deletion of resources, but modifications are allowed. For example: 'You need to ensure that a critical resource group cannot be deleted, but administrators can still update resource configurations.'
- ✓
ReadOnly
Why this is correct
The ReadOnly lock is the correct choice because it blocks all write operations against a resource, including create, update, and delete actions, while allowing reads. This effectively enforces a change freeze by preventing any configuration modification through the management plane, regardless of the user's role, because locks are evaluated above RBAC. Even an Owner cannot modify resources until the lock is removed, making it the strongest way to guarantee a freeze.
- ✗
Reader
Why it's wrong here
Reader is a built-in RBAC role that grants read-only permission to users, but it is not a resource lock and does not affect other users' abilities. Any user with a higher privilege, such as Contributor or Owner, can still modify the resource, so assigning the Reader role to one user doesn't prevent changes. Moreover, a lock applies universally to all principals, whereas an RBAC role only controls access for specific identities; thus, Reader cannot enforce a change freeze.
When this WOULD be correct
A question asks: 'You need to allow a support team to view resource configurations but prevent them from making any changes. Which built-in role should you assign?' Here, Reader is correct because it grants read-only access without blocking administrators.
- ✗
DeployIfNotExists
Why it's wrong here
DeployIfNotExists is an Azure Policy effect used for remediation—when a resource doesn't match a policy, the effect triggers deployment of a corrective resource. It does not prevent or block changes; instead, it can initiate changes to bring resources into compliance. Since a change freeze requires blocking all modifications, this policy effect cannot enforce it and is conceptually unrelated to resource locks.
When this WOULD be correct
A question asks: 'You need to automatically deploy a network security group to any new subnet that does not have one. Which policy effect should you use?' In that scenario, DeployIfNotExists would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓ReadOnlyCorrect answer▾
Why this is correct
The ReadOnly lock is the correct choice because it blocks all write operations against a resource, including create, update, and delete actions, while allowing reads. This effectively enforces a change freeze by preventing any configuration modification through the management plane, regardless of the user's role, because locks are evaluated above RBAC. Even an Owner cannot modify resources until the lock is removed, making it the strongest way to guarantee a freeze.
✗CanNotDeleteWrong answer — click to see why▾
Why this is wrong here
The CanNotDelete lock prevents deletion but still allows modifications to existing resources, which does not satisfy the requirement to block all changes during the freeze.
★ When this WOULD be the correct answer
A question where the primary concern is preventing accidental deletion of resources, but modifications are allowed. For example: 'You need to ensure that a critical resource group cannot be deleted, but administrators can still update resource configurations.'
Why candidates choose this
Candidates may assume that 'change-freeze' implies preventing deletion, but they overlook that modifications are also a form of change that must be blocked.
✗ReaderWrong answer — click to see why▾
Why this is wrong here
The Reader role allows viewing resources but does not block modifications; it only prevents changes by users without contributor/owner permissions, not by administrators or automated processes. The question requires blocking all changes, which ReadOnly lock provides.
★ When this WOULD be the correct answer
A question asks: 'You need to allow a support team to view resource configurations but prevent them from making any changes. Which built-in role should you assign?' Here, Reader is correct because it grants read-only access without blocking administrators.
Why candidates choose this
Candidates confuse the Reader role (a role-based access control) with the ReadOnly lock (a resource lock), thinking 'Reader' implies read-only access that blocks changes, but it does not prevent changes by users with higher permissions.
✗DeployIfNotExistsWrong answer — click to see why▾
Why this is wrong here
DeployIfNotExists is a policy effect, not a lock. It triggers a remediation task to deploy a resource if one doesn't exist, but it does not block changes to existing resources, which is the requirement here.
★ When this WOULD be the correct answer
A question asks: 'You need to automatically deploy a network security group to any new subnet that does not have one. Which policy effect should you use?' In that scenario, DeployIfNotExists would be correct.
Why candidates choose this
Candidates may confuse policy effects with resource locks, or think that 'DeployIfNotExists' implies a protective action that prevents changes, when it actually only deploys missing resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.