A finance department shares a resource group containing a critical VM and a storage account. Administrators must still be able to update settings and apply patches, but no one should accidentally delete the resources. Which lock should be applied at the resource group level?

ReadOnly lock, because it is the most restrictive option.

ReadOnly would block normal updates and patching, which the business still needs to perform.

A policy assignment that denies delete operations.

Policy can enforce compliance rules, but a lock is the more direct tool for protecting resources from accidental deletion.

No lock, because RBAC permissions already prevent deletion.

RBAC alone does not reliably prevent mistakes if a user has the correct permissions, so a lock is still needed.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: CanNotDelete lock. — CanNotDelete is the correct lock because it blocks deletion while leaving other management operations available. That means administrators can still patch the VM, update configurations, and manage the storage account without being forced into a read-only state. This is a common protection for shared or critical resources where accidental deletion would be damaging but routine operations must continue. Why others are wrong: ReadOnly is too restrictive because it blocks writes, including the updates and patching the scenario explicitly requires. A policy assignment can enforce delete-related standards, but resource locks are the native control for accidental deletion protection. RBAC permissions do not act as a safety brake once someone has sufficient rights, so relying on permissions alone is not enough.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.