A production resource group contains application VMs and databases. Operators must be able to update resources inside the group, but nobody should be able to delete the whole group by accident. Finance also wants ownership data to remain with the resources if they are moved to another resource group. Which two actions should you take? Select two.

Apply a ReadOnly lock to the resource group.

ReadOnly blocks write operations as well as deletions, which would interfere with the operators' need to manage the resources normally.

Move the resource group to a management group.

Management groups organize subscriptions, not resource groups. They do not solve deletion protection or preserve chargeback labels on resources.

Grant Resource Policy Contributor to the operators.

This role is about managing policy assignments, not protecting a resource group from deletion or preserving ownership information.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Apply a CanNotDelete lock to the resource group. — A CanNotDelete lock protects the resource group from accidental deletion while still allowing updates to the resources inside it. Tags are the right tool for ownership and chargeback metadata because they remain attached to the resources if those resources are moved. Together, these controls address protection and organization without blocking day-to-day administration. Why others are wrong: A ReadOnly lock would break normal operations because it blocks writes, not just deletes. Management groups are for subscription-level organization, not resource-group protection. RBAC roles manage permissions, but they do not preserve ownership metadata or create a delete safeguard.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.