AZ-104 Manage Azure Identities and Governance Practice Question
A production resource group contains VMs, public IP addresses, and a storage account. During a migration window, administrators must still be able to change settings and resize VMs, but nobody should accidentally delete any resource. Which lock should you apply to the resource group?
⚠ Common exam trap
Test-takers frequently confuse Azure Policy with resource locks, thinking Policy can prevent deletion, when in fact only a CanNotDelete lock (or a custom policy with a deny effect on delete) blocks delete operations, and Policy alone does not provide that protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CanNotDelete
The CanNotDelete lock prevents any user or process from deleting the resource group or its resources, while still allowing all other operations including read, write, and configuration changes such as resizing VMs. This matches the requirement that administrators must be able to change settings and resize VMs but must not accidentally delete any resource.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ReadOnly
Why it's wrong here
ReadOnly is a lock type in Azure that blocks all write operations, including updates, resizing, and any configuration changes, though it does prevent deletion. For a production resource group where you still need to modify VMs and adjust public IP settings, ReadOnly is overly restrictive. This lock would disrupt normal management and thus cannot fulfill the requirement to allow configuration changes.
When this WOULD be correct
A scenario where administrators need to prevent any modifications or deletions to resources, such as a critical production environment where even configuration changes must be blocked during an audit or compliance period.
- ✓
CanNotDelete
Why this is correct
CanNotDelete is a resource lock in Azure that prevents accidental deletion while still permitting read, update, and resizing operations. This lock operates at the management plane, blocking only the delete action on the VM, public IP, or resource group, so configuration changes remain possible. It is the correct choice because it selectively guards against deletion without freezing the resource's writable state.
- ✗
Contributor
Why it's wrong here
Contributor is an Azure RBAC role that grants full management access to resources, including the ability to delete them. Unlike a resource lock, it does not impose any deletion protection; in fact, a user with Contributor permissions can delete the VM or public IP. Therefore, choosing Contributor fails to safeguard resources from accidental removal.
When this WOULD be correct
A question asks which RBAC role to assign to a user who needs to manage all resources in a resource group but cannot grant access to others. Contributor would be correct.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that audits or enforces rules about resource properties, such as allowed locations, tagging, or SKUs, but it is not a deletion lock. Policies can trigger remediation or compliance actions but do not directly block delete operations against a specific VM or public IP. Therefore, Azure Policy cannot provide the same accidental-deletion protection as CanNotDelete.
When this WOULD be correct
When the question asks for a mechanism to enforce tagging rules or ensure all resources in a resource group have a specific configuration (e.g., require encryption), Azure Policy would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓CanNotDeleteCorrect answer▾
Why this is correct
CanNotDelete is a resource lock in Azure that prevents accidental deletion while still permitting read, update, and resizing operations. This lock operates at the management plane, blocking only the delete action on the VM, public IP, or resource group, so configuration changes remain possible. It is the correct choice because it selectively guards against deletion without freezing the resource's writable state.
✗ReadOnlyWrong answer — click to see why▾
Why this is wrong here
ReadOnly lock prevents all changes, including resizing VMs and changing settings, which contradicts the requirement that administrators must still be able to modify resources.
★ When this WOULD be the correct answer
A scenario where administrators need to prevent any modifications or deletions to resources, such as a critical production environment where even configuration changes must be blocked during an audit or compliance period.
Why candidates choose this
Candidates may confuse 'prevent deletion' with 'prevent changes' and think ReadOnly is a stronger form of protection, overlooking that it also blocks legitimate modifications.
✗ContributorWrong answer — click to see why▾
Why this is wrong here
Contributor is an Azure RBAC role, not a lock. It allows full management access, including deletion, so it does not prevent accidental deletion.
★ When this WOULD be the correct answer
A question asks which RBAC role to assign to a user who needs to manage all resources in a resource group but cannot grant access to others. Contributor would be correct.
Why candidates choose this
Candidates confuse RBAC roles with resource locks, thinking Contributor restricts deletion because it sounds less permissive than Owner.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce organizational standards and assess compliance, not to prevent accidental deletion of resources. It does not provide a lock that blocks delete operations.
★ When this WOULD be the correct answer
When the question asks for a mechanism to enforce tagging rules or ensure all resources in a resource group have a specific configuration (e.g., require encryption), Azure Policy would be the correct answer.
Why candidates choose this
Candidates may confuse Azure Policy's ability to enforce rules with the operational lock functionality, thinking it can prevent deletions as a compliance rule.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.