A production resource group must be protected from accidental deletion during a change freeze. Administrators still need to update VM sizes, rotate tags, and change NSG rules. Which two actions should the administrator take? Select two.

Apply a ReadOnly lock to the resource group.

ReadOnly blocks write operations such as resizing VMs, changing tags, and editing NSGs. That would break the stated operational requirement.

Use Azure Policy to deny all delete requests.

Azure Policy is for configuration compliance and can govern create or update behavior, but it is not the right mechanism for deletion protection in this scenario.

Add a Protected=true tag and use it to prevent deletion.

Tags are useful for classification and cost tracking, but they do not enforce any security or change-prevention behavior by themselves.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Apply a CanNotDelete lock to the resource group. — The correct configuration is a CanNotDelete lock on the resource group. That lock blocks deletion of the group and its contents while still allowing changes such as resizing virtual machines, updating tags, and editing network rules. Applying the lock at the resource group scope protects every current and future resource in the group, which is ideal during a change freeze. Why others are wrong: A ReadOnly lock would over-restrict the environment and stop the required updates. Azure Policy is not the normal control for preventing deletions, and tags do not enforce behavior. Locking individual resources is also weaker operationally than protecting the whole resource group.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.