AZ-104 Manage Azure Identities and Governance Practice Question
A production resource group must not be deleted accidentally, but administrators still need to update resources inside it. Which lock should you apply to the resource group?
⚠ Common exam trap
Many exam-takers confuse RBAC roles (like Contributor) with resource locks, mistakenly thinking that assigning a role can prevent deletion, whereas locks are a separate governance mechanism that override role-based permissions for specific operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CanNotDelete lock
The CanNotDelete lock (option B) is correct because it prevents deletion of the resource group while still allowing all other operations, including updates to resources within it. This lock type is specifically designed to protect against accidental deletion without blocking read, write, or modify actions, which aligns perfectly with the requirement that administrators need to update resources inside the group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ReadOnly lock
Why it's wrong here
A ReadOnly lock at resource group scope prevents any PUT, PATCH, or DELETE operations on the group and its resources, so administrators cannot modify configurations, deploy updates, or scale resources. While it does block deletion, it also blocks all write operations, making it impossible to perform routine administrative changes that a production resource group typically requires. This over-restrictive approach makes ReadOnly lock inappropriate here because deletion protection alone does not justify freezing every management operation.
- ✓
CanNotDelete lock
Why this is correct
A CanNotDelete lock blocks delete operations on the resource group and all contained resources while allowing normal read and update activities, making it the right control to prevent accidental deletion. It is enforced by Azure Resource Manager after RBAC authorization, so even users with delete permissions (such as Owner) will be denied the delete operation as long as the lock is present. Since the question concerns only accidental deletion, this lock provides the exact protection without affecting ongoing administration.
- ✗
Contributor role
Why it's wrong here
The Contributor role is an RBAC permission that grants a user the ability to create, update, and delete resources, meaning a Contributor is authorized to delete the resource group itself. Assigning a role does not add a protective barrier; it only expands who has control, so it cannot stop accidental deletion by anyone with that role. The scenario requires a denial-based control at the resource scope, not an authorization assignment that increases who can perform the destructive action.
- ✗
Azure Policy deny assignment
Why it's wrong here
Azure Policy is designed to enforce compliance rules on resource configurations, such as allowed regions or tags, and a deny assignment from policy typically targets properties of resource types rather than lifecycle actions like deleting a resource group. Although a custom policy with a 'Microsoft.Authorization' effect could be crafted to deny the delete action, it requires defining a policy assignment and a deny assignment, which is an overly complex and indirect solution. The standard, purpose-built mechanism for guarding a single resource group against deletion is a resource lock, not policy.
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.