A production resource group must not be deleted accidentally, but administrators still need to update resources inside it. Which lock should you apply to the resource group?

ReadOnly lock

ReadOnly would prevent normal updates and make administration harder than necessary.

Contributor role

Contributor is an access role, not a protection control that prevents accidental deletion.

Azure Policy deny assignment

A deny assignment is not the standard tool for simply preventing deletion of a resource group.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: CanNotDelete lock — CanNotDelete is the correct lock because it prevents accidental deletion while still allowing normal management operations such as configuration changes and updates. That matches the requirement for production resources that must stay protected but remain manageable. In Azure, this is the common choice when deletion is the risk but routine administration must continue. Why others are wrong: ReadOnly is too restrictive because it also blocks many update operations. Contributor is only an RBAC role and does not protect against deletion. Policy deny assignment is not the standard administrative answer for this simple protection requirement and is more complex than needed.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.