AZ-104 Manage Azure Identities and Governance Practice Question
A production storage account must remain available for updates, but administrators want to prevent accidental deletion during maintenance windows. Which lock should be applied to the storage account?
⚠ Common exam trap
Many exam-takers confuse the ReadOnly lock with preventing deletion, but ReadOnly also blocks updates, which fails the requirement; they may also incorrectly assume a subscription-scoped lock is necessary for a single resource, ignoring the principle of least privilege.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CanNotDelete lock at the storage account scope.
The CanNotDelete lock at the storage account scope prevents the storage account from being deleted while still allowing all read and update operations. This meets the requirement of keeping the storage account available for updates while preventing accidental deletion during maintenance windows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ReadOnly lock at the storage account scope.
Why it's wrong here
A ReadOnly lock on the storage account itself blocks all write operations, not just deletion, so administrators cannot apply configuration updates, change the SKU, update network rules, or modify tags. Worse, this lock also prevents listing the storage account access keys, which effectively blocks all data plane read/write operations in production, causing application outages. Since the requirement explicitly states the account must remain available for updates, a read-only lock is too restrictive and violates the availability goal.
When this WOULD be correct
If the question asked for a lock that prevents any modifications (including updates) to a resource, such as securing a configuration storage account from accidental changes during maintenance, a ReadOnly lock at the storage account scope would be correct.
- ✓
CanNotDelete lock at the storage account scope.
Why this is correct
CanNotDelete is the correct lock because it prevents deletion while still allowing typical configuration updates. That matches the requirement to protect the storage account from accidental removal without freezing all management operations. Applying it directly at the resource scope keeps the protection targeted to the specific storage account.
- ✗
CanNotDelete lock at the subscription scope.
Why it's wrong here
A CanNotDelete lock applied at the subscription scope is overly broad and would prevent deletion of every resource and resource group within the subscription, not just the production storage account. This creates an operational hazard because legitimate cleanup of unrelated test resources or temporary infrastructure would be blocked. Additionally, managing a subscription-scoped lock requires elevated permissions and affects all future resources, far exceeding the requirement to protect a single storage account. The correct protection is targeted to the resource scope.
When this WOULD be correct
This option would be correct if the question asked for a lock that prevents deletion of all resources in a subscription during a maintenance window, or if the requirement was to protect an entire resource group or subscription from accidental deletion.
- ✗
Azure Policy deny assignment on all storage account operations.
Why it's wrong here
An Azure Policy deny assignment that targets all Microsoft.Storage/storageAccounts operations would reject every management action, including read operations and updates, making the resource unmanageable and unusable. Policy is a governance mechanism designed to enforce compliance standards at scale across many resources, not to provide a targeted operational safeguard for a single resource. It would also affect all current and future storage accounts in the scope, creating broad unintended consequences. Resource locks are the correct service for deletion protection without blocking legitimate writes.
When this WOULD be correct
A question where the requirement is to prevent all storage account operations (including updates) across multiple subscriptions or enforce organizational compliance rules, not just prevent deletion of a specific resource.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓CanNotDelete lock at the storage account scope.Correct answer▾
Why this is correct
CanNotDelete is the correct lock because it prevents deletion while still allowing typical configuration updates. That matches the requirement to protect the storage account from accidental removal without freezing all management operations. Applying it directly at the resource scope keeps the protection targeted to the specific storage account.
✗ReadOnly lock at the storage account scope.Wrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents any updates to the storage account, but the question requires the account to remain available for updates. Thus, it does not meet the requirement of allowing updates while preventing deletion.
★ When this WOULD be the correct answer
If the question asked for a lock that prevents any modifications (including updates) to a resource, such as securing a configuration storage account from accidental changes during maintenance, a ReadOnly lock at the storage account scope would be correct.
Why candidates choose this
Candidates may confuse 'prevent accidental deletion' with 'prevent all changes,' and ReadOnly locks are a common solution for protecting resources from unintended modifications.
✗CanNotDelete lock at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
A CanNotDelete lock at the subscription scope would prevent deletion of all resources in the subscription, not just the storage account, and is overly broad for the requirement of preventing accidental deletion of a specific storage account during maintenance.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a lock that prevents deletion of all resources in a subscription during a maintenance window, or if the requirement was to protect an entire resource group or subscription from accidental deletion.
Why candidates choose this
Candidates may think applying a lock at a higher scope (subscription) is more effective or simpler, not realizing it affects all resources and may conflict with other administrative tasks.
✗Azure Policy deny assignment on all storage account operations.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy deny assignments block operations based on policy rules, but they do not prevent accidental deletion specifically; they are for enforcing compliance across resources, not for protecting a single resource from deletion during maintenance.
★ When this WOULD be the correct answer
A question where the requirement is to prevent all storage account operations (including updates) across multiple subscriptions or enforce organizational compliance rules, not just prevent deletion of a specific resource.
Why candidates choose this
Candidates may think a policy-based deny is a stronger lock, but they overlook that the question specifically asks for preventing accidental deletion while allowing updates, which is exactly what CanNotDelete does.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.