A production storage account must remain available for updates, but administrators want to prevent accidental deletion during maintenance windows. Which lock should be applied to the storage account?

ReadOnly lock at the storage account scope.

ReadOnly blocks write operations as well as deletion, which would interfere with normal administration and planned changes.

CanNotDelete lock at the subscription scope.

Subscription scope would protect far more resources than requested and could block deletion of unrelated test or temporary resources.

Azure Policy deny assignment on all storage account operations.

Policy can enforce configuration rules, but the scenario is specifically about preventing deletion of one resource with a lock, not about broad policy compliance.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: CanNotDelete lock at the storage account scope. — CanNotDelete is the right lock because it protects the storage account from deletion while still allowing administrators to modify settings and perform normal operational tasks. Applying the lock at the storage account scope keeps the impact narrow and avoids restricting unrelated resources. This is a common protection pattern for important production assets that should not be removed accidentally. Why others are wrong: ReadOnly is too restrictive because it blocks changes that the team still needs to make. Subscription-level locking is broader than necessary and can interfere with other work. Azure Policy is useful for compliance, but this scenario calls for the deletion protection behavior of a resource lock.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.