A shared resource group contains a VM and a storage account used by payroll. Administrators still need to modify configuration and apply patches, but accidental deletion of either resource must be prevented. What should the administrator apply?

A ReadOnly lock on the entire resource group.

ReadOnly would block normal updates and patching, which conflicts with the requirement to continue making changes.

A policy assignment that denies delete operations on the resource group.

Azure Policy is not the right control for simple deletion protection when a lock is available and more direct.

A management group with a deny assignment.

Management groups organize subscriptions and governance, but they are not the most precise control for protecting two resources in one group.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A CanNotDelete lock on each resource. — CanNotDelete is the correct lock when administrators must continue to update resources but should not be able to remove them accidentally. Applying the lock to each specific resource provides the required protection without affecting unrelated items in the same resource group. A ReadOnly lock would be too disruptive because it blocks write operations, including patching and configuration changes. This is a classic change-control requirement where deletion protection is needed without freezing management. Why others are wrong: ReadOnly is too restrictive because it prevents legitimate administrative updates. Policy can enforce rules, but for simple delete protection a lock is the direct and operationally cleaner control. Management groups are for subscription-level organization and inherited governance, not for shielding a couple of resources from deletion. The scenario asks for the least disruptive method, which is exactly what CanNotDelete provides.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.