AZ-104 Implement and Manage Storage Practice Question
A storage account must stay online for applications, but administrators have a temporary freeze on configuration changes. Users can still view the account, but attempts to change the access tier, create a container, or update networking all fail. What most likely caused the behavior?
⚠ Common exam trap
Many candidates confuse CanNotDelete locks with ReadOnly locks, mistakenly thinking that a deletion-prevention lock also blocks modifications, when in fact only ReadOnly locks block all write operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A ReadOnly lock was applied to the storage account.
A ReadOnly lock (Azure Resource Manager lock) prevents any modification to the storage account, including changing the access tier, creating containers, or updating networking settings, while still allowing read operations like viewing the account. This matches the described behavior exactly because the lock is applied at the resource scope and blocks all write/delete operations, but does not affect read access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A CanNotDelete lock was applied to the storage account.
Why it's wrong here
A CanNotDelete lock on a storage account prevents only delete operations at the locked scope. It does not restrict modifying account properties, networking rules, or child resources, so normal configuration changes and writes would still succeed. The described symptom of write operations failing while read access remains is inconsistent with this lock, making it incorrect.
When this WOULD be correct
A CanNotDelete lock would be correct if the question stated that administrators cannot delete the storage account or its resource group, but all other operations (including configuration changes) are allowed. For example: 'Users can modify settings and add containers, but attempts to delete the storage account fail.'
- ✓
A ReadOnly lock was applied to the storage account.
Why this is correct
ReadOnly is the correct explanation because it blocks write operations on the locked scope. That includes changing account settings, creating child resources such as containers, and modifying networking configuration. Read-only access still allows users to view the resource, which matches the symptom described in the scenario. This lock is useful when all configuration changes must be paused.
- ✗
An Azure Policy audit assignment was applied to the storage account.
Why it's wrong here
An Azure Policy audit assignment uses the 'Audit' effect, which checks resources against policy rules and logs non-compliance in the Activity Log without in any way blocking or denying the attempted operation. When an administrator changes a storage account setting under this policy, the action is allowed and simply recorded as non-compliant. Therefore audit policies never produce authorization failures or read-only symptoms, so this is not the cause.
When this WOULD be correct
An Azure Policy audit assignment would be correct if the question asked about a scenario where administrators need to track non-compliant changes without preventing them, such as monitoring storage accounts that use blob access tiers other than 'Cool'.
- ✗
The account was moved to a different subscription.
Why it's wrong here
Moving a storage account to a different subscription changes its ARM resource path and transfers management planning, but it does not lock down configuration or block writes. The move operation requires validation and should preserve role assignments, keys, and existing settings; after completion the account remains fully writable. Applications also continue to access the account using its existing endpoints and keys, so a subscription move does not explain write-blocked access.
When this WOULD be correct
If a question states that a storage account is inaccessible or cannot be found after a subscription change, and the account name is still visible in the old subscription, then moving to a different subscription could be the cause due to subscription-level permissions or resource relocation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A ReadOnly lock was applied to the storage account.Correct answer▾
Why this is correct
ReadOnly is the correct explanation because it blocks write operations on the locked scope. That includes changing account settings, creating child resources such as containers, and modifying networking configuration. Read-only access still allows users to view the resource, which matches the symptom described in the scenario. This lock is useful when all configuration changes must be paused.
✗A CanNotDelete lock was applied to the storage account.Wrong answer — click to see why▾
Why this is wrong here
A CanNotDelete lock prevents deletion of the resource but does not block configuration changes like changing the access tier or creating containers. The question describes read-only behavior, which is not caused by a CanNotDelete lock.
★ When this WOULD be the correct answer
A CanNotDelete lock would be correct if the question stated that administrators cannot delete the storage account or its resource group, but all other operations (including configuration changes) are allowed. For example: 'Users can modify settings and add containers, but attempts to delete the storage account fail.'
Why candidates choose this
Candidates may confuse CanNotDelete with ReadOnly, thinking that any lock prevents modifications. They might not realize that CanNotDelete only blocks deletion, not updates or creations.
✗An Azure Policy audit assignment was applied to the storage account.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy audit assignments only evaluate and report compliance; they do not block configuration changes. The question describes operations failing, which requires an enforcement mechanism like a lock or deny policy.
★ When this WOULD be the correct answer
An Azure Policy audit assignment would be correct if the question asked about a scenario where administrators need to track non-compliant changes without preventing them, such as monitoring storage accounts that use blob access tiers other than 'Cool'.
Why candidates choose this
Candidates may confuse audit policies with deny policies, assuming that any policy assignment can block operations, or they may overestimate the enforcement capabilities of audit-only policies.
✗The account was moved to a different subscription.Wrong answer — click to see why▾
Why this is wrong here
Moving a storage account to a different subscription does not cause configuration changes to fail; it only changes the subscription context. Users can still modify settings after the move.
★ When this WOULD be the correct answer
If a question states that a storage account is inaccessible or cannot be found after a subscription change, and the account name is still visible in the old subscription, then moving to a different subscription could be the cause due to subscription-level permissions or resource relocation.
Why candidates choose this
Candidates may think that moving a subscription imposes restrictions on the resource, confusing subscription-level changes with resource-level locks or policies.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Container
A container is a lightweight, standalone software package that includes everything needed to run an application, such as code, runtime, system tools, and libraries.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.