AZ-104 Manage Azure Identities and Governance Practice Question
A storage account named stfinance01 contains critical data. Administrators must still be able to read and modify the data, but no one should be able to delete the storage account accidentally. What should you configure?
⚠ Common exam trap
Many exam-takers confuse resource locks with role-based access control (RBAC) or network security groups, thinking a ReadOnly lock or NSG rule can prevent accidental deletion, but only a CanNotDelete lock directly blocks delete operations at the resource level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A CanNotDelete lock on stfinance01.
A CanNotDelete lock on stfinance01 prevents the storage account from being deleted while still allowing administrators to read and modify data. This lock type blocks delete operations at the resource level, but does not restrict read or write access, which is exactly what the requirement specifies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A CanNotDelete lock on stfinance01.
Why this is correct
A CanNotDelete lock on the storage account scope blocks all Azure Resource Manager Delete calls against stfinance01 from any principal, even an Owner, until the lock is explicitly removed. This preserves the resource while leaving the control-plane and data-plane APIs open for permitted write updates, making it the right balance for critical data. The lock must be removed before deletion can succeed, creating an intentional two-step safeguard.
- ✗
A ReadOnly lock on stfinance01.
Why it's wrong here
A ReadOnly lock prevents all management-plane write operations, including deleting stfinance01, but it also blocks critical updates such as changing the account's configuration and even listing account keys, which would break applications relying on data-plane access. It is a valid protection only for immutable resources; for a live storage account it is too restrictive and could cause application outages.
When this WOULD be correct
A ReadOnly lock would be correct if the requirement was to prevent any changes to the storage account or its data, while still allowing read access, such as for a compliance or audit scenario where data must remain immutable.
- ✗
A policy assignment that audits storage accounts.
Why it's wrong here
An Azure Policy assignment using the Audit effect evaluates storage account configuration against policy and reports non-compliance in Azure Policy and Activity Log, but it never interrupts or denies the delete operation itself. It is post-event governance, not an access-control guard. Only a Deny effect or an explicit RBAC denial/lock can prevent deletion.
- ✗
An NSG rule denying outbound traffic from the subnet.
Why it's wrong here
An NSG rule denying outbound traffic on the subnet operates at layer 3/4 and filters IP packets between resources, but it has no effect on Azure Resource Manager control-plane delete operations. Deleting stfinance01 is an HTTPS API call issued by a management client or the portal, not dependent on the storage account's own outbound traffic. It also doesn't address incoming delete authorizations.
When this WOULD be correct
A scenario where you need to restrict a storage account from initiating outbound connections to the internet (e.g., to prevent data exfiltration or enforce a network isolation policy). The question would specify blocking outbound traffic from the subnet hosting the storage account.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A CanNotDelete lock on stfinance01.Correct answer▾
Why this is correct
A CanNotDelete lock on the storage account scope blocks all Azure Resource Manager Delete calls against stfinance01 from any principal, even an Owner, until the lock is explicitly removed. This preserves the resource while leaving the control-plane and data-plane APIs open for permitted write updates, making it the right balance for critical data. The lock must be removed before deletion can succeed, creating an intentional two-step safeguard.
✗A ReadOnly lock on stfinance01.Wrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents all modifications, including reading and modifying data, which contradicts the requirement that administrators must still be able to read and modify data.
★ When this WOULD be the correct answer
A ReadOnly lock would be correct if the requirement was to prevent any changes to the storage account or its data, while still allowing read access, such as for a compliance or audit scenario where data must remain immutable.
Why candidates choose this
Candidates may confuse the purpose of locks, thinking a ReadOnly lock only prevents deletion, or they may not fully understand that it also blocks write operations.
✗An NSG rule denying outbound traffic from the subnet.Wrong answer — click to see why▾
Why this is wrong here
An NSG rule controls network traffic, not deletion prevention. The question is about preventing accidental deletion of a storage account, which is a management-plane operation, not a data-plane network issue.
★ When this WOULD be the correct answer
A scenario where you need to restrict a storage account from initiating outbound connections to the internet (e.g., to prevent data exfiltration or enforce a network isolation policy). The question would specify blocking outbound traffic from the subnet hosting the storage account.
Why candidates choose this
Candidates may confuse network security controls with resource management controls, or think that blocking all outbound traffic could somehow prevent deletion, which is incorrect.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.