CanNotDelete Lock — Prevent Accidental Deletion While Allowing Updates

• A.Apply no lock and rely on RBAC alone.
• B.Apply a ReadOnly lock to RG-Prod.
• ✓ C.Apply a CanNotDelete lock to RG-Prod.
• D.Apply a Contributor role assignment to RG-Prod.

Why C: Option C is correct because applying a CanNotDelete lock to RG-Prod prevents the resource group from being deleted while still allowing administrators to update settings on resources inside it. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to prevent accidental deletion without restricting management changes.

• A.Apply a ReadOnly lock to the resource group.
• ✓ B.Apply a CanNotDelete lock to the resource group.
• C.Assign the Reader role to all operators.
• D.Assign an Azure Policy deny assignment at the subscription.

Why B: The CanNotDelete lock (Option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM settings, changing tags, and updating network rules. This lock type is specifically designed to protect against accidental deletion during a change freeze without blocking management operations.

• ✓ A.Apply a CanNotDelete lock to the resource group.
• B.Apply a ReadOnly lock to the resource group.
• ✓ C.Place the CanNotDelete lock at the resource group scope so it covers current and future resources.
• D.Use Azure Policy to deny all delete requests.
• E.Add a Protected=true tag and use it to prevent deletion.

Why A: Option A is correct because applying a CanNotDelete lock to the resource group prevents the entire resource group from being deleted, while still allowing administrators to update VM sizes, rotate tags, and modify NSG rules. This lock type blocks delete operations but permits all read and write operations, aligning with the requirement to protect against accidental deletion during a change freeze while maintaining administrative flexibility.

• A.A ReadOnly lock
• ✓ B.A CanNotDelete lock
• C.A deny assignment
• D.A budget alert

Why B: A CanNotDelete lock (B) prevents the resource group from being deleted while still allowing all operations (including updates) on resources within it. This is the correct choice because the requirement is to block accidental deletion of the entire resource group, not to restrict modifications to its resources.

• A.ReadOnly
• ✓ B.CanNotDelete
• C.Delete lock
• D.No lock and a budget alert

Why B: The CanNotDelete lock prevents the resource group from being deleted while still allowing all operations (including create and modify) on resources within it. This is the correct choice because the requirement is specifically to block deletion, not to restrict modifications or read access.

• ✓ A.A CanNotDelete lock
• B.A ReadOnly lock
• C.An Azure Policy deny assignment
• D.A budget alert

Why A: A CanNotDelete lock (Azure resource lock) prevents accidental deletion of the virtual network while allowing all other operations, including updates to subnet settings. This lock type blocks DELETE requests at the Azure Resource Manager level, but permits PUT and PATCH operations, so administrators can still modify subnet configurations.

• A.ReadOnly lock
• ✓ B.CanNotDelete lock
• C.Contributor role
• D.Azure Policy deny assignment

Why B: The CanNotDelete lock (option B) is correct because it prevents deletion of the resource group while still allowing all other operations, including updates to resources within it. This lock type is specifically designed to protect against accidental deletion without blocking read, write, or modify actions, which aligns perfectly with the requirement that administrators need to update resources inside the group.

• A.ReadOnly
• ✓ B.CanNotDelete
• C.Contributor
• D.Azure Policy

Why B: The CanNotDelete lock prevents any user or process from deleting the resource group or its resources, while still allowing all other operations including read, write, and configuration changes such as resizing VMs. This matches the requirement that administrators must be able to change settings and resize VMs but must not accidentally delete any resource.