Based on the exhibit, which lock should the administrator apply to protect the resource group from accidental deletion while still allowing normal updates to the resources inside it?

Apply a ReadOnly lock to rg-payroll-prod.

ReadOnly would block writes and many administrative changes, which conflicts with the need to keep updating and operating the resources.

Apply a tag named Protected=True to rg-payroll-prod.

Tags help with organization and reporting, but they do not enforce deletion protection or any access restriction.

Create an Azure Policy assignment that denies all delete operations.

Policy can enforce rules, but the requirement specifically calls for protecting a resource group from deletion, which is the lock use case.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Apply a CanNotDelete lock to rg-payroll-prod. — A CanNotDelete lock is the right choice because it prevents accidental deletion of the resource group while leaving the resources inside it manageable. Administrators can still perform operational tasks such as starting and stopping VMs, scaling services, and changing configuration. That makes it a better fit than ReadOnly, which would interfere with normal maintenance and updates. Why others are wrong: A ReadOnly lock would also block write operations, making day-to-day administration difficult or impossible. A tag is only metadata and provides no protection. Azure Policy can deny delete operations in some scenarios, but the question is asking for the standard protection feature that prevents the resource group from being removed while preserving normal management activities.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.