During a change freeze, administrators must prevent deletion of a production resource group and all resources inside it, but they still need to update VM sizes and tags. Which lock should be applied?

ReadOnly on the resource group

ReadOnly blocks write operations, so it would also prevent the VM size and tag changes that must remain allowed.

CanNotDelete on the management group

That would protect far more than the single production resource group and could affect unrelated subscriptions.

An Azure Policy deny assignment

Policy can enforce rules, but this question specifically asks for a lock that prevents deletion while allowing writes.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: CanNotDelete on the resource group — A CanNotDelete lock at the resource group scope prevents deletion of the resource group and its contents, but it still allows normal write operations. That means admins can resize virtual machines, update tags, or make other configuration changes during the freeze without risking accidental removal of the production environment. It is the standard choice when deletion prevention is required but operational changes must continue. Why others are wrong: ReadOnly is too restrictive because it blocks updates, not just deletions. A lock at management group scope would be much broader than the single resource group and could disrupt unrelated workloads. Azure Policy is useful for compliance, but the requirement here is specifically about deletion protection, which is exactly what CanNotDelete provides.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.