AZ-104 Manage Azure Identities and Governance Practice Question
During a change freeze, an administrator applies a lock to a resource group. Users can still read resource details, but attempts to update tags, resize a VM, or change an NSG fail. Which lock was applied?
⚠ Common exam trap
Watch out — candidates often confuse the CanNotDelete lock with blocking updates, when in fact it only prevents deletion, while the ReadOnly lock is the one that blocks all write operations including updates and modifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ReadOnly lock, because it blocks write operations while allowing read access.
The ReadOnly lock (option B) is correct because it explicitly blocks all write operations (including updates to tags, resizing a VM, or modifying an NSG) while allowing read operations. This matches the scenario where users can still read resource details but cannot perform any modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CanNotDelete lock, because it blocks all updates but allows reading.
Why it's wrong here
CanNotDelete lock only prevents deletion of the resource or resource group; it does not block updates, tag modifications, or resizing operations. Because a change freeze must halt all management-plane write activities, a CanNotDelete lock would still allow users to edit tags, change VM sizes, or modify network rules, so it does not match the symptom described.
When this WOULD be correct
A question where users can delete resources but cannot update them, e.g., 'During a freeze, users can still modify tags and resize VMs, but attempts to delete a VM fail. Which lock was applied?'
- ✓
ReadOnly lock, because it blocks write operations while allowing read access.
Why this is correct
ReadOnly is the lock that allows users to view resources but prevents writes, including changes to tags, VM sizes, network rules, and many other configuration actions. This exactly matches the symptom described during a change freeze. It is a strong protection and should be used only when the organization truly wants to halt modifications.
- ✗
Reader role assignment, because it removes edit permissions from the group.
Why it's wrong here
Reader is an RBAC role, not a lock. Although it grants read-only permissions, it would not be something you apply as a lock to a resource group. The symptom specifically points to a management lock.
When this WOULD be correct
This option would be correct if the question described a scenario where users need to view resources but should be prevented from making any changes, and the solution involves assigning the Reader role at the resource group scope.
- ✗
Azure Policy audit assignment, because it reports changes without blocking them.
Why it's wrong here
An Azure Policy assignment with the audit effect merely evaluates and reports resource compliance; it does not deny or block any management-plane operations. Audit policies can generate logs and alerts about changes, but they never prevent tag edits or VM resizing, so they cannot be the cause of the failed write operations described during the change freeze.
When this WOULD be correct
A question asks: 'Which Azure feature should you use to monitor whether resources in a subscription are compliant with tagging standards without enforcing the standards?' In that case, an audit policy assignment would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓ReadOnly lock, because it blocks write operations while allowing read access.Correct answer▾
Why this is correct
ReadOnly is the lock that allows users to view resources but prevents writes, including changes to tags, VM sizes, network rules, and many other configuration actions. This exactly matches the symptom described during a change freeze. It is a strong protection and should be used only when the organization truly wants to halt modifications.
✗CanNotDelete lock, because it blocks all updates but allows reading.Wrong answer — click to see why▾
Why this is wrong here
CanNotDelete lock blocks deletion but allows all other write operations, including updating tags, resizing VMs, and changing NSGs. The question states these updates fail, so a ReadOnly lock is required.
★ When this WOULD be the correct answer
A question where users can delete resources but cannot update them, e.g., 'During a freeze, users can still modify tags and resize VMs, but attempts to delete a VM fail. Which lock was applied?'
Why candidates choose this
Candidates may confuse 'CanNotDelete' with blocking all modifications, or assume that any lock that prevents changes must block deletion as well.
✗Reader role assignment, because it removes edit permissions from the group.Wrong answer — click to see why▾
Why this is wrong here
A Reader role assignment removes edit permissions but also blocks read access to resource details, which contradicts the scenario where users can still read resource details.
★ When this WOULD be the correct answer
This option would be correct if the question described a scenario where users need to view resources but should be prevented from making any changes, and the solution involves assigning the Reader role at the resource group scope.
Why candidates choose this
Candidates may confuse role-based access control (RBAC) with resource locks, thinking that assigning a Reader role is a way to block updates, but they overlook that locks are separate from RBAC and that Reader role still allows reading.
✗Azure Policy audit assignment, because it reports changes without blocking them.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy audit assignment only reports compliance of existing resources without blocking any actions, so it would not prevent updates to tags, VM resizing, or NSG changes.
★ When this WOULD be the correct answer
A question asks: 'Which Azure feature should you use to monitor whether resources in a subscription are compliant with tagging standards without enforcing the standards?' In that case, an audit policy assignment would be correct.
Why candidates choose this
Candidates may confuse Azure Policy's audit effect with actual enforcement, thinking that auditing can block changes, or they may mistakenly believe that any policy assignment can prevent modifications.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID Users and Groups
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.