AZ-104 Manage Azure Identities and Governance Practice Question
During a change freeze, the operations team wants to prevent accidental deletion of a production resource group and everything in it. They still need to update VM settings, change tags, and modify network rules. Which lock should be applied?
⚠ Common exam trap
A common mix-up: candidates confuse ReadOnly locks with CanNotDelete locks, assuming that any lock will block all changes, but the key distinction is that ReadOnly locks block all write operations (including updates), whereas CanNotDelete locks only block deletion, allowing the required modifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a CanNotDelete lock to the resource group.
The CanNotDelete lock (Option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM settings, changing tags, and updating network rules. This lock type is specifically designed to protect against accidental deletion during a change freeze without blocking management operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a ReadOnly lock to the resource group.
Why it's wrong here
A ReadOnly lock at the resource group scope blocks all write and delete operations, including virtual machine configuration changes, tag updates, and network settings modifications. Because the change freeze still permits normal management updates, this lock would be too restrictive and prevent the operations team from performing the very activities they need to continue during the freeze.
When this WOULD be correct
If the question required preventing any changes to the resource group and its resources, such as during a security audit where no modifications are allowed, a ReadOnly lock would be correct.
- ✓
Apply a CanNotDelete lock to the resource group.
Why this is correct
CanNotDelete is the correct lock because it blocks deletion while still allowing normal update operations. That means the team can continue to change VM settings, update tags, and manage networking during the freeze, but they cannot accidentally delete the protected resource group or its child resources. It is the standard choice when preservation is required without freezing all management activity.
- ✗
Assign the Reader role to all operators.
Why it's wrong here
Assigning the Reader role to all operators revokes all write permissions, so no one could make any changes to resources during the freeze, which defeats the purpose of allowing normal updates. Additionally, this would change identity-based access control globally, affecting operators' ability to perform other tasks even outside the resource group. Resource locks are a more scoped and reversible way to prevent deletion without altering role assignments.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to prevent any changes (including updates and deletions) to a resource group and its resources, and users only need to view configurations for auditing or monitoring purposes.
- ✗
Assign an Azure Policy deny assignment at the subscription.
Why it's wrong here
An Azure Policy deny assignment is designed to enforce compliance rules by denying non-compliant resource actions, not to provide blanket deletion protection across all resources. To use it for this purpose, you would need a custom policy definition that targets specific resource types and effects, adding complexity without guaranteeing comprehensive protection. The simple resource lock is the intended mechanism for preventing deletion while allowing updates.
When this WOULD be correct
This option would be correct if the question asked: 'The security team needs to prevent operators from creating VMs without encryption, but they should still be able to manage other resources. Which solution should you use?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Apply a CanNotDelete lock to the resource group.Correct answer▾
Why this is correct
CanNotDelete is the correct lock because it blocks deletion while still allowing normal update operations. That means the team can continue to change VM settings, update tags, and manage networking during the freeze, but they cannot accidentally delete the protected resource group or its child resources. It is the standard choice when preservation is required without freezing all management activity.
✗Apply a ReadOnly lock to the resource group.Wrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents all write operations, including updates to VM settings, tags, and network rules, which the operations team still needs to perform.
★ When this WOULD be the correct answer
If the question required preventing any changes to the resource group and its resources, such as during a security audit where no modifications are allowed, a ReadOnly lock would be correct.
Why candidates choose this
Candidates may think a ReadOnly lock is the safest option to prevent accidental deletion, overlooking that it also blocks necessary updates.
✗Assign the Reader role to all operators.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role allows read-only access but does not prevent deletion; operators could still delete resources if they have other permissions, and it blocks all write operations, which contradicts the requirement to update VM settings, change tags, and modify network rules.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to prevent any changes (including updates and deletions) to a resource group and its resources, and users only need to view configurations for auditing or monitoring purposes.
Why candidates choose this
Candidates may think that restricting permissions via RBAC is sufficient to prevent deletion, and they might overlook that the Reader role also blocks necessary write operations, confusing it with a more granular lock.
✗Assign an Azure Policy deny assignment at the subscription.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy deny assignments prevent non-compliant resource creation or modification, but they do not block deletion of existing resources. The question requires preventing deletion while allowing updates, which is achieved by a CanNotDelete lock, not a policy.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'The security team needs to prevent operators from creating VMs without encryption, but they should still be able to manage other resources. Which solution should you use?'
Why candidates choose this
Candidates may confuse Azure Policy's ability to enforce compliance with the operational control of resource locks, thinking a deny assignment can block deletions, but policies only affect creation and modification, not deletion.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.