During a change freeze, the operations team wants to prevent accidental deletion of a production resource group and everything in it. They still need to update VM settings, change tags, and modify network rules. Which lock should be applied?

Apply a ReadOnly lock to the resource group.

ReadOnly would block most write operations, including the updates the team still needs to perform.

Assign the Reader role to all operators.

Reader removes write access entirely, which is much more restrictive than the requirement.

Assign an Azure Policy deny assignment at the subscription.

Policy can enforce compliance, but it is not the right mechanism for simple deletion prevention during a freeze.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Apply a CanNotDelete lock to the resource group. — CanNotDelete is designed for exactly this situation. It stops accidental deletion of the protected scope while allowing administrators to continue making normal configuration changes. Because the requirement explicitly says updates must still work, ReadOnly would be too restrictive and would interfere with operations such as tag changes and VM resizing. Why others are wrong: ReadOnly blocks write operations and would prevent the required updates. Reader removes even more access by allowing only viewing. Azure Policy is useful for compliance scenarios, but a simple change freeze is more directly and predictably handled by a resource lock.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.