You need to ensure engineers cannot delete a production resource group, but they must still be able to start and stop VMs and change network rules during maintenance. Which resource lock should you apply to the resource group?

No lock

This does not protect the resource group from accidental deletion.

ReadOnly

ReadOnly blocks writes as well as deletes, which would interfere with maintenance tasks.

Azure Policy deny assignment

Policy controls compliance, but it is not the same as a lock for delete protection.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: CanNotDelete — CanNotDelete is the correct lock when you want to protect a resource group from accidental removal while preserving operational changes. It blocks delete operations on the locked scope and its child resources, but it still allows write operations such as starting VMs, changing settings, or updating network rules. That makes it a practical safeguard for production environments where administrators still need to perform maintenance. Why others are wrong: No lock provides no protection. ReadOnly is too restrictive because it blocks writes, which would stop routine maintenance. Azure Policy can enforce configuration rules, but it is not a resource lock and does not specifically provide delete protection for the group.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.