AZ-104 Manage Azure Identities and Governance Practice Question
You need to ensure engineers cannot delete a production resource group, but they must still be able to start and stop VMs and change network rules during maintenance. Which resource lock should you apply to the resource group?
⚠ Common exam trap
Test-takers frequently confuse ReadOnly with CanNotDelete, assuming any lock will block all operations, when in fact ReadOnly blocks all write operations (including start/stop and network changes) while CanNotDelete only blocks deletion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CanNotDelete
The CanNotDelete lock prevents deletion of the resource group while allowing all other operations, including starting/stopping VMs and modifying network rules. This meets the requirement because engineers retain full management capabilities except for deletion, which is explicitly blocked at the resource group scope.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No lock
Why it's wrong here
Choosing No lock leaves the resource group fully exposed to any principal that has delete permission on that scope, such as an Owner, Contributor, or a custom role containing Microsoft.Resources/subscriptions/resourceGroups/delete. Azure RBAC does not distinguish between accidental and intentional deletion, so a misdirected command in a script or Azure portal can permanently delete the resource group and cascade to all resources inside it. Without a lock, there is no safety mechanism at the ARM layer to block that destructive operation.
When this WOULD be correct
If the question stated that engineers should have full control including deletion, or if no restriction on deletion is needed, then no lock would be appropriate.
- ✗
ReadOnly
Why it's wrong here
A ReadOnly resource lock prevents any delete and all write operations, including PUT, POST, and PATCH requests, at the resource group scope and on inherited child resources. While it does make the resource group impossible to delete, it also stops engineers from performing ordinary maintenance actions such as updating application settings, adding diagnostic settings, or scaling virtual machines—functionality the scenario assumes they should still have. Therefore a ReadOnly lock is too restrictive; the requirement is to block deletion only, not to freeze production resources from all modification.
When this WOULD be correct
When the requirement is to prevent all changes to a resource group, including read operations like viewing secrets or keys, and no maintenance actions are needed.
- ✓
CanNotDelete
Why this is correct
A CanNotDelete resource lock (also called a Delete lock) blocks any delete operation against the resource group and every child resource beneath it, while still allowing normal write operations such as adding tags, modifying settings, or updating configurations. Because locks are evaluated by Azure Resource Manager independently of role-based access control, even a user with Contributor or Owner rights receives an HTTP 409 (Conflict) error if they try to delete the protected scope. This is the correct answer because it removes only the delete privilege without interfering with the management tasks engineers need to perform in production.
- ✗
Azure Policy deny assignment
Why it's wrong here
An Azure Policy deny assignment uses policy rules to enforce compliance and the deny effect is evaluated when a resource request is submitted to the resource provider, typically for create, update, or property-change operations. It is not a scope-level guard that protects an existing resource group from being deleted by RBAC-authorized users; even a custom policy that attempts to deny delete actions is not the native lock mechanism and is far more complex to apply uniformly than a simple lock. Because the question asks for the standard guardrail for deletion, Azure Policy is not the right choice.
When this WOULD be correct
A scenario where you need to prevent specific resource configurations (e.g., ensuring VMs are only deployed in certain regions) while allowing other operations. For example, 'You need to ensure that all VMs in a resource group are deployed in the West US region, but engineers can still manage them. What should you use?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓CanNotDeleteCorrect answer▾
Why this is correct
A CanNotDelete resource lock (also called a Delete lock) blocks any delete operation against the resource group and every child resource beneath it, while still allowing normal write operations such as adding tags, modifying settings, or updating configurations. Because locks are evaluated by Azure Resource Manager independently of role-based access control, even a user with Contributor or Owner rights receives an HTTP 409 (Conflict) error if they try to delete the protected scope. This is the correct answer because it removes only the delete privilege without interfering with the management tasks engineers need to perform in production.
✗No lockWrong answer — click to see why▾
Why this is wrong here
No lock would allow engineers to delete the resource group, which violates the requirement to prevent deletion.
★ When this WOULD be the correct answer
If the question stated that engineers should have full control including deletion, or if no restriction on deletion is needed, then no lock would be appropriate.
Why candidates choose this
Candidates may think that RBAC roles alone are sufficient to prevent deletion, overlooking that resource locks provide an additional layer of protection.
✗ReadOnlyWrong answer — click to see why▾
Why this is wrong here
ReadOnly lock prevents any modifications, including starting/stopping VMs and changing network rules, which are required during maintenance.
★ When this WOULD be the correct answer
When the requirement is to prevent all changes to a resource group, including read operations like viewing secrets or keys, and no maintenance actions are needed.
Why candidates choose this
Candidates may confuse 'prevent deletion' with 'prevent changes' and think ReadOnly is a stronger lock, or they may not realize that ReadOnly blocks write operations needed for maintenance.
✗Azure Policy deny assignmentWrong answer — click to see why▾
Why this is wrong here
Azure Policy deny assignment is used to enforce compliance rules across resources, not to prevent deletion while allowing modifications. It would block all actions that violate the policy, including starting/stopping VMs or changing network rules, which contradicts the requirement for engineers to perform maintenance.
★ When this WOULD be the correct answer
A scenario where you need to prevent specific resource configurations (e.g., ensuring VMs are only deployed in certain regions) while allowing other operations. For example, 'You need to ensure that all VMs in a resource group are deployed in the West US region, but engineers can still manage them. What should you use?'
Why candidates choose this
Candidates may confuse Azure Policy with resource locks because both are used for governance and control. They might think a deny assignment can selectively block deletions while allowing other changes, not realizing it applies to specific policy conditions rather than operations.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. RG-Prod is locked during a change freeze with a CanNotDelete lock. Administrators still need to keep the environment healthy without removing the lock. Which three actions can still be completed? Select three.
hard- ✓ A.Change the size of an existing virtual machine in the resource group.
- B.Delete an unused storage account from the resource group.
- ✓ C.Add or update a tag on an existing resource.
- D.Delete the entire resource group to rebuild it from scratch.
- ✓ E.Create a new storage account in the locked resource group.
Why A: A CanNotDelete lock prevents deletion of resources but allows all management operations that do not involve deletion. Changing the size of an existing virtual machine is a modification operation, not a deletion, so it is permitted under this lock type.
Variation 2. A change-freeze requires that no one can modify the settings of a subscription's resource group for six hours. Deletion is not the main concern; the priority is to block changes to existing resources during the freeze. Which lock should you apply?
medium- A.CanNotDelete
- ✓ B.ReadOnly
- C.Reader
- D.DeployIfNotExists
Why B: The ReadOnly lock prevents any modification to existing resources, including configuration changes, while still allowing read operations. This directly satisfies the change-freeze requirement to block changes for six hours, as it denies all write operations at the resource group scope.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.