AZ-104 Manage Azure Identities and Governance Practice Question
RG-Prod hosts line-of-business workloads. The business wants to prevent accidental deletion of the resource group during change freezes and also ensure every new resource carries a CostCenter tag for chargeback. Which two governance controls should be used? Select two.
⚠ Common exam trap
Watch out — candidates often confuse a ReadOnly lock with a CanNotDelete lock, assuming any lock prevents deletion, but ReadOnly locks also block updates, which would break production workloads, while the correct choice is the less restrictive CanNotDelete lock for deletion prevention only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a CanNotDelete lock to RG-Prod.
Applying a CanNotDelete lock to RG-Prod prevents the resource group from being deleted during change freezes, which directly meets the requirement to prevent accidental deletion. This lock type allows read and update operations but blocks delete operations, making it ideal for protecting critical resources without impacting ongoing workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply a CanNotDelete lock to RG-Prod.
Why this is correct
A CanNotDelete lock prevents deletion of the resource group and all child resources while leaving read and update operations fully functional. This lock is enforced at the Azure Resource Manager control plane, so ordinary updates, deployments, and configuration changes continue to work, which aligns with the need to host production workloads without disruption. It is the appropriate choice when the goal is to guard against accidental deletion without restricting administrative changes.
- ✗
Apply a ReadOnly lock to RG-Prod.
Why it's wrong here
Applying a ReadOnly lock at the resource group scope blocks all write operations, including creating, modifying, and deleting resources, as well as updating their configurations. For production workloads, this would prevent legitimate changes such as deploying new updates, scaling settings, or applying patches, potentially causing operational outages when changes are needed. It also blocks writes to data plane operations for many services, so it is far more restrictive than needed and would interfere with normal management of the workloads.
When this WOULD be correct
If the business required that no changes (including updates) be made to the resource group or its resources during a freeze period, a ReadOnly lock would be the correct choice to enforce complete read-only access.
- ✓
Use Azure Policy with a Modify effect to add the CostCenter tag to new resources.
Why this is correct
The Modify effect in Azure Policy automatically adds or replaces the CostCenter tag on new resources as part of their creation, without blocking the deployment. This effect uses a defined policy rule and a remediation task to bring non-compliant resources into alignment, ensuring consistent cost accounting across the resource group. Unlike a Deny policy, Modify does not reject the resource; it applies the required tag during the control plane operation, making it transparent to developers and operations teams.
- ✗
Grant Reader to the finance team on the resource group.
Why it's wrong here
Granting the finance team the Reader role on RG-Prod gives them permission to view resources, their properties, and their tags, but it does not affect what other users can do to the resources. Reader does not prevent users with Owner or Contributor roles from deleting resources or modifying tags, nor does it enforce any tagging requirements. Therefore, this assignment offers visibility for tracking but fails to satisfy either the deletion protection or the CostCenter tagging goals.
When this WOULD be correct
If the question asked for a control to allow the finance team to view resource costs without making changes, granting Reader access to the resource group would be correct. For example: 'Which role should you assign to the finance team so they can monitor resource usage without modifying resources?'
- ✗
Create a private endpoint for RG-Prod.
Why it's wrong here
A private endpoint is a network interface with a private IP address from a virtual network that securely connects to a PaaS service such as Storage or SQL Database. It operates entirely at the network data plane and has no effect on Azure Resource Manager control plane functions like deletion protections or resource tagging. Deploying a private endpoint for RG-Prod would therefore make no contribution to preventing resource deletion or enforcing cost-center tags, so it is not a solution to either requirement.
When this WOULD be correct
In a scenario where a company needs to ensure that a storage account in RG-Prod is accessed only over a private network from a specific VNet, and all public access must be disabled, creating a private endpoint for that storage account would be the correct governance control.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Apply a CanNotDelete lock to RG-Prod.Correct answer▾
Why this is correct
A CanNotDelete lock prevents deletion of the resource group and all child resources while leaving read and update operations fully functional. This lock is enforced at the Azure Resource Manager control plane, so ordinary updates, deployments, and configuration changes continue to work, which aligns with the need to host production workloads without disruption. It is the appropriate choice when the goal is to guard against accidental deletion without restricting administrative changes.
✗Apply a ReadOnly lock to RG-Prod.Wrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents any changes, including updates and deletions, but the requirement is only to prevent accidental deletion during change freezes, not to block all modifications. Additionally, it does not address the CostCenter tag requirement.
★ When this WOULD be the correct answer
If the business required that no changes (including updates) be made to the resource group or its resources during a freeze period, a ReadOnly lock would be the correct choice to enforce complete read-only access.
Why candidates choose this
Candidates may confuse ReadOnly lock with CanNotDelete lock, thinking any lock prevents deletion, but ReadOnly is more restrictive than needed and fails to meet the tag requirement.
✗Grant Reader to the finance team on the resource group.Wrong answer — click to see why▾
Why this is wrong here
Granting Reader permission to the finance team allows them to view resources but does not enforce tagging or prevent deletion. The question requires preventing accidental deletion and ensuring a CostCenter tag on new resources, which Reader cannot achieve.
★ When this WOULD be the correct answer
If the question asked for a control to allow the finance team to view resource costs without making changes, granting Reader access to the resource group would be correct. For example: 'Which role should you assign to the finance team so they can monitor resource usage without modifying resources?'
Why candidates choose this
Candidates may think Reader is a governance control because it restricts write access, but it does not prevent deletion (locks do) or enforce tagging (policy does). The term 'governance' is broad, leading to confusion between access control and resource governance.
✗Create a private endpoint for RG-Prod.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint secures network connectivity to a PaaS service (e.g., Storage, SQL) by giving it a private IP in a VNet, not a resource group. It does not prevent deletion or enforce tagging.
★ When this WOULD be the correct answer
In a scenario where a company needs to ensure that a storage account in RG-Prod is accessed only over a private network from a specific VNet, and all public access must be disabled, creating a private endpoint for that storage account would be the correct governance control.
Why candidates choose this
Candidates may confuse 'private endpoint' with a general governance tool, thinking it 'locks down' the resource group, or they may misapply the concept of 'private' as a form of access control beyond networking.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.