RG-Prod hosts line-of-business workloads. The business wants to prevent accidental deletion of the resource group during change freezes and also ensure every new resource carries a CostCenter tag for chargeback. Which two governance controls should be used? Select two.

Apply a ReadOnly lock to RG-Prod.

ReadOnly would block necessary updates and is more disruptive than the requirement calls for.

Grant Reader to the finance team on the resource group.

Reader provides visibility only and does not prevent deletion or enforce tags.

Create a private endpoint for RG-Prod.

Private endpoints are a networking feature and have no effect on deletion prevention or tag governance.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Apply a CanNotDelete lock to RG-Prod. — A CanNotDelete lock is the correct protection when administrators must still make operational changes but should not be able to delete the group by accident. To ensure every new resource gets a CostCenter value without blocking deployments, Azure Policy with a Modify effect is the right governance control. Together, these two controls address both change prevention and cost tracking in a way that matches the business requirement. Why others are wrong: ReadOnly would block too much, including routine maintenance. Reader is only an access role and does not enforce governance. Private endpoints solve network isolation, not chargeback or deletion protection. The correct pairing is a deletion lock plus a tag-enforcement policy.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.