RG-Prod is locked during a change freeze with a CanNotDelete lock. Administrators still need to keep the environment healthy without removing the lock. Which three actions can still be completed? Select three.

Delete an unused storage account from the resource group.

Deleting a resource is exactly what a CanNotDelete lock prevents.

Delete the entire resource group to rebuild it from scratch.

The lock protects both the group and the resources from deletion until the lock is removed.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Change the size of an existing virtual machine in the resource group. — A CanNotDelete lock is designed to prevent accidental deletion, not to freeze all configuration changes. Administrators can still resize VMs, update tags, and deploy new resources into the locked resource group. This makes it useful during maintenance windows or freezes where the environment must stay intact but still requires operational updates. Only delete operations are blocked unless the lock itself is removed. Why others are wrong: Deleting a resource or the entire resource group is blocked by CanNotDelete, so those requests fail. The lock is narrower than ReadOnly and does not stop normal configuration updates. That distinction is important because many administrators incorrectly assume every lock prevents all changes.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.