AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Change the size of an existing virtual machine in the resource group.

  Why this is correct

  Changing the size of an existing virtual machine modifies the resource's properties through a PUT/PATCH operation. A CanNotDelete lock is scoped to DELETE calls only, so it does not intercept update requests. Therefore, resizing the VM is allowed even while the resource group is under a change freeze, because it is not a destructive action.

• ✗

  Delete an unused storage account from the resource group.

  Why it's wrong here

  Deleting an unused storage account is precisely a DELETE operation on an existing resource. Since the CanNotDelete lock explicitly blocks all delete calls, the operation will fail with an error. The fact that the account is unused or decommissioned is irrelevant; the lock is designed to prevent accidental removal, so any deletion attempt is rejected until the lock is removed.

  When this WOULD be correct

  If the lock were a ReadOnly lock instead of CanNotDelete, then deleting resources would be allowed (since ReadOnly only blocks modifications, not deletions). Or if the question asked which actions are prevented by a CanNotDelete lock, deleting a storage account would be a correct answer.

• ✓

  Add or update a tag on an existing resource.

  Why this is correct

  Adding or updating a tag on a resource is also a write operation, typically performed via PATCH on the resource. Since the lock's rule is limited to the delete verb, any non-delete modification—including tag changes—is permitted. This is true even if the tag holds critical governance or cost-accounting metadata; the lock does not treat metadata updates as deletions.

• ✗

  Delete the entire resource group to rebuild it from scratch.

  Why it's wrong here

  Deleting the entire resource group is a delete action targeting the resource group itself, which is the exact scope where the CanNotDelete lock is applied. The lock prevents the resource group from being deleted, and by extension, all resources within it are also protected from any deletion attempt, including a group-level removal. Rebuilding from scratch is therefore impossible without first removing the lock.

  When this WOULD be correct

  If the resource group had a CanNotDelete lock but the question asked which actions are blocked, or if the lock was a ReadOnly lock instead, deleting the resource group would be blocked. Alternatively, if the question was about removing a lock first, then deleting the group would be possible after lock removal.

• ✓

  Create a new storage account in the locked resource group.

  Why this is correct

  Creating a new storage account in the locked resource group is a deployment action that triggers a PUT on the resource provider to create a brand-new resource. CanNotDelete locks do not prevent resource creation, only deletion of existing resources. Hence, you can still add resources to a locked group; the lock exists solely to shield existing assets from removal.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”