AZ-900 Describe Azure management and governance Practice Question
A company manages a production Azure subscription that contains critical resources. The security team wants to prevent any user, including users with the Owner role, from accidentally deleting the entire subscription or any resource within it. The team still wants authorized users to be able to modify settings and create new resources. Which Azure feature should the team use?
⚠ Common exam trap
Many candidates confuse Azure Policy with resource locks, thinking that a Deny policy can prevent deletions, but policies evaluate at resource creation or update and do not block delete operations, whereas resource locks directly block delete actions regardless of RBAC roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a global 'CanNotDelete' resource lock at the subscription scope.
A 'CanNotDelete' resource lock at the subscription scope prevents any user, including those with the Owner role, from deleting the subscription or any resource within it. This lock overrides all RBAC permissions for delete operations, while still allowing authorized users to modify settings and create new resources, meeting the security team's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a custom RBAC role that denies the 'Microsoft.Resources/subscriptions/delete' action and assign it to the subscription.
Why it's wrong here
A custom RBAC role can deny deletion, but users with the Owner role (or another role that includes 'Microsoft.Authorization/*' actions) can modify RBAC assignments and remove this restriction. Resource locks are a more robust solution because they apply to all users, including Owners.
When this WOULD be correct
This option would be correct if the question asked for a way to prevent non-Owner users from deleting the subscription while allowing Owners to retain full control, or if the requirement was to restrict a specific action without affecting other permissions.
- ✓
Apply a global 'CanNotDelete' resource lock at the subscription scope.
Why this is correct
A resource lock at the subscription scope prevents the deletion of the subscription itself and all resources within it. This lock overrides RBAC permissions, so even the Owner cannot delete the locked resources. It allows read and modification actions other than Delete. This directly meets the requirement.
- ✗
Configure an Azure Policy that audits delete operations and sends an alert to the security team.
Why it's wrong here
This option only generates an audit log and alerts after a deletion has been attempted or performed. It does not prevent the deletion from happening, so it does not meet the requirement to block accidental deletion.
When this WOULD be correct
A question asks for a solution to detect and alert when delete operations occur on critical resources, without blocking the action, to monitor for unauthorized deletions.
- ✗
Create a management group, move the subscription into it, and assign an Azure Policy definition with the 'Deny' effect targeting delete operations.
Why it's wrong here
Management groups do not support resource locks. Additionally, Azure Policy's 'Deny' effect only blocks creation or update operations that violate the policy; it does not prevent deletion actions. This combination cannot protect against accidental deletion.
When this WOULD be correct
This option would be correct if the question asked for a way to prevent deletion of resources within the subscription (not the subscription itself) across multiple subscriptions, and the solution needed to be centrally managed at the management group scope.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Apply a global 'CanNotDelete' resource lock at the subscription scope.Correct answer▾
Why this is correct
A resource lock at the subscription scope prevents the deletion of the subscription itself and all resources within it. This lock overrides RBAC permissions, so even the Owner cannot delete the locked resources. It allows read and modification actions other than Delete. This directly meets the requirement.
✗Create a custom RBAC role that denies the 'Microsoft.Resources/subscriptions/delete' action and assign it to the subscription.Wrong answer — click to see why▾
Why this is wrong here
Custom RBAC roles cannot override the Owner role's permissions; an Owner can still delete the subscription or resources, so this does not meet the requirement to prevent accidental deletion by any user, including Owners.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a way to prevent non-Owner users from deleting the subscription while allowing Owners to retain full control, or if the requirement was to restrict a specific action without affecting other permissions.
Why candidates choose this
Candidates may think custom RBAC roles can deny actions universally, but they forget that RBAC is additive and cannot deny permissions granted by the Owner role.
✗Configure an Azure Policy that audits delete operations and sends an alert to the security team.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy with 'Audit' effect only logs and alerts on delete operations; it does not prevent deletion, which is the explicit requirement to block accidental deletion of the subscription or resources.
★ When this WOULD be the correct answer
A question asks for a solution to detect and alert when delete operations occur on critical resources, without blocking the action, to monitor for unauthorized deletions.
Why candidates choose this
Candidates may confuse auditing with enforcement, thinking that alerting on delete operations is sufficient to prevent accidental deletion, or they may overestimate the capabilities of Azure Policy's audit effect.
✗Create a management group, move the subscription into it, and assign an Azure Policy definition with the 'Deny' effect targeting delete operations.Wrong answer — click to see why▾
Why this is wrong here
Moving a subscription into a management group and assigning a Deny policy does not prevent deletion of the subscription itself; Azure Policy cannot block subscription-level delete operations. Only resource locks can prevent deletion of the subscription.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a way to prevent deletion of resources within the subscription (not the subscription itself) across multiple subscriptions, and the solution needed to be centrally managed at the management group scope.
Why candidates choose this
Candidates may think that Azure Policy with Deny effect can block all delete operations, including subscription deletion, and that management groups provide a broader control scope, overlooking that subscription deletion is not governed by Azure Policy.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.