AZ-900 Describe Azure management and governance Practice Question
A company manages its production workloads in a dedicated Azure subscription under the root management group. The infrastructure team recently created a critical resource group named 'rg-prod-core' that contains networking resources. To prevent accidental deletion of this entire resource group, the team needs a mechanism that blocks delete operations on 'rg-prod-core' while still allowing changes to resources within it. The solution must not affect any other resource groups in the subscription. Which Azure feature should the team apply to 'rg-prod-core'?
⚠ Common exam trap
Many exam-takers confuse Azure Policy (which enforces compliance rules) with resource locks (which provide operational protection against accidental deletion), leading them to choose a policy-based solution that would affect broader scopes instead of the targeted lock.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a resource lock with the 'CanNotDelete' setting to the resource group.
A resource lock with the 'CanNotDelete' setting prevents deletion of the resource group while still allowing read and update operations on resources within it. This lock applies only to the specific resource group scope, so it does not affect any other resource groups in the subscription. This directly meets the requirement to block deletion of 'rg-prod-core' without impacting other groups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign an Azure Policy with the 'deny' effect at the management group scope to block deletions of any resource group.
Why it's wrong here
Assigning an Azure Policy with the 'deny' effect at the management group scope would block deletions of all resource groups under that management group, not just 'rg-prod-core', thereby violating the requirement that no other resource groups be affected. This option is tempting because Azure Policy can enforce compliance across resources, and a 'deny' effect on resource group deletion would prevent accidental removal; however, it would be the correct choice only if the organisation needed to prohibit deletion of every resource group in the subscription, rather than targeting a single group.
When this WOULD be correct
If the requirement were to prevent deletion of all resource groups in the subscription (or under a management group) to enforce a company-wide policy, then assigning an Azure Policy with 'deny' effect at the management group scope would be correct.
- ✓
Apply a resource lock with the 'CanNotDelete' setting to the resource group.
Why this is correct
A 'CanNotDelete' resource lock prevents deletion of the resource group and its resources but still allows modifications to the resources within. This lock is scoped to the specific resource group, so it does not affect other resource groups.
- ✗
Create a custom RBAC role that explicitly denies the delete action, and assign it to the infrastructure team at the resource group scope.
Why it's wrong here
While a custom role could theoretically block deletions for a specific team, it does not prevent the resource owner or another privileged user from deleting the resource group. It also adds unnecessary complexity compared to using a resource lock, which is the recommended practice for preventing accidental deletion.
When this WOULD be correct
This option would be correct in a scenario where the company needs to restrict deletion of a resource group for a specific set of users (e.g., a development team) while allowing administrators to delete it when necessary. For example: 'A company wants to prevent developers from deleting a critical resource group, but administrators should still be able to delete it. Which solution should be used?'
- ✗
Deploy an Azure Blueprint that includes a policy to audit deletions of the resource group.
Why it's wrong here
Azure Blueprints are used to deploy a collection of resources and policies consistently. An audit policy only reports on compliance but does not actively prevent deletion. This does not meet the requirement to block delete operations.
When this WOULD be correct
A company needs to ensure compliance by tracking any deletion attempts on critical resource groups for auditing purposes, without blocking the operation. In that case, deploying an Azure Blueprint with a policy to audit deletions would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Apply a resource lock with the 'CanNotDelete' setting to the resource group.Correct answer▾
Why this is correct
A 'CanNotDelete' resource lock prevents deletion of the resource group and its resources but still allows modifications to the resources within. This lock is scoped to the specific resource group, so it does not affect other resource groups.
✗Assign an Azure Policy with the 'deny' effect at the management group scope to block deletions of any resource group.Wrong answer — click to see why▾
Why this is wrong here
Assigning an Azure Policy with 'deny' effect at the management group scope would block deletions of all resource groups under that management group, not just 'rg-prod-core', violating the requirement to not affect other resource groups.
★ When this WOULD be the correct answer
If the requirement were to prevent deletion of all resource groups in the subscription (or under a management group) to enforce a company-wide policy, then assigning an Azure Policy with 'deny' effect at the management group scope would be correct.
Why candidates choose this
Candidates may confuse Azure Policy with resource locks, thinking that a 'deny' effect policy can be scoped to a single resource group, but policies at management group scope apply to all child resources.
✗Create a custom RBAC role that explicitly denies the delete action, and assign it to the infrastructure team at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
A custom RBAC role that denies delete actions would block all delete operations on the resource group, including those by the infrastructure team, but it would not prevent accidental deletion by users with higher privileges (e.g., Owner) or at higher scopes. The question requires a mechanism that blocks deletion while still allowing changes to resources, which is exactly what a resource lock does; RBAC roles cannot override inherited permissions from higher scopes.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the company needs to restrict deletion of a resource group for a specific set of users (e.g., a development team) while allowing administrators to delete it when necessary. For example: 'A company wants to prevent developers from deleting a critical resource group, but administrators should still be able to delete it. Which solution should be used?'
Why candidates choose this
Candidates may think that RBAC roles can enforce deletion prevention because they are familiar with using custom roles to deny specific actions. They might overlook that resource locks are the dedicated feature for preventing accidental deletion, and that RBAC roles can be overridden by higher-scope permissions.
✗Deploy an Azure Blueprint that includes a policy to audit deletions of the resource group.Wrong answer — click to see why▾
Why this is wrong here
Azure Blueprints audit deletions but do not block them; the question requires a mechanism that prevents deletion, not just audits it.
★ When this WOULD be the correct answer
A company needs to ensure compliance by tracking any deletion attempts on critical resource groups for auditing purposes, without blocking the operation. In that case, deploying an Azure Blueprint with a policy to audit deletions would be correct.
Why candidates choose this
Candidates may confuse auditing with enforcement, thinking that auditing deletions provides a preventive control, or they may overestimate the capabilities of Azure Blueprints in enforcing restrictions.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure subscription
An Azure subscription is a logical container in Microsoft Azure that provides billing isolation and access boundaries for your cloud resources and services.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.