AZ-900 Describe Azure management and governance Practice Question
A company stores critical financial records in an Azure Storage account. The operations team needs to ensure that the storage account cannot be deleted by any user, including administrators with Contributor permissions. However, authorized users must still be able to add and modify blobs. The solution should not affect the ability to update the account's configuration. Which Azure feature should the company implement?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy with resource locks, thinking a policy can prevent deletion of a specific resource, when in fact resource locks are the correct tool for that purpose, while Azure Policy is used for broader compliance and governance rules across resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a CanNotDelete resource lock on the storage account.
A CanNotDelete resource lock on the storage account prevents any user, including those with Contributor permissions, from deleting the resource. This satisfies the requirement that even administrators cannot delete the account, while still allowing authorized users to add and modify blobs (since blob operations are controlled by Azure RBAC roles, not the lock) and update the account's configuration (the lock only blocks delete operations).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the Storage Blob Data Owner role to the operations team.
Why it's wrong here
This role grants full control over storage blob data, but it does not prevent deletion of the storage account itself. Users holding this role can still delete the account if they also have delete permissions at the storage account level.
When this WOULD be correct
This option would be correct if the question asked for ensuring that the operations team can manage blob data (add, modify, delete blobs) without needing to manage the storage account itself, and the concern was about data access rather than account deletion.
- ✓
Apply a CanNotDelete resource lock on the storage account.
Why this is correct
A CanNotDelete resource lock prevents the storage account from being deleted by any user or process, while allowing all other operations (such as reading and updating blobs) as long as the user has the necessary RBAC permissions. This meets the requirement exactly.
- ✗
Create an Azure Policy that denies delete operations on storage accounts.
Why it's wrong here
An Azure Policy denying delete operations on storage accounts would prevent resource deletion, but it is not the most robust solution for protecting critical resources from administrators with Contributor permissions. Policies can be modified or disabled by users with sufficient permissions (e.g., Policy Contributor or Owner roles), potentially allowing the policy to be circumvented. Azure Resource Locks are designed for this specific scenario, providing a stronger, explicit prevention against deletion or modification of resources, even for administrators, without affecting data plane operations like adding/modifying blobs or control plane configuration updates.
When this WOULD be correct
An organization needs to enforce a company-wide rule that no storage accounts can be deleted across all subscriptions. In this case, an Azure Policy with a deny effect on delete operations for storage accounts would be the correct solution to ensure compliance at scale.
- ✗
Move the storage account to a new resource group.
Why it's wrong here
Moving the storage account to a new resource group changes its logical container but does not alter any authorization or protection controls. The storage account remains deletable by any identity with the appropriate RBAC permissions (e.g., Contributor or Owner) at the subscription, resource group, or resource scope. Resource group placement is purely organizational and has no bearing on deletion prevention; a user who can delete the account in the original group can still delete it after the move. In fact, the move itself requires delete and write permissions, and the account is fully vulnerable to deletion both during and after the move unless an explicit protection mechanism, like a resource lock, is applied.
When this WOULD be correct
A company needs to reorganize resources by moving a storage account to a different resource group for better management, without affecting its configuration or access. The question would ask: 'Which action should be taken to move a storage account to a new resource group while preserving its settings?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Apply a CanNotDelete resource lock on the storage account.Correct answer▾
Why this is correct
A CanNotDelete resource lock prevents the storage account from being deleted by any user or process, while allowing all other operations (such as reading and updating blobs) as long as the user has the necessary RBAC permissions. This meets the requirement exactly.
✗Assign the Storage Blob Data Owner role to the operations team.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Storage Blob Data Owner role grants permissions to manage blob data, not to prevent deletion of the storage account itself. It does not block deletion by users with Contributor permissions.
★ When this WOULD be the correct answer
This option would be correct if the question asked for ensuring that the operations team can manage blob data (add, modify, delete blobs) without needing to manage the storage account itself, and the concern was about data access rather than account deletion.
Why candidates choose this
Candidates may confuse data plane roles (like Storage Blob Data Owner) with management plane controls, thinking that assigning a role can prevent deletion, or they may misinterpret the requirement as needing to grant permissions rather than restrict them.
✗Create an Azure Policy that denies delete operations on storage accounts.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy can deny delete operations, but it applies to all resources matching the policy scope, not just a specific storage account. The question requires a solution that does not affect the ability to update the account's configuration, and a resource lock is more targeted and simpler.
★ When this WOULD be the correct answer
An organization needs to enforce a company-wide rule that no storage accounts can be deleted across all subscriptions. In this case, an Azure Policy with a deny effect on delete operations for storage accounts would be the correct solution to ensure compliance at scale.
Why candidates choose this
Candidates may think Azure Policy is the go-to for preventing deletions, but they overlook that resource locks are specifically designed to protect individual resources from accidental deletion or modification, while policies are for governance and compliance across resources.
✗Move the storage account to a new resource group.Wrong answer — click to see why▾
Why this is wrong here
Moving the storage account to a new resource group does not prevent deletion by users with Contributor permissions; it only changes the resource's container. The question requires a mechanism to block deletion entirely, which resource locks provide.
★ When this WOULD be the correct answer
A company needs to reorganize resources by moving a storage account to a different resource group for better management, without affecting its configuration or access. The question would ask: 'Which action should be taken to move a storage account to a new resource group while preserving its settings?'
Why candidates choose this
Candidates may think that moving the account to a different resource group isolates it from users who could delete it, but this does not actually prevent deletion by authorized users in the new group.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.