AZ-900 Describe Azure management and governance Practice Question
A company has a critical Azure resource group that contains all production virtual machines and databases. The IT security administrator wants to ensure that no user, including members of the 'Owner' role, can accidentally or intentionally delete this resource group. The solution must not prevent modification of resources inside the resource group. The administrator needs to apply a governance control at the resource group level. What should the administrator do?
⚠ Common exam trap
Test-takers frequently confuse resource locks with RBAC roles, thinking a custom RBAC deny assignment is sufficient, but locks are the only mechanism that can prevent deletion even by Owners without requiring additional permission management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a 'CanNotDelete' lock on the resource group.
Applying a 'CanNotDelete' lock at the resource group level prevents any user, including those with the Owner role, from deleting the resource group while still allowing modifications (e.g., adding or updating resources) inside it. This lock overrides all RBAC permissions for delete operations, making it the appropriate governance control for this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a 'ReadOnly' lock on the resource group.
Why it's wrong here
A 'ReadOnly' lock enforces read-only access to all resources within the scope by preventing any create, update, or delete operations for all users, including the Owner role. While it does block the resource group from being deleted, it also prevents legitimate modifications to production resources—such as configuration updates, scaling operations, or applying patches—which are required for ongoing operations. Therefore, it is overly restrictive and does not meet the requirement of allowing changes while only prohibiting deletion.
When this WOULD be correct
An administrator needs to ensure that no one can make any changes to a resource group or its resources, such as in a production environment where configuration must remain static for compliance. A 'ReadOnly' lock would be the correct choice.
- ✓
Apply a 'CanNotDelete' lock on the resource group.
Why this is correct
A 'CanNotDelete' lock allows read and update operations but blocks delete operations on the resource group. This lock applies to all users, including those with the Owner role, making it the correct governance control to prevent accidental or intentional deletion while allowing modifications.
- ✗
Assign a custom RBAC role that denies delete actions at the resource group scope.
Why it's wrong here
While a custom RBAC role can deny delete actions, it is not a foolproof governance control. Users with elevated roles (such as Owner) might override the deny assignment, or the assignment could be changed by other administrators. Azure Resource Locks provide a stronger enforcement that overrides RBAC permissions.
When this WOULD be correct
This option would be correct in a scenario where the administrator needs to prevent deletion of both the resource group and all resources within it, and where custom RBAC roles are allowed to be used instead of Azure locks.
- ✗
Move the resource group to a separate subscription with billing separation.
Why it's wrong here
Moving the resource group to a different subscription does not inherently prevent deletion. Users with administrative access to that subscription could still delete the resource group. This action does not provide the required protection against deletion.
When this WOULD be correct
An organization needs to isolate resources for compliance or cost tracking, and the requirement is to separate billing or administrative boundaries without affecting access controls. For example, a company wants to keep production resources in a separate subscription for chargeback purposes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Apply a 'CanNotDelete' lock on the resource group.Correct answer▾
Why this is correct
A 'CanNotDelete' lock allows read and update operations but blocks delete operations on the resource group. This lock applies to all users, including those with the Owner role, making it the correct governance control to prevent accidental or intentional deletion while allowing modifications.
✗Apply a 'ReadOnly' lock on the resource group.Wrong answer — click to see why▾
Why this is wrong here
A 'ReadOnly' lock prevents any modification, including creation, update, or deletion of resources, which contradicts the requirement that modification of resources inside the resource group must not be prevented.
★ When this WOULD be the correct answer
An administrator needs to ensure that no one can make any changes to a resource group or its resources, such as in a production environment where configuration must remain static for compliance. A 'ReadOnly' lock would be the correct choice.
Why candidates choose this
Candidates may think a 'ReadOnly' lock is a stronger form of protection against deletion, but they overlook that it also blocks modifications, which is not allowed per the question's constraints.
✗Assign a custom RBAC role that denies delete actions at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning a custom RBAC role that denies delete actions at the resource group scope would prevent deletion of the resource group, but it would also prevent deletion of resources inside the group, which violates the requirement that modification of resources inside the resource group must not be prevented.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the administrator needs to prevent deletion of both the resource group and all resources within it, and where custom RBAC roles are allowed to be used instead of Azure locks.
Why candidates choose this
Candidates may think that a custom RBAC role provides more granular control than a lock, or they may be unaware that RBAC deny assignments at the resource group scope also apply to child resources, thus blocking deletions inside the group.
✗Move the resource group to a separate subscription with billing separation.Wrong answer — click to see why▾
Why this is wrong here
Moving the resource group to a separate subscription does not prevent users with 'Owner' role in that subscription from deleting the resource group. It only separates billing and management, not governance.
★ When this WOULD be the correct answer
An organization needs to isolate resources for compliance or cost tracking, and the requirement is to separate billing or administrative boundaries without affecting access controls. For example, a company wants to keep production resources in a separate subscription for chargeback purposes.
Why candidates choose this
Candidates may think that moving to a separate subscription adds an extra layer of security or isolation, but it does not enforce deletion prevention at the resource group level.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.