AZ-900 Describe Azure management and governance Practice Question
A company has a critical Azure Storage account that stores immutable backups. The IT administrator wants to ensure that no one can delete or modify this storage account, even administrators with Contributor or Owner roles. The company still needs to allow read access to the data within the storage account. Which Azure governance feature should the administrator implement?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy (which enforces compliance rules) with Azure Resource Manager locks (which prevent accidental deletion or modification), or they assume RBAC alone can block privileged users, not realizing that locks override RBAC for management-plane operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Manager read-only lock
An Azure Resource Manager read-only lock prevents any user, including those with Contributor or Owner roles, from deleting or modifying the storage account while still allowing read access to the data. This lock operates at the management plane, blocking DELETE and PATCH operations via the Azure Resource Manager API, but does not affect data plane operations like reading blobs or files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy with Deny effect
Why it's wrong here
Azure Policy with Deny effect can block the creation or modification of resources that violate compliance rules, but it does not prevent the deletion of an existing resource. It also does not inherently provide a blanket lock that protects any resource from being deleted by an Owner. This option is incorrect because the requirement is to secure an already deployed resource from deletion and modification, not to enforce compliance during deployment.
When this WOULD be correct
A company wants to enforce that all storage accounts in a subscription must have encryption at rest enabled. If a storage account is created without encryption, Azure Policy with Deny effect would block the creation or flag non-compliance.
- ✗
Azure Blueprint with role assignment
Why it's wrong here
Azure Blueprints are used to orchestrate the deployment of resource groups, policies, role assignments, and resources in a repeatable manner. They help maintain consistency across environments but do not themselves enforce immutability on existing resources. This option is incorrect because a Blueprint cannot prevent an Owner from deleting a resource after it is deployed.
When this WOULD be correct
A company needs to deploy a standardized environment that includes multiple Azure resources with consistent role assignments (e.g., assigning Reader role to all users in a subscription). Azure Blueprint with role assignment would be correct to enforce those role assignments across resource groups.
- ✓
Azure Resource Manager read-only lock
Why this is correct
A read-only lock on the storage account prevents any user, including those with Owner or Contributor roles, from deleting or modifying the resource. It still allows read operations, such as reading the backup data. This lock is the correct Azure governance feature to make a resource immutable and protect it from accidental or intentional deletion or changes.
- ✗
Azure role-based access control (RBAC) with Reader role
Why it's wrong here
Assigning the Reader role to all users would prevent them from making changes, but it does not protect the storage account from an administrator who has the Owner or Contributor role. Those higher-privileged roles include permissions to delete resources. A resource lock is required to override the Owner's permissions. Therefore, RBAC alone is insufficient.
When this WOULD be correct
A company wants to allow users to view data in a storage account but prevent them from modifying or deleting the data. The administrator assigns the Reader role to a group of users who need read-only access to blobs and containers.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Resource Manager read-only lockCorrect answer▾
Why this is correct
A read-only lock on the storage account prevents any user, including those with Owner or Contributor roles, from deleting or modifying the resource. It still allows read operations, such as reading the backup data. This lock is the correct Azure governance feature to make a resource immutable and protect it from accidental or intentional deletion or changes.
✗Azure Policy with Deny effectWrong answer — click to see why▾
Why this is wrong here
Azure Policy with Deny effect can prevent creation or modification of resources based on rules, but it cannot prevent deletion or modification of an existing storage account by authorized users like Contributors or Owners. It does not provide a lock that overrides RBAC permissions.
★ When this WOULD be the correct answer
A company wants to enforce that all storage accounts in a subscription must have encryption at rest enabled. If a storage account is created without encryption, Azure Policy with Deny effect would block the creation or flag non-compliance.
Why candidates choose this
Candidates may think Azure Policy can enforce any restriction, including preventing deletion, because it can deny actions based on policy rules, but they overlook that policy does not override RBAC permissions for existing resources.
✗Azure Blueprint with role assignmentWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints are used to orchestrate deployment of resources and policies, not to prevent deletion or modification of a specific resource. They cannot enforce a read-only lock on an existing storage account.
★ When this WOULD be the correct answer
A company needs to deploy a standardized environment that includes multiple Azure resources with consistent role assignments (e.g., assigning Reader role to all users in a subscription). Azure Blueprint with role assignment would be correct to enforce those role assignments across resource groups.
Why candidates choose this
Candidates may confuse Blueprints with a governance tool that can lock resources, or think that role assignments within a Blueprint can prevent deletion, not realizing Blueprints are for deployment orchestration, not resource-level locks.
✗Azure role-based access control (RBAC) with Reader roleWrong answer — click to see why▾
Why this is wrong here
RBAC with Reader role only prevents write/delete actions on the storage account's management plane, but it does not prevent deletion of the storage account itself by users with higher roles like Contributor or Owner. The question requires a lock that overrides all roles, which RBAC cannot do.
★ When this WOULD be the correct answer
A company wants to allow users to view data in a storage account but prevent them from modifying or deleting the data. The administrator assigns the Reader role to a group of users who need read-only access to blobs and containers.
Why candidates choose this
Candidates may confuse RBAC with resource locks, thinking that assigning a Reader role at the subscription or resource group level can prevent deletion of the storage account, not realizing that RBAC does not override higher roles.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Resource Manager
Azure Resource Manager (ARM) is the deployment and management service for Azure that provides a consistent management layer for creating, updating, and deleting resources in your Azure account.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.