AZ-900 Describe Azure management and governance Practice Question
A company has deployed a production Azure SQL Database that is used by a critical line-of-business application. The database administrators need to be able to change the database schema and scaling settings. However, the operations team must ensure that no one can accidentally delete the database or its server. The company does not want to implement a complex backup strategy for this prevention; they want a simple control that can be applied at the resource level without affecting other management operations. What should the operations team configure to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse Azure Policy (which enforces compliance rules across resources) with resource locks (which are simple, resource-level safeguards against accidental deletion), leading them to choose a policy or RBAC solution that is either too broad or too complex for the stated requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A 'CanNotDelete' resource lock on the database and the server
A 'CanNotDelete' resource lock on the database and the server prevents accidental deletion while still allowing all other management operations, including schema changes and scaling. This meets the requirement for a simple, resource-level control that does not affect read or update permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An Azure Policy definition with the 'Deny' effect assigned to the resource group containing the database
Why it's wrong here
Azure Policy's 'Deny' effect is designed to enforce compliance by blocking the creation or modification of non-compliant resources, not to administratively lock existing resources from deletion. While a Deny policy can be configured with a condition that targets the 'delete' operation, the option as stated does not specify such a condition, so it would not reliably prevent deletion. Furthermore, a generic Deny policy would also block any schema changes that the policy deems non-compliant, which directly conflicts with the requirement that modifications remain allowed.
When this WOULD be correct
An organization needs to enforce that all SQL databases in a subscription must have a specific encryption setting enabled, and any attempt to create a database without that setting should be blocked. Azure Policy with 'Deny' effect would enforce this compliance requirement.
- ✗
A custom Azure Role-Based Access Control (RBAC) role that excludes the delete action
Why it's wrong here
A custom Azure RBAC role defines granular permissions for specific identities, preventing *those assigned the role* from performing delete actions. However, it doesn't prevent someone with a different, broader role (like Contributor) from deleting the resource. The requirement is a resource-level safeguard to prevent *anyone* from accidentally deleting the database or server, irrespective of their assigned roles, which RBAC alone cannot guarantee. This option would be suitable for defining a specific set of permissions for a particular team, ensuring they never *possess* the delete capability.
When this WOULD be correct
A custom RBAC role that excludes the delete action would be correct in a scenario where the company needs to prevent deletion of a resource but also requires granular control over other permissions, such as allowing some users to delete while preventing others, and where resource locks are not suitable because they would also block schema changes or scaling.
- ✓
A 'CanNotDelete' resource lock on the database and the server
Why this is correct
A 'CanNotDelete' resource lock is a management-level safeguard that explicitly prevents any user or role, including Subscription Owner, from deleting the database or server. Unlike RBAC, it applies independently of permissions, and because it allows read, update, and scale operations, it does not interfere with normal administration or schema changes. Locking both the database and the server is important because resource locks are not automatically inherited from a server to its databases in every scenario, and a lock on the resource group alone would not offer this specific, targeted protection.
- ✗
An Azure Blueprint that includes a policy enforcing a read-only state
Why it's wrong here
Incorrect. Azure Blueprints are used to define and deploy a repeatable set of Azure resources and policies. They do not directly provide a mechanism to lock existing resources against deletion. Applying a read-only state through a blueprint would block both deletion and modifications, which is not desired.
When this WOULD be correct
A company wants to enforce that all deployed resources in a subscription are read-only for non-administrative users to ensure compliance with a security policy. An Azure Blueprint with a policy enforcing a read-only state would be correct to apply at scale across multiple resource groups.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓A 'CanNotDelete' resource lock on the database and the serverCorrect answer▾
Why this is correct
A 'CanNotDelete' resource lock is a management-level safeguard that explicitly prevents any user or role, including Subscription Owner, from deleting the database or server. Unlike RBAC, it applies independently of permissions, and because it allows read, update, and scale operations, it does not interfere with normal administration or schema changes. Locking both the database and the server is important because resource locks are not automatically inherited from a server to its databases in every scenario, and a lock on the resource group alone would not offer this specific, targeted protection.
✗An Azure Policy definition with the 'Deny' effect assigned to the resource group containing the databaseWrong answer — click to see why▾
Why this is wrong here
Azure Policy with 'Deny' effect can prevent creation or modification of resources but does not prevent deletion of existing resources; it is not designed for operational locks against accidental deletion.
★ When this WOULD be the correct answer
An organization needs to enforce that all SQL databases in a subscription must have a specific encryption setting enabled, and any attempt to create a database without that setting should be blocked. Azure Policy with 'Deny' effect would enforce this compliance requirement.
Why candidates choose this
Candidates may confuse Azure Policy's 'Deny' effect with resource locks, thinking it can block deletions, or they may overestimate Policy's ability to control existing resource operations.
✗A custom Azure Role-Based Access Control (RBAC) role that excludes the delete actionWrong answer — click to see why▾
Why this is wrong here
A custom RBAC role that excludes the delete action would prevent deletion but also requires careful assignment and management, and it does not provide a simple, resource-level control that is easy to apply without affecting other management operations. The question specifically asks for a simple control that can be applied at the resource level without affecting other management operations, which is exactly what a resource lock provides.
★ When this WOULD be the correct answer
A custom RBAC role that excludes the delete action would be correct in a scenario where the company needs to prevent deletion of a resource but also requires granular control over other permissions, such as allowing some users to delete while preventing others, and where resource locks are not suitable because they would also block schema changes or scaling.
Why candidates choose this
Candidates may think that custom RBAC roles are a flexible way to prevent deletion, but they overlook that RBAC roles affect all management operations and require more complex configuration, whereas resource locks are simpler and specifically designed to prevent accidental deletion without blocking other operations.
✗An Azure Blueprint that includes a policy enforcing a read-only stateWrong answer — click to see why▾
Why this is wrong here
An Azure Blueprint enforces a read-only state, which would prevent database administrators from changing the schema and scaling settings, contradicting the requirement that they need to perform these actions.
★ When this WOULD be the correct answer
A company wants to enforce that all deployed resources in a subscription are read-only for non-administrative users to ensure compliance with a security policy. An Azure Blueprint with a policy enforcing a read-only state would be correct to apply at scale across multiple resource groups.
Why candidates choose this
Candidates may confuse Azure Blueprints with resource locks, thinking that a blueprint can apply a read-only lock, but blueprints are for deploying and governing environments, not for individual resource protection.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure SQL Database
Azure SQL Database is a fully managed relational database-as-a-service (DBaaS) in Microsoft Azure, based on the SQL Server engine, that handles scaling, backups, patching, and high availability automatically.
Key term
Resource lock
A resource lock is a cloud governance feature that prevents accidental deletion or modification of critical cloud resources by applying a read-only or delete-only restriction at the resource, resource group, or subscription level.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.