AZ-900 Describe Azure management and governance Practice Question
A company has an Azure subscription that contains production resources. The IT manager is concerned that a user who has the Contributor role might accidentally delete the entire subscription. The company wants a solution that prevents anyone from deleting the subscription, even users with the Owner role, while still allowing modifications to the resources inside the subscription. What should the administrator configure?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy (which governs resource configuration compliance) with resource locks (which protect against accidental deletion or modification at the management plane), leading them to choose Azure Policy instead of the correct lock type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a resource lock of type 'Delete' at the subscription level.
A resource lock of type 'Delete' at the subscription level prevents any user, including those with the Owner role, from deleting the subscription. This lock overrides all RBAC permissions, ensuring that while modifications to resources inside the subscription are still allowed, the subscription itself cannot be removed. This directly addresses the IT manager's concern about accidental deletion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a custom role-based access control (RBAC) role that denies the delete action for all users.
Why it's wrong here
This is incorrect because even with a custom role that denies delete, a user with the Owner role can modify or remove the custom role assignment, effectively bypassing the restriction. Resource locks are designed to override permissions for all users, including Owners.
When this WOULD be correct
This option would be correct if the question asked for a solution to prevent a specific user (e.g., with Contributor role) from deleting a resource group or resource, but not the subscription, and the requirement was to use RBAC without affecting other users.
- ✗
Configure an Azure Policy with the 'Deny' effect to block deletion of the subscription.
Why it's wrong here
This is incorrect because Azure Policy cannot be applied directly to a subscription itself; policies are assigned to scopes (management groups, subscriptions, resource groups) to enforce rules on resources within those scopes. Additionally, policies can be excluded or overridden by users with sufficient privileges. A resource lock is the appropriate tool for preventing deletion of the subscription.
When this WOULD be correct
An administrator needs to enforce that all storage accounts in a subscription must use HTTPS only. Applying an Azure Policy with 'Deny' effect on the storage account resource type would block creation of non-compliant storage accounts.
- ✓
Apply a resource lock of type 'Delete' at the subscription level.
Why this is correct
This is correct. A 'Delete' lock prevents the subscription from being deleted but allows read and update operations on the resources inside. Resource locks apply to all users, including Owners, and can be set at subscription, resource group, or resource level. This directly meets the requirement to protect against accidental deletion while still allowing modifications.
- ✗
Apply a resource lock of type 'ReadOnly' at the subscription level.
Why it's wrong here
This is incorrect because a 'ReadOnly' lock prevents both deletion and modification of the subscription and all resources within it. The requirement is to still allow modifications to resources, so a 'ReadOnly' lock is too restrictive. Only a 'Delete' lock should be used.
When this WOULD be correct
A 'ReadOnly' lock at the subscription level would be correct in a scenario where the goal is to prevent any changes to all resources within the subscription, such as for a critical production environment that must remain static for auditing or compliance purposes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Apply a resource lock of type 'Delete' at the subscription level.Correct answer▾
Why this is correct
This is correct. A 'Delete' lock prevents the subscription from being deleted but allows read and update operations on the resources inside. Resource locks apply to all users, including Owners, and can be set at subscription, resource group, or resource level. This directly meets the requirement to protect against accidental deletion while still allowing modifications.
✗Assign a custom role-based access control (RBAC) role that denies the delete action for all users.Wrong answer — click to see why▾
Why this is wrong here
Custom RBAC roles cannot override the Owner role's permissions, and even if they deny delete, the Owner role can modify or remove the role assignment, so it does not prevent subscription deletion by an Owner.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a solution to prevent a specific user (e.g., with Contributor role) from deleting a resource group or resource, but not the subscription, and the requirement was to use RBAC without affecting other users.
Why candidates choose this
Candidates may think that a custom role with explicit deny can block all users, including Owners, because they misunderstand that deny assignments in RBAC cannot override Owner permissions.
✗Configure an Azure Policy with the 'Deny' effect to block deletion of the subscription.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy with 'Deny' effect can block creation or modification of resources based on properties, but it cannot prevent the delete action on the subscription itself; subscription deletion is controlled by Azure RBAC and resource locks, not Azure Policy.
★ When this WOULD be the correct answer
An administrator needs to enforce that all storage accounts in a subscription must use HTTPS only. Applying an Azure Policy with 'Deny' effect on the storage account resource type would block creation of non-compliant storage accounts.
Why candidates choose this
Candidates may confuse Azure Policy with resource locks, thinking that a 'Deny' effect can block any action including subscription deletion, because both are used to enforce restrictions.
✗Apply a resource lock of type 'ReadOnly' at the subscription level.Wrong answer — click to see why▾
Why this is wrong here
A 'ReadOnly' lock prevents all modifications to resources, including changes to configurations and data, which is too restrictive. The question requires allowing modifications to resources inside the subscription while only preventing deletion of the subscription itself.
★ When this WOULD be the correct answer
A 'ReadOnly' lock at the subscription level would be correct in a scenario where the goal is to prevent any changes to all resources within the subscription, such as for a critical production environment that must remain static for auditing or compliance purposes.
Why candidates choose this
Candidates may confuse 'ReadOnly' locks with 'Delete' locks, thinking that a read-only lock also prevents deletion, but they overlook that it blocks all modifications, not just deletion.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Resource lock
A resource lock is a cloud governance feature that prevents accidental deletion or modification of critical cloud resources by applying a read-only or delete-only restriction at the resource, resource group, or subscription level.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.