AZ-900 Describe Azure management and governance Practice Question
What are the two types of Azure Resource Locks?
⚠ Common exam trap
Watch out — candidates often confuse Azure Resource Locks with Azure Policy effects (Deny/Allow) or database lock types (Shared/Exclusive), leading them to select options that describe unrelated Azure or general IT concepts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CanNotDelete and ReadOnly
Azure Resource Locks are designed to prevent accidental deletion or modification of critical resources. The two types are CanNotDelete, which allows read and update operations but blocks deletion, and ReadOnly, which permits only read operations and blocks both deletion and update. This distinction is correct because ReadOnly is more restrictive than CanNotDelete, and both are the only lock types available in Azure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ReadOnly and ReadWrite
Why it's wrong here
ReadWrite is not a valid Azure resource lock type; Azure resource locks only support ReadOnly and CanNotDelete. While ReadOnly is one valid type, its counterpart is CanNotDelete, not ReadWrite, which sounds like a storage account access tier or permission mode rather than a lock. Selecting this option incorrectly pairs a real lock type with an invented second type.
- ✓
CanNotDelete and ReadOnly
Why this is correct
CanNotDelete and ReadOnly are the only two types of Azure resource locks. CanNotDelete blocks deletion while permitting read and modify operations, so a resource remains usable unless someone explicitly removes the lock first. ReadOnly is the stricter lock: it blocks all write or delete attempts, turning the resource into effectively read-only. These locks apply to everyone, even an Azure account Owner, and are not alternatives or typo variants of any RBAC terms.
- ✗
Shared and Exclusive
Why it's wrong here
Shared and Exclusive are lock modes used by database engines, such as SQL Server's row or table locks, to manage concurrent transactions. Azure resource locks have nothing to do with transaction concurrency or data-level locking; they are ARM-level restrictions that prevent accidental deletion or modification at the resource scope. No Azure resource lock type is called Shared or Exclusive.
- ✗
Deny and Allow
Why it's wrong here
Deny and Allow are assignment-related terms from Azure RBAC, and "Deny" also appears as an effect in Azure Policy, but neither is a resource-lock type. Resource locks are a separate governance mechanism with only two valid values: CanNotDelete and ReadOnly. Confusing these terms overlooks that a resource lock is not permission logic but a restriction that takes precedence over role assignments.
Go deeper
Related to this question
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.