AZ-900 Describe Azure management and governance Practice Question
A company stores critical configuration data in an Azure Storage account. The IT administrator wants to prevent accidental deletion of this storage account. However, the administrator must still be able to read and update the data within the storage account. The company uses Azure Role-Based Access Control (RBAC) to manage permissions. Which Azure governance feature should the administrator implement to achieve this goal?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy's deny effect with resource locks, mistakenly thinking policy can prevent deletion of existing resources, or they choose Read-only lock because they overlook the requirement to still allow data updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Delete lock on the storage account
A Delete lock on the storage account prevents deletion of the resource while still allowing read and update operations on the data within it. Azure resource locks operate at the resource level, overriding any RBAC permissions that would otherwise allow deletion, but they do not restrict data plane operations like reading or writing blobs or tables. This directly meets the administrator's requirement to protect against accidental deletion while maintaining full read/update access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy with the deny effect to block deletion of the storage account
Why it's wrong here
Azure Policy with a deny effect can block the deletion of a storage account at the Azure Resource Manager level, but it is designed to enforce organisational compliance rules across multiple resources based on conditions like tags or locations, not to protect a single specific resource from accidental deletion. The correct tool for that purpose is a resource lock, which directly prevents deletion or modification of a particular resource while still allowing data read and update operations. The deny effect is tempting because it can also block delete actions, but its broader, rule-based compliance scope over multiple resources makes it unsuitable for this targeted operational safeguard.
When this WOULD be correct
An Azure Policy with deny effect would be correct if the question asked for a way to enforce compliance rules (e.g., requiring specific tags or ensuring storage accounts are only deployed in certain regions) across multiple subscriptions, and the goal was to block non-compliant resource creation or modification, not specifically to prevent accidental deletion of a single storage account.
- ✗
An Azure Blueprint that includes the storage account with a policy to prevent deletion
Why it's wrong here
An Azure Blueprint is used to define a repeatable set of governance artifacts (policies, role assignments, etc.) for deploying environments. It is not a feature to apply a protective lock on an existing individual resource.
When this WOULD be correct
An Azure Blueprint would be correct if the question asked for a way to deploy a consistent set of resources (including a storage account) with built-in policies and RBAC assignments across multiple subscriptions, ensuring compliance with organizational standards.
- ✗
A Read-only lock on the storage account
Why it's wrong here
A Read-only lock prevents any modification or deletion of the resource. Since the administrator needs to update data within the storage account, a Read-only lock would block those updates, which does not meet the requirement.
When this WOULD be correct
In a scenario where the requirement is to prevent any modifications (including updates) to the storage account or its data, while still allowing read access. For example, an auditor needs to ensure that historical configuration data cannot be altered.
- ✓
A Delete lock on the storage account
Why this is correct
A Delete lock prevents the resource from being deleted but allows all other operations, including reading and updating data. This directly satisfies the administrator's need to protect against accidental deletion while still permitting data modifications.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Delete lock on the storage accountCorrect answer▾
Why this is correct
A Delete lock prevents the resource from being deleted but allows all other operations, including reading and updating data. This directly satisfies the administrator's need to protect against accidental deletion while still permitting data modifications.
✗Azure Policy with the deny effect to block deletion of the storage accountWrong answer — click to see why▾
Why this is wrong here
Azure Policy with deny effect can block deletion, but it does not prevent accidental deletion by users with sufficient RBAC permissions (e.g., Contributor or Owner) who can override policies. The question requires a governance feature that prevents deletion while still allowing data read/update, which is best achieved by a Delete lock (a type of CanNotDelete lock) that blocks deletion but allows modifications.
★ When this WOULD be the correct answer
An Azure Policy with deny effect would be correct if the question asked for a way to enforce compliance rules (e.g., requiring specific tags or ensuring storage accounts are only deployed in certain regions) across multiple subscriptions, and the goal was to block non-compliant resource creation or modification, not specifically to prevent accidental deletion of a single storage account.
Why candidates choose this
Candidates may think Azure Policy is the go-to solution for preventing deletion because it can enforce rules, but they overlook that RBAC permissions can override policies unless a deny assignment is explicitly set, and that locks are specifically designed to prevent accidental deletion or modification of resources.
✗An Azure Blueprint that includes the storage account with a policy to prevent deletionWrong answer — click to see why▾
Why this is wrong here
An Azure Blueprint is used to orchestrate the deployment of resource templates, policies, and role assignments, but it does not itself prevent deletion. The question asks for a governance feature to prevent accidental deletion, which is a lock, not a blueprint.
★ When this WOULD be the correct answer
An Azure Blueprint would be correct if the question asked for a way to deploy a consistent set of resources (including a storage account) with built-in policies and RBAC assignments across multiple subscriptions, ensuring compliance with organizational standards.
Why candidates choose this
Candidates may think that a blueprint, which can include policies, is a comprehensive solution for governance, and mistakenly believe it can directly prevent deletion, overlooking that locks are the specific feature for resource-level protection.
✗A Read-only lock on the storage accountWrong answer — click to see why▾
Why this is wrong here
A Read-only lock prevents all write operations, including updates to data, but the administrator must still be able to read and update data. The goal is only to prevent deletion, not to block updates.
★ When this WOULD be the correct answer
In a scenario where the requirement is to prevent any modifications (including updates) to the storage account or its data, while still allowing read access. For example, an auditor needs to ensure that historical configuration data cannot be altered.
Why candidates choose this
Candidates may confuse 'prevent deletion' with 'prevent all changes' and think a Read-only lock is the standard way to protect resources, not realizing it also blocks updates.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.