A company has a critical Azure Storage account that stores immutable backups. The IT administrator wants to ensure that no one can delete or modify this storage account, even administrators with Contributor or Owner roles. The company still needs to allow read access to the data within the storage account. Which Azure governance feature should the administrator implement?

Azure Policy with Deny effect

Azure Policy with Deny effect can block the creation or modification of resources that violate compliance rules, but it does not prevent the deletion of an existing resource. It also does not inherently provide a blanket lock that protects any resource from being deleted by an Owner. This option is incorrect because the requirement is to secure an already deployed resource from deletion and modification, not to enforce compliance during deployment.

Azure Blueprint with role assignment

Azure Blueprints are used to orchestrate the deployment of resource groups, policies, role assignments, and resources in a repeatable manner. They help maintain consistency across environments but do not themselves enforce immutability on existing resources. This option is incorrect because a Blueprint cannot prevent an Owner from deleting a resource after it is deployed.

Azure role-based access control (RBAC) with Reader role

Assigning the Reader role to all users would prevent them from making changes, but it does not protect the storage account from an administrator who has the Owner or Contributor role. Those higher-privileged roles include permissions to delete resources. A resource lock is required to override the Owner's permissions. Therefore, RBAC alone is insufficient.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Azure Resource Manager read-only lock — Azure Resource Manager locks provide an additional layer of protection beyond role-based access control. A read-only lock prevents any modification or deletion of a resource, effectively making it immutable. This lock overrides all Azure role assignments, including Owner and Contributor, ensuring that even administrators cannot accidentally or intentionally delete or alter the storage account. Read operations are still permitted, which satisfies the requirement for read access. Azure Policy with 'Deny' effect is used to prevent the creation of non-compliant resources, not to lock existing resources. An Azure Blueprint is used to deploy and manage consistent environments, not to enforce immutability. RBAC with the Reader role would prevent changes if that role is assigned, but an Owner can override it; therefore, a resource lock is the correct safeguard.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.