AZ-900 Describe Azure management and governance Practice Question
A company has deployed a critical production application in an Azure resource group. The security team wants to prevent accidental deletion or modification of any resources within that resource group. They have already configured Azure RBAC roles to grant only necessary permissions to the operations team. However, they need an additional protection that even users with Owner permissions cannot delete the resource group or its resources without a two-step process to remove the protection. Which Azure feature should the company implement?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy with Azure Resource Lock, thinking that a policy can prevent deletion, but policies only audit or enforce configuration rules and do not block delete operations at the resource manager level like a lock does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Lock
Azure Resource Lock is the correct feature because it provides a protection mechanism that prevents accidental deletion or modification of resources, even for users with Owner permissions. Unlike RBAC, which controls who can perform actions, a resource lock enforces a restriction that must be explicitly removed (a two-step process) before any changes can be made. This directly addresses the requirement for an additional layer of protection beyond role-based access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy enforces organisational standards by auditing or denying resource creation and modification based on defined rules. While it can prevent specific actions, it does not implement a *lock* that requires a separate, explicit removal step to protect resources from deletion, even by Owners. An Owner with policy management permissions could potentially disable the policy itself. It is tempting as it enforces governance, and would be correct for scenarios like ensuring all resources are tagged or denying the deployment of specific resource SKUs or regions.
When this WOULD be correct
An exam question where the requirement is to enforce organizational standards (e.g., all resources must have a cost center tag) or audit resource configurations across subscriptions would make Azure Policy the correct answer.
- ✓
Azure Resource Lock
Why this is correct
Azure Resource Locks (CanNotDelete or ReadOnly) prevent accidental deletion or modification of resources. Even users with Owner permissions must remove the lock before they can delete the resource, ensuring a two-step process. This meets the stated requirement exactly.
- ✗
Azure Blueprint
Why it's wrong here
Azure Blueprints orchestrate the deployment of resource groups, policies, role assignments, and ARM template artifacts so environments are created consistently. They act at deployment time, not at runtime: once a resource is live, a blueprint has no intrinsic mechanism to force a two-step deletion or modification guard. Deleting a blueprint or its assignment does not lock existing resources; protection against deletion requires an explicit Azure Resource Lock on the resource or its resource group.
When this WOULD be correct
A company needs to ensure that all Azure resources in a subscription comply with organizational standards (e.g., requiring specific tags or enforcing encryption). Azure Blueprint would be correct to define and deploy a repeatable set of policies, role assignments, and resource templates across multiple environments.
- ✗
Azure Resource Tag
Why it's wrong here
Tags are key-value metadata used for cost tracking, resource organization, and automation filtering, but they carry no enforcement semantics. A tag such as 'do-not-delete' is purely informational; nothing in Azure's control plane consults tags to block Delete or Update operations unless you explicitly chain them to an Azure Policy effect like deny, which still requires policy evaluation rather than a lock. Unlike a Resource Lock, tags do not create a permission block that an Owner must remove before deletion.
When this WOULD be correct
A company needs to categorize resources by cost center and enforce that all resources in a resource group have a specific tag. The correct answer would be Azure Resource Tag to apply and manage these metadata labels.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Resource LockCorrect answer▾
Why this is correct
Azure Resource Locks (CanNotDelete or ReadOnly) prevent accidental deletion or modification of resources. Even users with Owner permissions must remove the lock before they can delete the resource, ensuring a two-step process. This meets the stated requirement exactly.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy enforces compliance rules (e.g., requiring specific tags or SKUs) but does not prevent deletion or modification by authorized users; it cannot block actions by users with Owner permissions.
★ When this WOULD be the correct answer
An exam question where the requirement is to enforce organizational standards (e.g., all resources must have a cost center tag) or audit resource configurations across subscriptions would make Azure Policy the correct answer.
Why candidates choose this
Candidates may confuse policy-based governance (Azure Policy) with operational protection (Resource Lock), thinking that a policy can block deletion actions when it only evaluates and enforces resource properties.
✗Azure BlueprintWrong answer — click to see why▾
Why this is wrong here
Azure Blueprint is used for orchestrating the deployment of resource templates and policies to create consistent environments, not for preventing deletion or modification of existing resources. It does not provide a lock mechanism that requires a two-step process to remove.
★ When this WOULD be the correct answer
A company needs to ensure that all Azure resources in a subscription comply with organizational standards (e.g., requiring specific tags or enforcing encryption). Azure Blueprint would be correct to define and deploy a repeatable set of policies, role assignments, and resource templates across multiple environments.
Why candidates choose this
Candidates may confuse Blueprint's role in enforcing compliance with the need to protect resources from deletion, as both involve governance. The term 'blueprint' suggests a plan to prevent changes, leading to this incorrect association.
✗Azure Resource TagWrong answer — click to see why▾
Why this is wrong here
Azure Resource Tags are metadata labels used for organizing resources, not for preventing deletion or modification. They do not provide any access control or protection against accidental changes.
★ When this WOULD be the correct answer
A company needs to categorize resources by cost center and enforce that all resources in a resource group have a specific tag. The correct answer would be Azure Resource Tag to apply and manage these metadata labels.
Why candidates choose this
Candidates might confuse tags with locks because both are applied to resources, but tags serve organizational purposes, not security controls. The word 'protection' in the question may mislead them into thinking tags can prevent deletion.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.