A company has a critical production resource group that contains several virtual machines and an Azure SQL Database. The IT manager wants to prevent anyone from accidentally deleting the resource group or any of its resources. However, authorized administrators must still be able to add, update, or delete individual resources within the group (except deletion of the group itself). Which Azure feature should the manager apply to the resource group?

Apply an Azure Policy with the 'Deny' effect to prevent all operations on the resource group.

Azure Policy 'Deny' effect blocks creation or update of resources that do not comply with policy rules, but it does not prevent deletion of existing resources or the resource group itself. Moreover, it is too broad (would block any non-compliant resource modifications) and is not designed for accidental deletion protection. Using a 'Deny' policy is incorrect for this scenario.

Apply a Read-Only lock on the resource group.

A Read-Only lock prevents any user (even with Owner permissions) from creating, updating, or deleting resources in the resource group. The requirement explicitly states that administrators must be able to add or modify resources, so this lock is too restrictive and would block those operations. Therefore, it is not the correct solution.

Remove the Contributor role from all users and assign the Owner role to the IT manager only.

Changing role assignments does not reliably prevent resource group deletion. Users with the Owner role (or even Contributor role) can delete a resource group unless a resource lock is applied. Removing Contributor roles may still leave owners who can delete, and this approach is complex and does not directly address the requirement to prevent accidental deletion while allowing modifications. It is incorrect.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Apply a CanNotDelete lock on the resource group. — Azure Resource Locks are used to prevent accidental deletion or modification of critical resources. There are two types: 'CanNotDelete' (allows all operations except deletion) and 'ReadOnly' (blocks all write operations). In this scenario, the requirement is to allow full management of resources while only blocking deletion of the resource group and its contained resources. The CanNotDelete lock is the appropriate choice because it permits creation, update, and even deletion of individual resources (if the user has permissions) but prevents the entire resource group from being deleted. If a ReadOnly lock were applied, no modifications would be allowed at all, which is too restrictive. An Azure Policy with 'Deny' effect could block specific resource actions but would not directly block deletion of the resource group itself; additionally, Deny policies are for enforcing compliance rules (e.g., requiring a tag), not for locking. Changing role assignments (option D) would not reliably prevent deletion because users with Owner or Contributor roles can still delete resource groups unless a lock is in place.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.