AZ-900 Describe Azure management and governance Practice Question
A company has a critical production resource group that contains several virtual machines and an Azure SQL Database. The IT manager wants to prevent anyone from accidentally deleting the resource group or any of its resources. However, authorized administrators must still be able to add, update, or delete individual resources within the group (except deletion of the group itself). Which Azure feature should the manager apply to the resource group?
⚠ Common exam trap
Many candidates confuse Azure Policy with resource locks, mistakenly thinking a Deny policy can be scoped to only block deletion, when in fact Azure Policy effects like 'Deny' apply to all operations defined in the policy rule, not just delete actions, whereas a CanNotDelete lock is specifically designed to block only deletion at the resource group or resource level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a CanNotDelete lock on the resource group.
A CanNotDelete lock on the resource group prevents deletion of the group itself while still allowing authorized administrators to add, update, or delete individual resources within the group. This lock type specifically blocks delete operations on the locked scope, but does not restrict read, write, or other management operations, aligning perfectly with the requirement to protect the resource group from accidental deletion while permitting ongoing resource management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply an Azure Policy with the 'Deny' effect to prevent all operations on the resource group.
Why it's wrong here
Azure Policy 'Deny' effect blocks creation or update of resources that do not comply with policy rules, but it does not prevent deletion of existing resources or the resource group itself. Moreover, it is too broad (would block any non-compliant resource modifications) and is not designed for accidental deletion protection. Using a 'Deny' policy is incorrect for this scenario.
When this WOULD be correct
This option would be correct if the requirement was to prevent any changes to the resource group and all its resources, such as enforcing a compliance rule that no modifications are allowed to a critical environment.
- ✗
Apply a Read-Only lock on the resource group.
Why it's wrong here
A Read-Only lock prevents any user (even with Owner permissions) from creating, updating, or deleting resources in the resource group. The requirement explicitly states that administrators must be able to add or modify resources, so this lock is too restrictive and would block those operations. Therefore, it is not the correct solution.
When this WOULD be correct
This option would be correct if the requirement were to prevent any changes to the resource group and its resources, allowing only read access, such as for auditing or compliance purposes where no modifications are permitted.
- ✓
Apply a CanNotDelete lock on the resource group.
Why this is correct
A CanNotDelete lock allows all operations (read, create, update, delete of individual resources) except the deletion of the locked scope (the resource group in this case). This exactly matches the requirement: authorized administrators can manage resources normally, but the entire resource group and all its resources are protected from accidental deletion. This is the correct choice.
- ✗
Remove the Contributor role from all users and assign the Owner role to the IT manager only.
Why it's wrong here
Changing role assignments does not reliably prevent resource group deletion. Users with the Owner role (or even Contributor role) can delete a resource group unless a resource lock is applied. Removing Contributor roles may still leave owners who can delete, and this approach is complex and does not directly address the requirement to prevent accidental deletion while allowing modifications. It is incorrect.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to restrict all management operations (including adding, updating, and deleting resources) to a single administrator, and all other users should have no access to the resource group. For example, a question stating: 'The IT manager wants to ensure that only they can make any changes to the resource group, and all other users must be completely blocked from performing any operations.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Apply a CanNotDelete lock on the resource group.Correct answer▾
Why this is correct
A CanNotDelete lock allows all operations (read, create, update, delete of individual resources) except the deletion of the locked scope (the resource group in this case). This exactly matches the requirement: authorized administrators can manage resources normally, but the entire resource group and all its resources are protected from accidental deletion. This is the correct choice.
✗Apply an Azure Policy with the 'Deny' effect to prevent all operations on the resource group.Wrong answer — click to see why▾
Why this is wrong here
Applying a Deny effect Azure Policy would block all operations, including authorized administrators from adding, updating, or deleting individual resources, which contradicts the requirement that they must be able to do so.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to prevent any changes to the resource group and all its resources, such as enforcing a compliance rule that no modifications are allowed to a critical environment.
Why candidates choose this
Candidates may think that a 'Deny' policy is the strongest way to prevent deletion, but they overlook that it also blocks other management operations that are still required.
✗Apply a Read-Only lock on the resource group.Wrong answer — click to see why▾
Why this is wrong here
A Read-Only lock prevents all modifications, including adding, updating, or deleting individual resources, which contradicts the requirement that authorized administrators must be able to perform these actions.
★ When this WOULD be the correct answer
This option would be correct if the requirement were to prevent any changes to the resource group and its resources, allowing only read access, such as for auditing or compliance purposes where no modifications are permitted.
Why candidates choose this
Candidates may confuse locks with policies or think that a Read-Only lock is the standard way to prevent accidental deletion, not realizing it also blocks legitimate updates.
✗Remove the Contributor role from all users and assign the Owner role to the IT manager only.Wrong answer — click to see why▾
Why this is wrong here
Removing the Contributor role from all users and assigning the Owner role to the IT manager only would prevent all users except the IT manager from making changes, but it does not prevent accidental deletion by the IT manager or other authorized administrators. The requirement is to allow authorized administrators to add, update, or delete individual resources while preventing deletion of the resource group itself, which is achieved by a CanNotDelete lock, not by role changes.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to restrict all management operations (including adding, updating, and deleting resources) to a single administrator, and all other users should have no access to the resource group. For example, a question stating: 'The IT manager wants to ensure that only they can make any changes to the resource group, and all other users must be completely blocked from performing any operations.'
Why candidates choose this
Candidates may think that restricting permissions to a single user is a simple way to prevent accidental deletions, overlooking that locks provide a more granular control that allows authorized users to perform operations while still protecting against deletion.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Azure SQL Database
Azure SQL Database is a fully managed relational database-as-a-service (DBaaS) in Microsoft Azure, based on the SQL Server engine, that handles scaling, backups, patching, and high availability automatically.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.