A company has a production resource group that contains several Azure virtual machines and a SQL database. The company wants to ensure that no user can accidentally delete these resources, but authorized administrators must still be able to modify the configuration and update the resources. The company needs a straightforward governance feature that can be applied directly to the resource group and can be removed only by an authorized user with the Owner role. Which Azure feature should the company use?

Azure Policy with a Deny effect to block resource deletions.

Azure Policy can deny certain actions on resources based on properties, but it is not the most direct or straightforward feature for preventing accidental deletion of an entire resource group. Resource locks are designed specifically for this purpose and are simpler to apply.

A Read-Only lock on the resource group.

A Read-Only lock prevents both modification and deletion. Since the scenario requires that authorized administrators can still update resources, a Read-Only lock would block those updates and is therefore incorrect.

An Azure RBAC role assignment that excludes the Delete action for all users.

While RBAC can be used to deny delete permissions, it requires creating a custom role and carefully managing assignments for all users. This approach is more complex and error-prone compared to applying a resource lock. Resource locks provide a simpler, more robust solution for this specific requirement.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: A Delete lock on the resource group. — Resource locks are a governance feature in Azure that prevent accidental deletion or modification of critical resources. A Delete lock allows all operations except deletion, making it the correct choice for this scenario. A Read-Only lock would also prevent modifications, which is not desired. Azure Policy can enforce rules on resource properties but is not the simplest tool for preventing deletion of an entire resource group. Azure RBAC can be configured to deny delete permissions, but this requires custom role definitions and assignments, which is more complex than applying a resource lock. Resource locks are easy to apply at the resource group level and can only be changed by users with Owner or User Access Administrator roles.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.