A company has an Azure subscription that contains production resources. The IT manager is concerned that a user who has the Contributor role might accidentally delete the entire subscription. The company wants a solution that prevents anyone from deleting the subscription, even users with the Owner role, while still allowing modifications to the resources inside the subscription. What should the administrator configure?

Assign a custom role-based access control (RBAC) role that denies the delete action for all users.

This is incorrect because even with a custom role that denies delete, a user with the Owner role can modify or remove the custom role assignment, effectively bypassing the restriction. Resource locks are designed to override permissions for all users, including Owners.

Configure an Azure Policy with the 'Deny' effect to block deletion of the subscription.

This is incorrect because Azure Policy cannot be applied directly to a subscription itself; policies are assigned to scopes (management groups, subscriptions, resource groups) to enforce rules on resources within those scopes. Additionally, policies can be excluded or overridden by users with sufficient privileges. A resource lock is the appropriate tool for preventing deletion of the subscription.

Apply a resource lock of type 'ReadOnly' at the subscription level.

This is incorrect because a 'ReadOnly' lock prevents both deletion and modification of the subscription and all resources within it. The requirement is to still allow modifications to resources, so a 'ReadOnly' lock is too restrictive. Only a 'Delete' lock should be used.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Apply a resource lock of type 'Delete' at the subscription level. — Resource locks in Azure provide a way to protect resources from accidental deletion or modification. A 'Delete' lock at the subscription level prevents any user or process from deleting the subscription itself, but still allows read and update operations on the resources within. This lock applies to all users, including those with the Owner role, because locks override any RBAC permissions. In contrast, a 'ReadOnly' lock would also block modifications. Azure Policy and role-based access control (RBAC) do not provide this type of override; policies enforce compliance rules but can be excluded, and RBAC assignments can be changed by owners. Azure Blueprints is used for orchestration of resource templates, not for protecting against deletion.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.