Question 32 of 1,031

Describe Azure management and governance →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is to configure a 'CanNotDelete' resource lock on both the Azure SQL Database and its server. This lock prevents accidental deletion while still allowing database administrators to change the schema and scaling settings, because resource locks only restrict delete operations, not read or update actions. On the Microsoft Azure Fundamentals AZ-900 exam, this scenario tests your understanding of how resource locks differ from role-based access control (RBAC) and Azure Policy—a common trap is confusing locks with permissions, but locks are a simple, resource-level safeguard that override any higher-level permissions. Remember the memory tip: "CanNotDelete locks the door but leaves the key in the lock for changes," meaning you can still manage and modify the resource, just not remove it entirely.

AZ-900 Describe Azure management and governance Practice Question

This AZ-900 practice question tests your understanding of describe azure management and governance. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company has deployed a production Azure SQL Database that is used by a critical line-of-business application. The database administrators need to be able to change the database schema and scaling settings. However, the operations team must ensure that no one can accidentally delete the database or its server. The company does not want to implement a complex backup strategy for this prevention; they want a simple control that can be applied at the resource level without affecting other management operations. What should the operations team configure to meet these requirements?

Question 1mediummultiple choice

Full question →

A
An Azure Policy definition with the 'Deny' effect assigned to the resource group containing the database
Why wrong: Incorrect. A Deny policy blocks all non-compliant resource creation or modification, but it does not specifically prevent deletion. It would block schema changes if they are not explicitly allowed, which contradicts the requirement.
B
A custom Azure Role-Based Access Control (RBAC) role that excludes the delete action
Why wrong: Incorrect. While a custom RBAC role could remove delete permissions, it requires careful design and assignment. It is more complex to manage and could inadvertently affect other operations. Resource locks provide a simpler, declarative control.
C
A 'CanNotDelete' resource lock on the database and the server
Correct. A 'CanNotDelete' resource lock prevents deletion of the resource while allowing all other management operations such as reading, updating, and scaling. This directly meets the requirement for a simple, resource-level control.
D
An Azure Blueprint that includes a policy enforcing a read-only state
Why wrong: Incorrect. Azure Blueprints are used to define and deploy a repeatable set of Azure resources and policies. They do not directly provide a mechanism to lock existing resources against deletion. Applying a read-only state through a blueprint would block both deletion and modifications, which is not desired.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A 'CanNotDelete' resource lock on the database and the server

A 'CanNotDelete' resource lock on the database and the server prevents accidental deletion while still allowing all other management operations, including schema changes and scaling. This meets the requirement for a simple, resource-level control that does not affect read or update permissions.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
An Azure Policy definition with the 'Deny' effect assigned to the resource group containing the database
Why it's wrong here
Incorrect. A Deny policy blocks all non-compliant resource creation or modification, but it does not specifically prevent deletion. It would block schema changes if they are not explicitly allowed, which contradicts the requirement.
✗
A custom Azure Role-Based Access Control (RBAC) role that excludes the delete action
Why it's wrong here
Incorrect. While a custom RBAC role could remove delete permissions, it requires careful design and assignment. It is more complex to manage and could inadvertently affect other operations. Resource locks provide a simpler, declarative control.
✓
A 'CanNotDelete' resource lock on the database and the server
Why this is correct
Correct. A 'CanNotDelete' resource lock prevents deletion of the resource while allowing all other management operations such as reading, updating, and scaling. This directly meets the requirement for a simple, resource-level control.
Related concept
Read the scenario before looking for a memorised answer.
✗
An Azure Blueprint that includes a policy enforcing a read-only state
Why it's wrong here
Incorrect. Azure Blueprints are used to define and deploy a repeatable set of Azure resources and policies. They do not directly provide a mechanism to lock existing resources against deletion. Applying a read-only state through a blueprint would block both deletion and modifications, which is not desired.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse Azure Policy (which enforces compliance rules across resources) with resource locks (which are simple, resource-level safeguards against accidental deletion), leading them to choose a policy or RBAC solution that is either too broad or too complex for the stated requirement.

Detailed technical explanation

How to think about this question

Resource locks in Azure operate at the resource or resource group level and override any RBAC permissions, meaning even an Owner cannot delete a locked resource. The 'CanNotDelete' lock allows all read and write operations (including schema modifications and scaling) but blocks delete and modify operations on the lock itself. This is implemented via Azure Resource Manager's lock management, which checks lock status before any delete operation is executed.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related AZ-900 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Describe cloud concepts practice questions

Practise AZ-900 questions linked to Describe cloud concepts.

Describe Azure architecture and services practice questions

Practise AZ-900 questions linked to Describe Azure architecture and services.

Describe Azure management and governance practice questions

Practise AZ-900 questions linked to Describe Azure management and governance.

AZ-900 Azure services practice questions

Practise AZ-900 questions linked to AZ-900 Azure services.

AZ-900 pricing and support practice questions

Practise AZ-900 questions linked to AZ-900 pricing and support.

AZ-900 security and compliance practice questions

Practise AZ-900 questions linked to AZ-900 security and compliance.

AZ-900 governance practice questions

Practise AZ-900 questions linked to AZ-900 governance.

Practice this exam

Start a free AZ-900 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

AZ-900 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this AZ-900 question test?

Describe Azure management and governance — This question tests Describe Azure management and governance — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: A 'CanNotDelete' resource lock on the database and the server — A 'CanNotDelete' resource lock on the database and the server prevents accidental deletion while still allowing all other management operations, including schema changes and scaling. This meets the requirement for a simple, resource-level control that does not affect read or update permissions.

What should I do if I get this AZ-900 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on AZ-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company manages its production workloads in a dedicated Azure subscription under the root management group. The infrastructure team recently created a critical resource group named 'rg-prod-core' that contains networking resources. To prevent accidental deletion of this entire resource group, the team needs a mechanism that blocks delete operations on 'rg-prod-core' while still allowing changes to resources within it. The solution must not affect any other resource groups in the subscription. Which Azure feature should the team apply to 'rg-prod-core'?

medium

A.Assign an Azure Policy with the 'deny' effect at the management group scope to block deletions of any resource group.
✓ B.Apply a resource lock with the 'CanNotDelete' setting to the resource group.
C.Create a custom RBAC role that explicitly denies the delete action, and assign it to the infrastructure team at the resource group scope.
D.Deploy an Azure Blueprint that includes a policy to audit deletions of the resource group.

Why B: Option B is correct because a resource lock with the 'CanNotDelete' setting prevents deletion of the resource group while still allowing read and update operations on resources within it. This lock applies only to the specific resource group scope, so it does not affect any other resource groups in the subscription. This directly meets the requirement to block deletion of 'rg-prod-core' without impacting other groups.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.