AZ104-Q: prevent accidental production deletion
An administrator must prevent accidental deletion of a production resource group while allowing authorized changes to resources inside it. Which control should be applied?
- A) A Reader role assignment.
- B) A Deny Azure Policy that blocks all resource creation.
- C) A tag named
do-not-delete. - D) A CanNotDelete resource lock on the production resource group. ✓
Answer: D. A CanNotDelete lock blocks deletion while allowing authorized modification. It is a protection mechanism distinct from RBAC and Policy.
Why not the others: Reader prevents changes broadly. Policy and tags do not provide the targeted deletion safeguard in this scenario.