Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
CannotDelete Locks Allow Updates Without Deletion Risk
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An administrator manages a mission-critical Azure storage account that hosts essential business data. The operations team frequently performs routine maintenance tasks that require updating the storage account settings and reading data.
To ensure business continuity, the administrator must prevent any user—including administrators—from accidentally deleting the storage account while still allowing normal configuration modifications and updates.
Which solution should the administrator implement?
Explanations
Apply resource tags indicating the production status to the storage account
Apply resource tags indicating the production status to the storage account
What Resource Tags Are
Resource tags are metadata key-value pairs applied to Azure resources to support logical categorization, cost tracking, department billing, and asset inventory management.
Why It Doesn't Meet the Requirement
Resource tags are purely informational metadata and do not enforce any operational restrictions. Adding a tag such as Environment: Production or DoNotDelete: True does not technically restrict any user from deleting or altering the resource.
Key Characteristics and Limitations
- Informational Only: Tags do not restrict control plane actions such as write or delete.
- No Deletion Prevention: Users with appropriate RBAC permissions can still delete tagged resources.
- Useful for Reporting: Primarily intended for filtering, billing allocation, and search organization.
This Answer Would Be Correct If
The organization needed to categorize resources for cost analysis, departmental accounting, or governance reporting across multiple subscriptions.
Additional Context
While tags can help identify critical infrastructure during audits, they must be combined with governance features like Resource Locks to physically prevent accidental deletion.
Apply a ReadOnly resource lock to the storage account
Apply a ReadOnly resource lock to the storage account
What a ReadOnly Resource Lock Is
A ReadOnly resource lock restricts a resource so that authorized users can only read its settings, preventing anyone from modifying the configuration or deleting the resource.
Why It Doesn't Meet the Requirement
While a ReadOnly lock successfully prevents deletion, it also blocks all configuration changes and maintenance operations. In the scenario, the team must be able to regularly modify storage account properties and settings. Applying a ReadOnly lock would block these required administrative updates and prevent POST operations such as listing storage access keys.
Key Characteristics and Limitations
- Blocks All Modifications: Prevents updating resource properties, tags, or settings.
- Restricts Control Plane Operations: Disallows operations like key rotation and listing account keys through Resource Manager.
- Too Restrictive for Active Workloads: Interacts with services in ways that may halt ongoing maintenance tasks.
This Answer Would Be Correct If
A ReadOnly lock would be the right choice if the storage account were in a frozen, archive-only state where no configuration changes or writes were permitted under any circumstances.
Additional Context
Both ReadOnly and CannotDelete protect against deletion, but CannotDelete is designed specifically for workloads that remain actively maintained and updated.
Apply a CannotDelete resource lock to the storage account
Apply a CannotDelete resource lock to the storage account
What a CannotDelete Resource Lock Is
An Azure Resource Manager resource lock with the CannotDelete (or CanNotDelete) level is a governance mechanism that prevents authorized users from accidentally or intentionally deleting an Azure resource, while still allowing them to read and modify its settings.
How It Meets the Requirements
- Prevents Accidental Deletion: Applying a CannotDelete lock creates an explicit restriction at the Azure Resource Manager control plane that blocks all delete operations on the storage account.
- Permits Configuration Changes: Unlike stricter lock types, CannotDelete allows administrators and authorized engineers to continue modifying account configurations, updating network rules, and performing standard maintenance.
- Applies Across All Permission Levels: Resource locks apply to all users, even those assigned high-privilege built-in roles such as Owner or Contributor, ensuring that a careless command or misclick cannot destroy critical infrastructure.
Key Advantages and Capabilities
- Targeted Protection: Can be applied at the subscription, resource group, or individual resource scope.
- Independent of Role Assignments: Restricts deletion actions without requiring custom RBAC role configurations.
- Inheritance Support: Child resources automatically inherit locks configured on parent scopes such as resource groups.
- Quick Override Workflow: If an administrator genuinely needs to delete the resource, they must first explicitly remove the lock, adding a crucial safeguard step.
Why This Is Optimal
A CannotDelete lock is the optimal choice because it precisely satisfies both business requirements: blocking destructive deletion actions while enabling normal administrative updates without disrupting operational workflows.
Assign the Reader role to all administrators on the storage account
Assign the Reader role to all administrators on the storage account
What the Reader Role Is
The Reader role is a built-in Azure role-based access control (Azure RBAC) role that grants view-only access to management plane resources without granting permission to alter settings or delete resources.
Why It Doesn't Meet the Requirement
Assigning administrators the Reader role strips away their ability to modify configurations and perform maintenance tasks. The scenario requires the team to continue performing updates to the storage account settings, which requires contributor or owner privileges.
Key Characteristics and Limitations
- View-Only Access: Allows users to inspect resource definitions but prohibits all write and delete operations.
- Disrupts Administrative Duties: Prevents administrators from making necessary operational adjustments.
- Does Not Provide Deletion Locks: RBAC controls general access permissions rather than placing explicit safeguards on critical resources against privileged accounts.
This Answer Would Be Correct If
The goal were to grant external auditors or monitoring teams visibility into resource configurations without granting them any ability to make changes.
Additional Context
Azure RBAC defines what actions a user or group is authorized to perform, whereas Resource Locks place global safeguards on the resource itself regardless of user permissions.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
CanNotDelete Resource Lock
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Lock Types
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
CanNotDelete Resource Lock Removal
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Owner Role vs CanNotDelete Resource Lock
Describe the purpose of resource locks
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure App Service and Azure SQL Database PaaS
Describe platform as a service (PaaS)
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Container Apps vs AKS
Recommend a container-based solution
Last updated Validated