AZ-104 Question 39
Single answerYou are an Azure Administrator for a company that has a resource group named 'DataRG' which contains a mission-critical Azure Storage account named 'ProdStorage'. The company is concerned about accidental deletion of 'ProdStorage' but wants to allow modifications, such as adding new containers or updating access tiers. Which is the best way to ensure 'ProdStorage' isn't deleted by mistake while continuing to allow the required updates?
- A
Create a resource policy that denies the Delete operation for the entire resource group
- B
Apply a ReadOnly lock on 'ProdStorage' to prevent any changes or deletions
- C
Configure a Delete lock on 'ProdStorage' to prevent its removal while allowing modifications
- D
Revoke the Contributor role from all users who have access to 'ProdStorage'
Show answer and explanation
Correct answer: C
Explanation
The Delete lock achieves the goal of preventing the accidental removal of the resource while still permitting updates and other operations that are necessary for managing the storage account.
- A. Incorrect.
This would block all Delete operations on every resource in the group, which may be too restrictive if you only need to protect 'ProdStorage'.
- B. Incorrect.
A ReadOnly lock prevents both deletions and updates, which goes beyond the requirement and disallows necessary modifications.
- C. Correct.
A Delete lock specifically prevents the resource from being deleted while allowing other operations, such as updates.
- D. Incorrect.
Removing the Contributor role would block essential contributions and configurations, not just the delete action.