An admin accidentally deleted a production VM last month. Which feature prevents accidental deletion or modification of resources going forward?
A.Azure Policy
Policy can deny certain actions but isn't the named mechanism for delete protection.
B.Resource locks (CanNotDelete / ReadOnly)
Locks exist precisely for accidental delete/modify protection. Correct.
C.Azure Advisor recommendations
Advisor recommends — it doesn't prevent actions.
D.Availability zones
Availability zones protect against datacenter failure, not admin mistakes.
Why this answer
Resource locks apply to subscriptions, resource groups, or individual resources: CanNotDelete allows read/modify but blocks deletion; ReadOnly blocks modification and deletion. Locks apply regardless of permissions — even owners must remove the lock first.
Correct answer: B · Last reviewed 2026-02-13
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Management & Governance practice session.
Practice Management & Governance