A storage account has a CanNotDelete lock. A user with Owner rights on the subscription tries to delete it. What happens?
A.Deletion succeeds — Owner overrides all locks
Locks override permissions by design — that's their entire purpose.
B.Deletion is blocked until the lock is removed
Block stands until lock removal. Correct.
C.Deletion succeeds after MFA confirmation
Locks don't have an MFA bypass path.
D.The resource moves to a 'soft deleted' state
Soft delete is a storage data-protection feature — unrelated to the lock.
Why this answer
Locks apply at the control-plane level for ALL users — including Owners. The lock must be explicitly removed before the protected action succeeds. Locks also inherit downward (subscription lock → all child resources).
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Governance practice session.
Practice Identity & Governance