City platform engineers want one control that protects every resource inside the production resource group from accidental deletion. Where should they apply a CanNotDelete lock for that inheritance effect?
Select an answer to reveal the explanation.
Short Explanation
Lock the resource group and the kids inherit the protection. Chasing every NIC one by one is how something gets missed. Scope the lock where the whole production pile lives.
Full Explanation
Applying a lock at resource group scope protects the group and applies to the resources within that group for the lock’s restriction. That is an efficient way to safeguard an entire production set. Locking one child resource does not protect siblings. Entra tenant settings and external DNS are unrelated scopes for this Azure resource-lock goal.