Which control prevents accidental deletion of a production resource group regardless of RBAC?

1. ✓ A A CanNotDelete resource lock (correct answer)
2. B Reader role
3. C A tag
4. D Azure Advisor

Shortcut: Resource locks apply to all principals including Owners. CanNotDelete blocks deletion while permitting modification; ReadOnly blocks both.