Explanation:

Azure provides resource locks to prevent accidental changes or deletion of critical resources. This is a core governance feature covered in the Microsoft Azure Administrator (AZ-104) study materials under resource management and protection.
To prevent administrators from inadvertently modifying resources in a resource group, you must apply a ReadOnly lock at the resource group scope. A ReadOnly lock allows users to view resources but blocks any modification or deletion, even for users with high privileges, unless the lock is first removed.
There are two primary lock levels in Azure:
ReadOnly - Users can read resources but cannot modify or delete them.
CanNotDelete (Delete) - Users can modify resources but cannot delete them.
Since the requirement is to prevent modification, the correct lock level is ReadOnly, not DeleteResources or CanNotDelete.
From Microsoft Azure Administrator documentation:
"A ReadOnly lock prevents users from making changes to a resource. Authorized users can still remove the lock if needed." To create this lock using PowerShell, the correct cmdlet is New-AzResourceLock, which is used to create management locks at the subscription, resource group, or resource level.
Applying the lock to RG1 ensures all resources within the group inherit the protection, meeting the requirement with minimal administrative effort.
Correct PowerShell Command (Conceptual Form)
New-AzResourceLock `
-LockName LockGroup `
-LockLevel ReadOnly `
-ResourceGroupName RG1
Final Hotspot Selections
Cmdlet: New-AzResourceLock
LockName: LockGroup
LockLevel: ReadOnly
ResourceGroupName: RG1