You manage a production resource group named RG-Finance that contains several critical virtual machines. To prevent accidental deletion of any resource in the group while still allowing administrators to start, stop, and resize the VMs, you apply a lock at the resource group scope. Which lock type should you configure?