A storage account has a CanNotDelete management lock. A team assumes this prevents every blob deletion through the data API. What should be explained?

1. The lock encrypts every blob with a new key
2. The lock guarantees all blob history is retained forever
3. The lock grants read access to all users
4. Management locks and data-plane retention controls protect different operations