Microsoft Azure Fundamentals (AZ-900)Describe Azure management and governanceHard
A financial services company needs to ensure that all sensitive customer data stored in Azure Blob Storage is protected against accidental deletion or modification for a period of seven years, even by administrators. Which Azure storage feature should they implement?
- AVersioning for blobs
- BBlob soft delete
- CImmutable storage with a time-based retention policy
- DAzure Backup
Show answer & explanationAnswer & explanation
Correct answer: C. Immutable storage with a time-based retention policy
Immutable storage for Azure Blob Storage, configured with a time-based retention policy, prevents data from being deleted or modified for a specified duration, even by users with administrative privileges. This meets the strict requirement for protection against accidental deletion/modification by administrators for a long period.
Why the other options are wrong
- A. Versioning for blobs maintains previous versions of a blob but doesn't prevent overwriting or deletion of the current or older versions by an authorized user.
- B. Blob soft delete protects against accidental deletion but allows data to be permanently deleted by an administrator after the retention period.
- D. Azure Backup is a backup and restore service; while it protects data, immutable storage directly addresses the 'no deletion/modification' requirement for the primary data itself.
Immutable Storage for Azure Blob Storage
A feature that allows Blob Storage data to be stored in a write-once, read-many (WORM) state, preventing modification or deletion for a specified retention period.
- Data cannot be deleted or modified.
- Supports time-based retention policies.
- Protects against administrative malicious actions.
- Essential for regulatory compliance.
Memory trick: Immutable storage: The data is frozen in time, no changes allowed.