Microsoft Cybersecurity Architect (SC-100)Design security for applications and dataMedium
A global e-commerce company uses Azure Blob Storage to store customer images, product catalogs, and historical order data. Due to regulatory compliance (e.g., GDPR, PCI DSS), the company must ensure that certain critical data, once written, cannot be modified or deleted for a specified retention period. This is crucial for audit trails and legal hold requirements. Which Azure Blob Storage feature should be configured?
- AAzure Storage Firewalls and Virtual Networks
- BSoft Delete for Blobs
- CImmutability policies for Blob Storage
- DBlob versioning
Show answer & explanationAnswer & explanation
Correct answer: C. Immutability policies for Blob Storage
Immutability policies for Blob Storage allow you to store business-critical data in a WORM (Write Once, Read Many) state, meaning data cannot be modified or deleted for a specified retention interval or until a legal hold is removed, directly addressing the compliance requirement.
Why the other options are wrong
- A. Azure Storage Firewalls and Virtual Networks control network access to the storage account, not the immutability of data within it.
- B. Soft delete provides a recovery option for accidentally deleted blobs but does not prevent modification or deletion during a retention period.
- D. Blob versioning keeps previous versions of a blob, allowing recovery from changes, but doesn't prevent current versions from being modified or deleted.
Azure Blob Storage Immutability Policies
A feature that allows storing business-critical data in a Write Once, Read Many (WORM) state, preventing modification or deletion for a specified retention period or until a legal hold is removed.
- Enforces WORM state for compliance.
- Prevents modification or deletion of data.
- Supports time-based retention and legal holds.
- Crucial for regulatory compliance and audit trails.
Memory trick: Immutability policies freeze your data, like an ice cube, unchangeable.