Microsoft Cybersecurity Architect (SC-100)Design security for infrastructureMedium

A client is designing a data archiving solution in Azure for historical financial records. These records must be stored for a minimum of 7 years and be immutable, meaning they cannot be modified or deleted, even by privileged administrators, for the entire retention period. They also need to be cost-effective for long-term storage with infrequent access. Which Azure storage solution and feature should be used?

  1. AAzure Data Lake Storage Gen2 with lifecycle management
  2. BAzure Disk Storage with snapshots
  3. CAzure Files with versioning
  4. DAzure Blob Storage (Archive tier) with time-based retention policy
Show answer & explanation

Correct answer: D. Azure Blob Storage (Archive tier) with time-based retention policy

Azure Blob Storage (Archive tier) is highly cost-effective for long-term, infrequently accessed data. Combined with a time-based retention policy (WORM - Write Once, Read Many), it ensures immutability for the specified 7-year period, preventing modification or deletion even by privileged users.

Why the other options are wrong

  • A. Azure Data Lake Storage Gen2 is for big data analytics, not primarily for immutable archival, and lifecycle management alone doesn't guarantee WORM immutability.
  • B. Azure Disk Storage is for active VMs, not cost-effective archival, and snapshots don't guarantee immutability against privileged deletion.
  • C. Azure Files is for file shares, not ideal for large-scale archival, and versioning allows changes, not immutability.

Azure Blob Immutability Policy

A feature of Azure Blob Storage that allows users to store business-critical data in a Write Once, Read Many (WORM) state.

  • Data cannot be overwritten or deleted for a specified retention interval.
  • Protects against accidental deletion, malicious activity, and compliance violations.
  • Supports both time-based retention and legal holds.

Memory trick: Archive Tier + Immutability = WORM for the long haul.

More Design security for infrastructure questions