Microsoft Cybersecurity Architect (SC-100)Design security for infrastructureMedium
A client is designing a data archiving solution in Azure for historical financial records. These records must be stored for a minimum of 7 years and be immutable, meaning they cannot be modified or deleted, even by privileged administrators, for the entire retention period. They also need to be cost-effective for long-term storage with infrequent access. Which Azure storage solution and feature should be used?
- AAzure Data Lake Storage Gen2 with lifecycle management
- BAzure Disk Storage with snapshots
- CAzure Files with versioning
- DAzure Blob Storage (Archive tier) with time-based retention policy
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Blob Storage (Archive tier) with time-based retention policy
Azure Blob Storage (Archive tier) is highly cost-effective for long-term, infrequently accessed data. Combined with a time-based retention policy (WORM - Write Once, Read Many), it ensures immutability for the specified 7-year period, preventing modification or deletion even by privileged users.
Why the other options are wrong
- A. Azure Data Lake Storage Gen2 is for big data analytics, not primarily for immutable archival, and lifecycle management alone doesn't guarantee WORM immutability.
- B. Azure Disk Storage is for active VMs, not cost-effective archival, and snapshots don't guarantee immutability against privileged deletion.
- C. Azure Files is for file shares, not ideal for large-scale archival, and versioning allows changes, not immutability.
Azure Blob Immutability Policy
A feature of Azure Blob Storage that allows users to store business-critical data in a Write Once, Read Many (WORM) state.
- Data cannot be overwritten or deleted for a specified retention interval.
- Protects against accidental deletion, malicious activity, and compliance violations.
- Supports both time-based retention and legal holds.
Memory trick: Archive Tier + Immutability = WORM for the long haul.