Microsoft Cybersecurity Architect (SC-100)Design security for applications and dataEasy
A global media company uses Azure Blob Storage to store vast amounts of video content, images, and documents. Many of these assets are subject to strict data retention policies and legal hold requirements, mandating that the data cannot be modified or deleted for a specified period, even by administrators. The company needs to implement a solution that ensures data immutability for compliance and legal purposes. Which Azure Blob Storage feature should the architect recommend to meet these requirements?
- AAzure Blob soft delete
- BAzure Blob versioning
- CStorage account access keys
- DAzure Blob immutability policies
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Blob immutability policies
Azure Blob storage immutability policies (also known as Write Once, Read Many - WORM) are designed specifically to meet compliance needs by preventing modification or deletion of data for a specified duration, even by users with administrative privileges, ensuring data integrity for legal hold and retention.
Why the other options are wrong
- A. Azure Blob soft delete protects against accidental deletion by retaining deleted data for a period, but it does not prevent modification or deletion by an authorized user, nor does it enforce WORM compliance.
- B. Azure Blob versioning maintains previous versions of a blob when it's modified or deleted, allowing for restoration, but it does not prevent modification or deletion of the current version.
- C. Storage account access keys provide full access to the storage account and do not enforce any immutability or retention policies; they are a method of authentication, not a data protection feature.
Azure Blob Immutability Policies
A feature of Azure Blob Storage that enables Write Once, Read Many (WORM) support, allowing data to be stored in a non-erasable, non-rewritable format for a specified duration.
- Prevents modification and deletion of data.
- Supports both time-based retention and legal holds.
- Ensures compliance with regulatory requirements like SEC 17a-4(f).
Memory trick: Immutability policies make Blob data 'set in stone' for compliance, no matter who tries to change it.