AZ-500 Question 162
Select 2You manage a business-critical Azure Storage account that holds confidential financial records. A new regulatory requirement mandates that certain documents must remain non-modifiable (WORM compliant) for a minimum of 14 days. The security team also wants to ensure that any accidental or malicious deletions can be easily reversed. Which two configurations should you implement to meet these requirements?
- A
Enable Soft Delete for blobs at the storage account level.
- B
Enable Blob versioning for the container hosting financial records.
- C
Configure a time-based retention policy in a container set to immutable (WORM) mode.
- D
Enable hierarchical namespace for the storage account.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the regulatory requirement for non-modifiable (WORM-compliant) storage, you must configure an immutable container with a time-based retention policy (Option 3). Enabling Soft Delete (Option 1) ensures that any accidentally or maliciously deleted blobs can be recovered. These two features work together to provide regulatory compliance and data protection. Refer to Azure documentation on 'Immutable storage for Azure Blobs' and 'Soft delete for blobs' for detailed guidance.
- A. Correct.
Option 1 (Correct): Enabling Soft Delete for blobs allows you to recover data if it is accidentally or maliciously deleted. This feature retains deleted blobs for a specified time, during which you can restore them.
- B. Incorrect.
Option 2 (Incorrect): Blob versioning helps mitigate accidental overwrites by maintaining previous versions of blobs. However, on its own, it does not enforce a WORM policy or guarantee immutability for compliance with regulatory retention requirements.
- C. Correct.
Option 3 (Correct): Configuring a time-based retention policy in an immutable container (WORM mode) prevents blobs from being modified or deleted until the retention period expires, fulfilling the regulatory need for non-modifiable storage. This is essential for financial records requiring a fixed retention period.
- D. Incorrect.
Option 4 (Incorrect): Enabling hierarchical namespace is primarily used for Azure Data Lake Storage Gen2 scenarios, such as managing data in a data lake environment. It does not directly address WORM compliance or accidental deletion recovery.