AZ-500 Question 208
Select 2You manage backups for your organization using an Azure Recovery Services vault to protect virtual machine data. Management is concerned about potential malicious or accidental deletions of backups. Which two actions should you take to improve security and ensure recoverability of your backups?
- A
Enable Soft Delete in the Recovery Services vault
- B
Turn off encryption at rest on the Recovery Services vault
- C
Apply a resource lock (Delete Lock) to the Recovery Services vault
- D
Create a shared access signature (SAS) URL for all backup data to facilitate quick access
- E
Use the built-in 'Contributor' role to give all administrators full access to manage backups
Show answer and explanation
Correct answers: A, C
Explanation
According to Microsoft best practices, enabling Soft Delete in the Recovery Services vault and applying resource locks are effective measures to protect backups from accidental or malicious deletions. Soft Delete ensures that even if a backup is removed, you can restore it within the retention period. A resource lock (such as a Delete Lock) adds an extra layer of protection by preventing the vault itself from being deleted. For more details, refer to Azure Backup documentation on Soft Delete and resource locks.
- A. Correct.
Enabling Soft Delete keeps backups in a recoverable state even if they are deleted, helping you restore in case of accidental or malicious deletion. This directly addresses the concern of ensuring recoverability.
- B. Incorrect.
Turning off encryption at rest exposes your backups to potential unauthorized data access. Azure Backup uses encryption at rest by default, and turning it off would weaken security.
- C. Correct.
Applying a Delete Lock on the Recovery Services vault prevents the vault and its contents from being deleted by mistake or intentionally, thereby improving backup security and recoverability.
- D. Incorrect.
Creating a SAS URL for all backup data grants broad access, potentially exposing backups to unauthorized access. SAS tokens are more suitable for granular data sharing scenarios, not for boosting backup deletion protection.
- E. Incorrect.
Using the built-in 'Contributor' role for all administrators grants them extensive privileges, potentially increasing the risk of accidental or malicious deletions. Least privilege access with more specific RBAC roles is recommended instead.