AZ-500 Question 210
Select 2You work as an Azure administrator for a company that uses Azure Backup to protect critical data. The security team wants to ensure that if an attacker gains unauthorized access to the Recovery Services vault, the backups remain recoverable even if the attacker attempts to delete them. They also want to ensure that only authorized personnel can change backup policies. Which TWO actions should you take to implement these requirements?
- A
Enable soft delete for the Recovery Services vault
- B
Grant the Backup Contributor role to all IT developers by default
- C
Require multi-factor authentication for critical operations on the vault
- D
Store your encryption keys in an unsecured on-premises file share to speed up access
Show answer and explanation
Correct answers: A, C
Explanation
Soft delete is a vital safeguard in Azure Backup that helps protect against accidental or intentional deletion of backup data by retaining deleted items for an extended period. Combining it with multi-factor authentication for critical operations adds an extra layer of security by requiring additional user verification. For reference, see Microsoft Docs on 'Security features in Azure Backup' (https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-features).
- A. Correct.
Option 1: Correct. Enabling soft delete retains backup data for an additional 14 days (by default) after a delete operation, providing protection against malicious or accidental deletion. It is a recommended security feature in Azure Backup.
- B. Incorrect.
Option 2: Incorrect. Granting the Backup Contributor role to all IT developers is too broad and violates the principle of least privilege. You should only grant roles to those who really need them to manage or restore backups.
- C. Correct.
Option 3: Correct. Requiring multi-factor authentication (MFA) ensures that critical operations (like disabling soft delete or changing backup policies) require an additional verification step. This greatly reduces the risk of unauthorized changes if an attacker gains credentials.
- D. Incorrect.
Option 4: Incorrect. Storing encryption keys in an unsecured file share exposes them to theft, defeating the purpose of encrypting backups. Keys should instead be securely managed, for example, in Azure Key Vault.