QuestionQ116

Design security solutions for infrastructure

You have an Azure subscription that includes virtual machines, storage accounts, and Azure SQL databases.

All resources are backed up several times per day by using Azure Backup.

You are developing a strategy to protect against ransomware attacks.

You need to recommend the controls that must be enabled to ensure Azure Backup can restore the resources following a successful ransomware attack.

Which two controls should you include in the recommendation? Each correct answer presents a complete solution.

> NOTE: Each correct selection is worth one point.

Choose two
  • A Enable soft delete for backups.
  • B Require PINs for critical operations.
  • C Encrypt backups by using customer-managed keys (CMKs).
  • D Perform offline backups to Azure Data Box.
  • E Use Azure Monitor notifications when backup configurations change.
Explanation

Soft delete preserves deleted backup data for a retention period, allowing recovery after accidental or malicious deletion. Requiring security PINs for critical operations adds an additional authentication control before destructive changes to online backups, helping prevent an attacker from deleting or weakening backups needed for restoration.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!