SC-100: Microsoft Cybersecurity ArchitectDemo

By Microsoft · Question Mode

QuestionQ351

Design security solutions for infrastructure

You have an Azure subscription that includes virtual machines, storage accounts, and Azure SQL databases.

All resources are backed up multiple times per day using Azure Backup.

You are developing a strategy to protect against ransomware attacks.

You need to recommend which control must be enabled so that Azure Backup can be used to restore the resources if a ransomware attack succeeds.

Which control should you include in the recommendation?

  • A Perform offline backups to Azure Data Box.
  • B Use Azure Monitor notifications when backup configurations change.
  • C Encrypt backups by using customer-managed keys (CMKs).
  • D Require PINs for critical operations.
Explanation

Azure Backup provides a security feature that requires an additional layer of authentication—a security PIN generated from the Azure portal—before critical operations can be performed, such as disabling soft delete, changing backup policies to reduce retention periods, or deleting backup items and recovery points. This control prevents an attacker (or a compromised account) who has gained control of the subscription during a ransomware attack from being able to delete or tamper with existing backups, thereby ensuring that clean, recoverable backup data remains available for restoration after the attack. This is part of Microsoft's documented ransomware protection guidance for Azure Backup ('Security features to help protect Azure Backup and recovery data from ransomware attacks').

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!