AZ-104 Practice Question 30: Backup Soft Delete Recovery
Microsoft Azure Administrator Associate (AZ-104) · Test 3 · question 10 of 10
A compromised administrator account was used yesterday to stop protection and delete the backup data for twelve VMs in the Recovery Services vault rsv-prod, and then to try to turn soft delete off in the Azure portal. The vault is in an Azure public region and was created with the current defaults.
What is the state of the backup data, and how do you get it back?
Show answer and explanation
Answer:
Soft delete is exactly the control for "ransomware or bad actors maliciously deleted backup data," and it is now enforced: "soft delete is enforced by default as part of secure-by-default assurance for Azure Backup," it is generally available for Recovery Services vaults in "all Azure Public Regions and National Clouds," and "a soft-delete state can no longer be modified from the Azure portal", so the attacker's attempt to disable it fails. Deleted data "is retained for the specified soft-delete retention period. The retention period is 14 days by default," with no cost for those 14 days, and restoring it "returns the data to a Stop protection with retain data state. You can then use the data to perform other restore operations, or you can resume backups for this instance."
Option B gives up too early, and misstates Cross Region Restore, which restores from the vault's replicated data in the paired region; it is not a separate escape hatch for data the vault itself deleted.
Option C confuses two independent features. Vault immutability blocks operations that would shorten retention; soft delete is what governs recovery after a delete, and it applies here whether or not immutability was configured.
Option D invents a dependency. Soft-delete retention is 14 days by default and configurable from 14 to 180 days; it is a vault setting that has nothing to do with whether the vault's storage replication is LRS, ZRS, or GRS.
Reference: Secure by default with soft delete for Azure Backup