AZ-305 Practice Question 16: Backup Ransomware Hardening
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 2 · question 6 of 10
During a tabletop exercise, a healthcare provider's security team demonstrates that an attacker who compromises an account holding the Backup Contributor role can stop protection, delete every recovery point, and leave the organization with nothing to restore. The redesign of the Recovery Services vault must guarantee that:
- recovery points cannot be deleted before their retention expires, even by a vault administrator, - a backup policy's retention period cannot be shortened, - the protection itself cannot be switched off later by the same attacker, - accidentally deleted backup data remains recoverable for a period after deletion.
What should you include in the design?
Show answer and explanation
Answer:
An immutable vault blocks the operations that would lead to loss of recovery points: protection can be stopped only while retaining data until expiry, a policy cannot be changed to reduce retention, and a policy cannot be swapped for one with lower retention. That covers the first two requirements. The third is the reason the design must also *lock* immutability; while immutability is merely enabled it can be turned off again, and locking makes the setting irreversible and moves backups to WORM storage, so the attacker cannot undo the control. Soft delete then keeps deleted backup data recoverable for a retention window, covering the last requirement.
Option B misunderstands what a resource lock protects. CanNotDelete stops deletion of the vault resource itself; it does not stop a user from deleting recovery points or editing a backup policy inside the vault. Demoting one account also does not generalize; the next compromised account with backup permissions has the same power.
Option C builds a second, unprotected copy. The runbook runs with credentials an attacker can also use, the copies are ordinary blobs with no immutability, and Azure Backup recovery points are not portable objects you can simply copy between accounts and restore from. It adds cost and a maintenance burden while leaving the primary vault exactly as exposed.
Option D detects rather than prevents. Soft delete alone helps with accidental deletion, and the alert tells the team after the fact, but nothing in this option stops retention from being reduced or protection from being stopped with deletion of data, and soft delete without locked immutability can itself be weakened by an attacker with vault permissions.
Reference: Immutable vault for Azure Backup