AZ-305 Practice Question 45: Worm Records Retention
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 5 · question 5 of 10
A broker-dealer must retain trade confirmations as blobs for seven years in a form that satisfies SEC Rule 17a-4(f). The compliance officer sets these conditions:
- once written, a confirmation cannot be modified or deleted for seven years, not by an application, and not by a user with storage account administrative privileges, - the retention period must not be shortenable, and the policy must not be removable, - when litigation begins, a specific set of records must stay immutable indefinitely, regardless of where they are in the seven-year clock, and the hold must carry the case identifier.
Which design should you recommend?
Show answer and explanation
Answer:
Immutable storage holds blob data in a WORM state, and Microsoft states that it ensures data can't be modified or deleted by any user, not even by users with account administrative privileges. An independent assessment validated it against SEC Rule 17a-4(f), CFTC 1.31 and FINRA 4511, but only when the time-based retention policy is *locked*: the documentation is explicit that a policy must be locked for the blob to be in a compliant immutable state, and a locked policy's retention can be extended but never shortened, and the policy cannot be deleted. Legal hold covers the litigation requirement: it keeps data immutable until the hold is explicitly cleared, and a container-level legal hold must be associated with user-defined tags such as a case ID.
Option A fails the exact point the compliance officer is making. An unlocked policy does protect against writes and deletes, but it can be shortened or deleted at any time, so it is not compliant with SEC 17a-4(f); Microsoft recommends the unlocked state only for short-term testing.
Option B protects against accident, not against intent. Soft delete lets you restore something that was deleted, it does not prevent the deletion, and a resource lock guards the storage account resource, not the blobs inside it. Neither creates a WORM state or satisfies the regulation.
Option D confuses cost tiering with immutability. The archive tier is a storage price point; a lifecycle rule automates deletion but places no restriction on a user or application deleting or overwriting a blob before the seven years are up.
Reference: Immutable storage for Azure Blob Storage