Exam AZ-305 topic 3 question 25 discussion

1, Enable operational backup with Azure Backup - can share same backup policy among multiple storage accounts 2, Enable permanent delete for soft deleted items - can delete blobs prematurely.

Got this ques in my exam on 29th Jan 2024 and scored 950. I chose "Enable operational backup with Azure Backup" and "Enable permanent delete for soft deleted items "

I got Enable Soft Delete for Blobs and Enable Versioning for Blobs. Why: This ensures that deleted data is retained for a configurable retention period, allowing you to recover from accidental or unauthorized deletions. It's a key step in standardizing retention policies. How: Set the retention period to align with your organization's data retention policy (e.g., 30 days). Why: Blob versioning helps track and retain previous versions of data. If unauthorized changes or deletions occur, you can revert to a prior version. Combined with encryption and access control policies, it supports purging data securely. How: Once enabled, each modification creates a new version of the blob, which can be restored if needed.

WRONG 1. Enable operational backup with Azure Backup 2. Enable permanent delete for soft deleted items

for those who mnention that soft delete is enabled by default, try to look from Exam point of view, the exam usually ask to check if you know the specific answer is part of the solution or not, regardless if the feature is by default enabled. also think if the feature was disabled after blob creation..so Soft delete for blobs is definitely a valid answer to standardize retention policy. second Box is Enable change feed, since the question is not asking how to purge copied data, it is asking about how to ensure that copied data can be poruged, so change feed is definitely a good option to track changes and modification to data

using the portal, I do not see the option "Enable operationel backup with Azure-Backup"

Backups are already in place, just need to select right recovery options. Since the question is about storage account, To me its (Enable soft delete for blobs) & Enable permanent delete for soft deleted items

Enable soft delete for blobs: Standardizes retention policies by allowing recovery within a retention period. Enable permanent delete for soft deleted items: Ensures data can be purged after the retention period if copied to unauthorized locations.

Final Answer: 1, Enable operational backup with Azure Backup 2, Enable permanent delete for soft deleted items

I would go for Enable operational backup with Azure Backup to tick off the box ensuring that retention policies are standardised across subscriptions. There is no other box in the list that would do this. For the second option in regard to ensuring data can be purged, I would go for Enable permanent delete for soft deleted items. Why? Because soft delete is enabled by default when you create containers. Assuming this was the case here, if you want to immediately delete something inside the container, you won't be able to without enabling this permanent delete for soft deleted items option. If you don't have this option and you delete something, it can be restored while it's in the soft-delete state (usually 7 days by default).

1. Enable permanent delete for soft deleted items 2. Enable blob change feed When creating the Storage Account (via the Portal) Enable soft delete for containers, Enable soft delete for blobs are enabled by default. So when you want to remove something (purge), you must permanent delete it otherwise it stays available for the days you configured in the soft deleted items. You want to purge the data once it is copied to an unauthorized location. For that, you need the change feed.

Second is definitely "blob change feed"... but first... how we can standardize policies across the subscription on storage account level?

The two settings that you should enable to meet the requirements are: • Versioning for blobs • Blob change feed Versioning for blobs allows you to keep multiple versions of a blob. This can be useful for recovering from accidental deletions or overwrites. You can configure versioning to retain a specific number of versions or to retain versions for a specific period of time. Blob change feed provides a continuous feed of events that occur on blobs in a storage account. This feed can be used to track changes to blobs and to take action on those changes, such as purging data if it is copied to an unauthorized location.

"Blob soft delete is enabled by default when you create a new storage account with the Azure portal. The setting to enable or disable blob soft delete when you create a new storage account is on the Data protection tab." https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal Blob versioning and soft delete "Blob versioning and blob soft delete are part of the recommended data protection configuration for storage accounts." https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-overview#enable-or-disable-blob-versioning

The only way to know if documents (blob files, not container like in the answer!) are copied to another location is via Blob Change Feed so this should be included in the answer I think. Probably also soft delete for blobs for the retention options.

the answer should be: 1) enable soft delete for blobs 2)enable versioning for blobs