SC-100 Certification Practice Question #268

Question

You have an Azure subscription and an on-premises datacenter. The datacenter contains 100 servers that run Windows Server. All the servers are backed up to a Recovery Services vault by using Azure Backup and the Microsoft Azure Recovery Services (MARS) agent.

You need to design a recovery solution for ransomware attacks that encrypt the on-premises servers. The solution must follow Microsoft Security Best Practices and protect against the following risks:

•	A compromised administrator account used to delete the backups from Azure Backup before encrypting the servers
•	A compromised administrator account used to disable the backups on the MARS agent before encrypting the servers

What should you use for each risk? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The question asks to "design a recovery solution" that protects against a compromised admin (1) deleting backups and (2) disabling backups on the MARS agent. MS Learn's ransomware best-practices FAQ pairs exactly two controls: soft delete (retains deleted backup data 14 days so deleted backups can be recovered) and Multi-user authorization via Resource Guard (forces a second approval before destructive/disable operations, defeating a single rogue admin). The highest-quality, MS-Learn-cited comments (Intrudire, Onimole, billy22, deadheadx) all land on Soft delete + MUA. Confidence is held at 78% because there is a genuine, well-argued community split: several reasoners (jvallespin, lt9898, Nian, wsrudmen) note that disabling protection at the MARS agent is not natively MUA-protected and that the on-premises security gate there is the Security PIN — so an examiner keying the second box to "A security PIN for critical operations" is plausible. The MS Learn ransomware guidance, which lists soft delete and MUA as the two headline controls, breaks the tie in favor of Soft delete + MUA.

More SC-100 practice questions