SC-100 Certification Practice Question #7

Question

You have an Azure subscription that contains virtual machines, storage accounts, and Azure SQL databases.
All resources are backed up multiple times a day by using Azure Backup.
You are developing a strategy to protect against ransomware attacks.
You need to recommend which controls must be enabled to ensure that Azure Backup can be used to restore the resources in the event of a successful ransomware attack.
Which two controls should you include in the recommendation? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

The question asks for controls that ENSURE Azure Backup can RESTORE resources after a successful attack. MS Learn's ransomware FAQ and the MCSB BR-2 control both name the same two protections: soft delete (retains deleted backups 14 days so a malicious delete is recoverable) and requiring out-of-band steps such as MFA / a security PIN before backups can be modified or erased. These map exactly to A and B. The community strongly agrees (AB has 75 votes, with the two top comments at 34 and 21 👍). The BD minority leans on the older "store backups offline/off-site" wording, but "Azure Data Box" (option D) is a data-transfer device rather than an offline backup destination, so D fails; CMK encryption (C) protects confidentiality but is not part of the restore-assurance control set and does not even cover VM backups. Confidence is held at 90 rather than higher because the official Suggested Answer lists only B, while the doc and community make A equally required.

More SC-100 practice questions