AZ-104 Monitor and Maintain Azure Resources Practice Question
The team accidentally stopped protection for a VM and deleted its backup data. They want Azure Backup to keep deleted backup items recoverable for a grace period so the item can be undeleted if needed. Which vault feature should be enabled?
⚠ Common exam trap
Many candidates confuse 'soft delete' with 'instant restore' because both involve retention of backup data, but instant restore only affects recovery point snapshots, not the ability to recover deleted items after protection is stopped.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Soft delete
Soft delete is the correct feature because it provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state. This allows administrators to recover (undelete) backup items that were accidentally deleted, including cases where protection was stopped and data was removed. Without soft delete, deleted backup data is permanently purged and cannot be recovered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Instant restore
Why it's wrong here
Instant restore is a snapshot-based feature in Azure Backup that creates local snapshots immediately after a backup and stores them for a short duration (typically 1–7 days) to allow fast recovery without waiting for transfer to the vault. It improves recovery time objectives (RTO) for existing, valid restore points, but it does not alter the retention of backup data after deletion or when protection is stopped. Once the backup data has been soft-deleted and purged, there are no snapshots or recovery points left for instant restore to act on. Therefore, instant restore is irrelevant to safeguarding against accidental deletion and provides no recovery window.
When this WOULD be correct
Enable Instant Restore when you need to reduce the time it takes to restore a VM by keeping snapshots locally for a specified duration, independent of the vault. This is useful for faster recovery in disaster scenarios.
- ✓
Soft delete
Why this is correct
Soft delete keeps removed backup items in a recoverable state for a retention period after deletion or after protection is stopped. That gives administrators a safety window to reverse accidental deletion and prevents immediate permanent loss of backup data. It is the right protection setting for accidental removal scenarios in Recovery Services vaults.
- ✗
A new backup policy
Why it's wrong here
A backup policy defines the frequency and retention of backup recovery points, such as daily backups kept for 30 days. However, when you stop protection and choose to delete backup data, the policy no longer applies because there are no future backups scheduled and the existing recovery points are destined for deletion. A new backup policy only affects newly protected items or restarts protection on an existing VM; it does not provide an undelete grace period for previously deleted backup items. Thus, it cannot undo the accidental removal of the VM's backup data.
When this WOULD be correct
This option would be correct if the question asked: 'The team needs to change the retention duration for future backups of a VM. Which vault feature should be configured?'
- ✗
A private endpoint for the vault
Why it's wrong here
A private endpoint for the vault is an Azure Private Link feature that restricts network access to the Recovery Services vault through a private IP address within a virtual network. It blocks public exposure and secures the management plane, but it has no effect on the vault's data lifecycle or deletion semantics. Soft delete retention behavior is governed by vault settings and protection state, not by how the vault is accessed. Therefore, configuring a private endpoint would not create any safety window for recovering an accidentally deleted backup.
When this WOULD be correct
When an exam question requires ensuring that backup traffic to the vault does not traverse the public internet and must be isolated within a virtual network, enabling a private endpoint would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Soft deleteCorrect answer▾
Why this is correct
Soft delete keeps removed backup items in a recoverable state for a retention period after deletion or after protection is stopped. That gives administrators a safety window to reverse accidental deletion and prevents immediate permanent loss of backup data. It is the right protection setting for accidental removal scenarios in Recovery Services vaults.
✗Instant restoreWrong answer — click to see why▾
Why this is wrong here
Instant restore controls the retention of recovery points for immediate restoration, not the grace period for deleted backup items. It does not allow undeletion of accidentally deleted backups.
★ When this WOULD be the correct answer
Enable Instant Restore when you need to reduce the time it takes to restore a VM by keeping snapshots locally for a specified duration, independent of the vault. This is useful for faster recovery in disaster scenarios.
Why candidates choose this
Candidates may confuse 'instant' with 'immediate recovery' and think it provides a quick way to restore deleted items, not realizing it only affects snapshot retention for active backups.
✗A new backup policyWrong answer — click to see why▾
Why this is wrong here
A new backup policy defines backup schedule and retention rules, but it cannot recover deleted backup data or provide a grace period for undeletion. The question specifically asks for a feature that keeps deleted items recoverable, which is soft delete, not a policy.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'The team needs to change the retention duration for future backups of a VM. Which vault feature should be configured?'
Why candidates choose this
Candidates may think that creating a new policy can somehow restore or protect deleted data, confusing policy management with data recovery features.
✗A private endpoint for the vaultWrong answer — click to see why▾
Why this is wrong here
A private endpoint for the vault provides secure network connectivity to the Recovery Services vault, not a grace period for recovering deleted backup items.
★ When this WOULD be the correct answer
When an exam question requires ensuring that backup traffic to the vault does not traverse the public internet and must be isolated within a virtual network, enabling a private endpoint would be the correct answer.
Why candidates choose this
Candidates may confuse private endpoints with data protection features, thinking that restricting network access also protects backup data from accidental deletion or provides recovery capabilities.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Backup
Azure Backup is a cloud-based service from Microsoft that protects your data by creating and storing backups of files, folders, virtual machines, databases, and entire servers in the Azure cloud.
Key term
Soft delete
A soft delete marks data as deleted without actually removing it from the database, allowing recovery if needed.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.