AZ-104 Monitor and Maintain Azure Resources Practice Question
Which two statements about Azure Backup soft delete are correct? Select two.
⚠ Common exam trap
Many candidates confuse soft delete with immediate permanent deletion (Option C) or incorrectly associate it with unrelated Azure features like availability zones or Azure Policy, rather than recognizing it as a backup-specific retention mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deleted backup data is retained for a grace period
Azure Backup soft delete ensures that deleted backup data is not immediately purged but retained for a default grace period of 14 days. This allows recovery of accidentally deleted backup items, such as Recovery Services vault backup data, without data loss. Option A is correct because the grace period is a core feature of soft delete.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deleted backup data is retained for a grace period
Why this is correct
When soft delete is enabled on a Recovery Services vault, any deleted backup data is retained for a configured grace period—by default 14 days—during which the backup items remain in a soft-deleted state. The data is not irrecoverably purged, but continues to occupy storage, and the retention period is configurable up to 180 days for Azure VM backups. This allows an administrator to recover the data before it is permanently lost.
- ✓
A protected item can be recovered after accidental deletion within that period
Why this is correct
If an administrator accidentally deletes a protected item (e.g., a VM backup), the soft delete feature allows the item to be 'undeleted' within the soft-delete retention window. In the Recovery Services vault, the operation is available via the 'Undelete' option, which restores the item to an active state, preserving all existing recovery points. Once the grace period expires, the item is permanently removed, so recovery must occur before that deadline.
- ✗
It permanently deletes backups immediately
Why it's wrong here
Permanent immediate deletion is the exact behavior that soft delete is designed to prevent, not a function it performs. In fact, enabling soft delete ensures that even if a user deletes the backup item, all recovery points are preserved in a hidden, soft-deleted state for the grace period, after which they are permanently erased. The delay introduced by soft delete also safeguards against malicious deletion, as an attacker would have to delete the item and then immediately purge the soft-deleted data—a step that requires elevated permissions and administrative 'undo' capabilities.
When this WOULD be correct
If the question were about the behavior of 'hard delete' or a scenario where a backup policy is configured to immediately delete backups after retention period ends, then 'permanently deletes backups immediately' could be correct.
- ✗
It changes the VM to a different availability zone
Why it's wrong here
Soft delete is a data-retention control that operates entirely within the scope of the Recovery Services vault; it does not affect the compute placement or infrastructure of virtual machines. Configuring soft delete does not change a VM's availability zone, region, or fault domain, which are properties of the virtual machine itself, managed via the compute provider. Moving a VM between availability zones is a separate administrative action, conventionally planned through disaster recovery or manual redeployment, and is unrelated to backup soft-delete.
When this WOULD be correct
This option would be correct in a question about Azure Site Recovery or VM availability zone migration, where changing a VM to a different availability zone is a valid recovery or high-availability action.
- ✗
It only applies to Azure Policy assignments
Why it's wrong here
Soft delete is a feature of the Azure Backup service, applied at the Recovery Services vault level, not to Azure Policy assignments. It protects every eligible protected item within the vault, including virtual machines, SQL and SAP HANA databases, and file shares. Although Azure Policy can be used to enforce that soft delete is enabled across your subscriptions—acting as a compliance guardrail—the feature itself has no dependency on either Azure Policy definitions or assignments.
When this WOULD be correct
In a question about Azure Policy effects, if asked 'Which effect prevents deletion of policy assignments?', 'Deny' or 'Append' could be correct, but soft delete is not related to policy assignments.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Deleted backup data is retained for a grace periodCorrect answer▾
Why this is correct
When soft delete is enabled on a Recovery Services vault, any deleted backup data is retained for a configured grace period—by default 14 days—during which the backup items remain in a soft-deleted state. The data is not irrecoverably purged, but continues to occupy storage, and the retention period is configurable up to 180 days for Azure VM backups. This allows an administrator to recover the data before it is permanently lost.
✗It permanently deletes backups immediatelyWrong answer — click to see why▾
Why this is wrong here
Azure Backup soft delete retains deleted backup data for a grace period (default 14 days), not permanently deleting backups immediately.
★ When this WOULD be the correct answer
If the question were about the behavior of 'hard delete' or a scenario where a backup policy is configured to immediately delete backups after retention period ends, then 'permanently deletes backups immediately' could be correct.
Why candidates choose this
Candidates may confuse soft delete with a feature that instantly purges data, or think that deleting a backup resource immediately removes all associated data.
✗It changes the VM to a different availability zoneWrong answer — click to see why▾
Why this is wrong here
Azure Backup soft delete does not change a VM's availability zone; it only retains deleted backup data for a grace period to allow recovery.
★ When this WOULD be the correct answer
This option would be correct in a question about Azure Site Recovery or VM availability zone migration, where changing a VM to a different availability zone is a valid recovery or high-availability action.
Why candidates choose this
Candidates may confuse Azure Backup with disaster recovery features like Azure Site Recovery, which can move VMs across zones, or mistakenly think soft delete involves relocating resources.
✗It only applies to Azure Policy assignmentsWrong answer — click to see why▾
Why this is wrong here
Azure Backup soft delete applies to backup data, not to Azure Policy assignments. It is a feature of Azure Backup that protects against accidental deletion of backup data, not a policy-level setting.
★ When this WOULD be the correct answer
In a question about Azure Policy effects, if asked 'Which effect prevents deletion of policy assignments?', 'Deny' or 'Append' could be correct, but soft delete is not related to policy assignments.
Why candidates choose this
Candidates may confuse the concept of 'soft delete' with policy enforcement or assume it applies broadly to all Azure resources, including policy assignments, due to the term 'delete' in the name.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Recovery Services vault
A Recovery Services vault is a secure storage container in Microsoft Azure that holds backup data and replication settings for virtual machines, databases, and other cloud resources, enabling you to restore them if something goes wrong.
Key term
Azure Backup
Azure Backup is a cloud-based service from Microsoft that protects your data by creating and storing backups of files, folders, virtual machines, databases, and entire servers in the Azure cloud.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, a backup administrator accidentally stopped protection for a critical VM and then deleted its backup item. The team wants Azure Backup to retain the deleted item long enough to recover it after the mistake is discovered the next day. What should be enabled on the vault?
medium- ✓ A.Soft delete for backup data
- B.A read-only resource lock on the VM
- C.A network security group rule allowing port 445
- D.Instant restore snapshots set to 30 days
Why A: Soft delete for backup data is the correct answer because it provides a safety net for accidentally deleted backup items. When enabled, Azure Backup retains deleted backup data for an additional 14 days (default) in a soft-deleted state, allowing administrators to recover the data before it is permanently purged. This directly addresses the scenario where protection was stopped and the backup item was deleted, as the data remains recoverable within the retention period.
Variation 2. An administrator accidentally stopped protection for a critical VM and then deleted its backup item. The mistake was discovered a day later, and the organization wants deleted backup data to remain recoverable for a grace period. Which feature should be enabled on the Recovery Services vault?
hard- ✓ A.Soft delete on the Recovery Services vault.
- B.An action group attached to the vault alerts.
- C.Diagnostic settings that export vault events to Log Analytics.
- D.Cross-region restore for the vault.
Why A: Soft delete on the Recovery Services vault provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state, allowing recovery even after a backup item is deleted. This feature is specifically designed to protect against accidental deletion, as it prevents permanent removal of backup data until the soft-delete period expires or is manually purged.
Variation 3. An administrator accidentally deletes a VM backup item from a Recovery Services vault. The company wants a built-in protection feature that helps recover the deleted backup item during the retention window. Which feature is this?
easy- A.Archive tier
- B.Availability zones
- C.Private endpoint
- ✓ D.Soft delete
Why D: Soft delete is a built-in protection feature for Azure Recovery Services vaults that preserves deleted backup data for an additional 14 days (default retention period) after deletion. When a backup item is accidentally deleted, soft delete retains the data in a 'soft deleted' state, allowing administrators to recover it within the retention window before permanent deletion occurs. This feature is enabled by default for new vaults and helps prevent data loss from accidental or malicious deletions.
Variation 4. Based on the exhibit, the VM backup item was accidentally deleted from the vault yesterday, but the VM itself still exists. What should you do to resume protection with the existing backup item?
medium- A.Delete the VM and recreate it so the backup can start again.
- ✓ B.Recover or undelete the backup item from the vault before the soft-delete retention expires.
- C.Create a new action group so the vault can re-enable protection.
- D.Disable diagnostic settings on the vault and then re-enable them.
Why B: Azure Backup uses soft-delete for backup items, which retains deleted backup data for 14 days by default. Since the backup item was accidentally deleted yesterday, it is still in the soft-delete state and can be recovered or undeleted from the vault before the retention period expires. Once recovered, protection can be resumed on the existing VM without data loss or reconfiguration.
Variation 5. The team accidentally stopped protection for a VM and deleted its backup data. They want Azure Backup to keep deleted backup items recoverable for a grace period so the item can be undeleted if needed. Which vault feature should be enabled?
medium- A.Instant restore
- ✓ B.Soft delete
- C.A new backup policy
- D.A private endpoint for the vault
Why B: Soft delete is the correct feature because it provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state. This allows administrators to recover (undelete) backup items that were accidentally deleted, including cases where protection was stopped and data was removed. Without soft delete, deleted backup data is permanently purged and cannot be recovered.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.