AZ-305 Design business continuity solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign Azure RBAC roles to limit access to the vault.

  Why it's wrong here

  Azure RBAC roles limit which users or principals can perform actions on the Recovery Services vault, but they do not stop an authorized user with delete permissions (e.g., Contributor, Backup Contributor, or a custom role including Microsoft.RecoveryServices/vaults/delete) from deleting the vault or its backup data. RBAC is a least-privilege access control mechanism, not a data protection or backup-retention control, so it cannot satisfy the requirement to protect against accidental or deliberate deletion.

• ✓

  Enable soft delete in the vault and use geo-redundant storage (GRS).

  Why this is correct

  Soft delete for a Recovery Services vault retains accidentally deleted backup data for an additional 14 days after deletion, allowing it to be recovered before permanent purge; this directly protects against accidental or malicious deletion of backup items. Geo-redundant storage (GRS) copies backup data to a paired Azure region, so even if the primary region's datacenter fails, the backup data remains available for restore from the secondary region. Together, these two controls address both deletion protection and cross-region disaster recovery.

• ✗

  Enable immutable storage for the vault.

  Why it's wrong here

  Immutable storage (WORM) is an Azure Blob Storage feature that prevents blobs from being deleted or overwritten for a specified retention interval, but it is not supported for Recovery Services vaults or Azure Backup data. Recovery Services vaults have no immutable storage setting, and attempting to apply WORM semantics to a vault is not a valid configuration. Even if immutability were available, it would not address the need for geo-redundancy, and the scenario specifically calls for vault-level protection for VM backups.

• ✗

  Enable locally redundant storage (LRS) for the vault.

  Why it's wrong here

  Locally redundant storage (LRS) replicates backup data three times within a single physical facility in the primary region, offering resilience only against local datacenter hardware failure. It does not provide protection against a regional disaster, such as a natural disaster or large-scale outage, because no copy exists in a different Azure region. For a Recovery Services vault that must survive a regional outage, GRS is required; LRS alone is insufficient and also does not address deletion protection, making it incorrect.

Go deeper

Related to this question