Question 821 of 194
AZ-500 Secure compute, storage, and databases Practice Question
A company enables Azure SQL Database auditing to log database events to a storage account. The security policy requires that the audit logs be protected from tampering and deletion after they are written. Which storage account feature should the company enable to ensure that audit log files cannot be modified or deleted by anyone for a specified retention period?
⚠ Common exam trap
Watch out — candidates often confuse soft delete with immutable storage, thinking that soft delete's ability to recover deleted blobs is sufficient for tamper-proofing, but soft delete does not prevent modification or deletion in the first place.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immutable storage
Immutable storage for Azure Blob Storage provides a WORM (Write Once, Read Many) policy that prevents audit log files from being modified or deleted by any user, including administrators, for a specified retention period. This directly meets the security requirement to protect audit logs from tampering and deletion after they are written.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Soft delete
Why it's wrong here
Soft delete is wrong because it only guards against accidental or incidental deletion, not deliberate tampering. When a blob is soft-deleted, it is marked as deleted but remains recoverable for the configured retention period; however, a user with write-and-delete permissions can permanently purge the soft-deleted blob or overwrite its contents, rendering the audit record unrecoverable. Soft delete also does not prevent modification of an active (non-deleted) blob. Thus it cannot provide the strong integrity guarantee required for preserving audit logs.
- ✓
Immutable storage
Why this is correct
Immutable storage is correct because it enforces a Write-Once-Read-Many (WORM) policy at the container or version level, blocking any delete or modify operation on blobs for a set retention period. This time-based retention lock makes the stored audit logs tamper-proof and compliant with regulatory frameworks such as SEC 17a-4f. After the policy is locked, even an account administrator cannot shorten the retention interval or disable immutability, ensuring that Azure SQL Database audit records remain intact until the policy expires.
- ✗
Hierarchical namespace
Why it's wrong here
Hierarchical namespace is wrong because it merely reorganizes storage into directories for Data Lake workloads, enabling HDFS-style path operations like rename and move. It provides no data protection or immutability semantics; blobs under a hierarchical namespace can still be deleted, overwritten, or moved by anyone possessing permissions. Enabling it does not prevent an attacker from altering audit logs, so it is irrelevant to safeguarding SQL auditing data.
- ✗
Firewall and virtual networks
Why it's wrong here
Firewall and virtual networks are wrong because they only control network access to the storage account at the TCP/IP layer, restricting which client IP addresses or virtual networks can reach the endpoint. They do not authenticate individual users or authorize operations; any user who can connect from an allowed network and has credentials with write/delete permissions can modify or delete audit logs exactly as they would from any other network. Network restrictions also fail against an insider with legitimate access, so they cannot ensure audit-log integrity.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.