AZ-500 Secure compute, storage, and databases Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Time-based retention policy

  Why it's wrong here

  Time-based retention policy is not suited to this scenario because it defines a finite, fixed retention interval (e.g., 7 years) after which blobs automatically become eligible for deletion or modification unless the policy is extended. Litigation often requires an indefinite hold that lasts for an unknown duration, which a time-based policy cannot guarantee. Additionally, time-based retention relies on clock-based expiration, so once the period lapses, the protection disappears automatically — a critical gap when a legal case is still active.

• ✓

  Legal hold

  Why this is correct

  Legal hold is the correct choice because it applies an indefinite, immutable lock on blob storage, preventing any modification or deletion until the hold is explicitly released by an authorized user. This hold is designed for legal and compliance scenarios where records must be preserved for an unknown or open-ended duration, such as active litigation or an ongoing investigation. Unlike time-based retention, legal hold does not expire automatically and continues protecting data until the hold is removed, ensuring that records remain untouched for as long as legally required.

• ✗

  Soft delete

  Why it's wrong here

  Soft delete is incorrect here because it does not block deletion or modification at all; it only retains a deleted blob (or version) for a configurable grace period (e.g., 7 or 14 days) so that an administrator can restore it after accidental or malicious deletion. Soft delete is a recovery mechanism, not a prevention mechanism — authorized users can still overwrite or delete blobs, and the data is only recoverable within the specified retention window. It also does not enforce immutability, so a user with write permissions could alter records during the soft-delete period, which would violate the requirement to preserve records in their original state.

• ✗

  Blob versioning

  Why it's wrong here

  Blob versioning is not a valid solution for this requirement because it preserves prior versions of a blob when it is modified or deleted, but it does not prevent those operations from occurring. Versioning enables rollback to an earlier version, but it does not enforce immutability — a blob can still be overwritten or deleted, and only the previous versions are retained as separate objects. Furthermore, versioning does not protect against deletion of the entire storage account or container, and versions themselves can be deleted (unless combined with additional controls like legal hold), so it fails to meet the need for a lockdown that prevents any change or removal during litigation.

Go deeper

Related to this question