AZ-500 Secure compute, storage, and databases Practice Question
A company stores sensitive financial documents in Azure Blob Storage. The security team needs to maintain an immutable log of all changes to the blob content, including the previous versions and the identity of the user who made the changes, for forensic analysis. Which Azure Storage feature should they enable on the storage account to meet this requirement?
⚠ Common exam trap
Candidates often confuse versioning (which preserves previous versions for recovery) with the change feed (which provides an immutable audit log of changes), leading them to select versioning when the requirement explicitly calls for a forensic log with user identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Blob Storage change feed.
The Blob Storage change feed provides an immutable, append-only log of all changes (create, update, delete) to blobs and blob metadata, including the previous version and the identity of the user who made the change via the requestor's object ID. This meets the forensic requirement for a complete audit trail of blob content changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Blob Storage soft delete.
Why it's wrong here
Azure Blob Storage soft delete is designed exclusively to shield against accidental or malicious deletion of blobs by temporarily retaining deleted objects (default retention is 7 days, configurable up to 365). It does not expose any per-blob history of content modifications (overwrites) or metadata changes, and it never logs the identity of the user or application that triggered the delete request. Even though soft-deleted blob snapshots can be restored, you cannot reconstruct a chronological audit trail of every read, write, or permission change, so it fails the core requirement of a compliance-oriented audit log.
- ✗
Azure Blob Storage versioning.
Why it's wrong here
Versioning automatically saves the previous versions of a blob, but it does not provide a chronological log of changes with user identity. It is useful for recovery but not for a detailed audit trail of all operations.
- ✓
Blob Storage change feed.
Why this is correct
Blob Storage change feed is the correct choice because it provides an append-only, immutable transaction log that captures every creation, update, and deletion of blobs in a storage account, ordered by blob modification time. Each change feed record includes the blob's ETag, content length, and a timestamp, but it does not natively capture user identity; however, by correlating change feed events with Azure Storage Analytics logs (which record the caller's user ID, IP address, and operation details), you can attribute each change to a specific principal. This enables a tamper-resistant, chronological audit trail that satisfies the requirement to show 'who' performed each action, something soft delete, versioning, or analytics logs alone cannot guarantee.
- ✗
Azure Storage analytics logs.
Why it's wrong here
Storage analytics logs capture detailed information about requests to the storage service, including user identity. However, logs are not immutable and can be overwritten; they are typically used for monitoring, not as a guaranteed audit trail. The change feed provides an immutable ordered log.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.