AZ-500 Secure compute, storage, and databases Practice Question
A company stores sensitive financial records in Azure Blob Storage. They want to ensure that if a blob is deleted or overwritten, it can be recovered within 30 days. They also want to protect against accidental deletion of the storage account itself. Which two configurations should they implement? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse blob versioning with soft delete, assuming versioning alone provides deletion recovery, but versioning only protects against overwrites, not deletions, and lacks a configurable retention period for recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable blob soft delete with a retention period of 30 days
Blob soft delete (Option A) protects individual blobs by retaining deleted or overwritten blobs for a specified retention period, allowing recovery within that window. Storage account soft delete (Option B) protects the entire storage account from accidental deletion by retaining the deleted account for a configurable period. Together, they address both the blob-level and account-level recovery requirements for the 30-day window.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable blob soft delete with a retention period of 30 days
Why this is correct
Blob soft delete retains deleted or overwritten blobs for a configurable retention period (here, 30 days), so a mistakenly deleted financial record can be undeleted from the soft-deleted state. Unlike versioning, it explicitly covers deletion events, and unlike container soft delete, it operates at the individual blob level, which is where the company's sensitive files live. This makes it a direct data-recovery safeguard for the scenario.
- ✓
Enable storage account soft delete with a retention period of 30 days
Why this is correct
Storage account soft delete is a separate control that protects the entire storage account, including all containers and blobs, from accidental account-level deletion. If someone deletes the storage account holding the financial records, this feature allows the account to be recovered within the 30-day retention period, which blob soft delete cannot do because it only rescues blobs from an existing account. Together with blob soft delete, it closes the gap between data-level and account-level accidental deletion.
- ✗
Enable container soft delete with a retention period of 30 days
Why it's wrong here
Container soft delete only protects the container resource itself, not the blobs inside it. If a blob is deleted while the container remains intact—the most likely scenario for accidental deletion of a single financial file—container soft delete does nothing because it only triggers when the entire container is removed. Moreover, it does not handle overwritten blobs or storage account deletion, so relying on it alone leaves the sensitive records exposed to both data corruption and account loss.
- ✗
Enable blob versioning
Why it's wrong here
Blob versioning keeps a history of each blob's contents as it is overwritten, enabling rollback to a previous version after an unintended modification. However, versioning does not capture deletions: a deleted blob is not turned into a version unless blob soft delete is also enabled, so the destroyed file would be unrecoverable. It also offers no protection against the storage account being deleted, because versions live inside the account and vanish with it.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.