Azure Blob Storage Immutable Storage for Regulatory Compliance
A healthcare organization needs to store patient records that must be immutable and cannot be modified or deleted for 7 years due to regulatory compliance. Which Azure feature should they use?
Quick Answer
The answer is Azure Blob Storage immutable storage, which provides WORM (Write Once, Read Many) capabilities to enforce a retention policy that prevents modification or deletion for a specified period. This is correct because the immutable storage feature locks data at the storage level, ensuring that even administrators cannot alter or remove patient records during the 7-year compliance window, directly meeting regulatory requirements. On the DP-900 exam, this concept tests your understanding of data protection and compliance features within Azure Storage, often appearing in scenario-based questions about healthcare or financial regulations. A common trap is confusing immutable storage with soft delete or snapshots—soft delete only protects against accidental deletion but can be overridden, while immutable storage is a hard policy. Remember the mnemonic “WORM for WORM-like compliance” to recall that Write Once, Read Many is the core mechanism for meeting strict retention rules.
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy (which enforces resource-level compliance rules) with data-level immutability, but Azure Policy cannot prevent data modification within a blob—only Azure Blob Storage immutable storage provides that guarantee.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blob Storage immutable storage
Azure Blob Storage immutable storage is correct because it provides WORM (Write Once, Read Many) capabilities that prevent data from being modified or deleted for a specified retention period. This directly meets the regulatory requirement for patient records to remain immutable for 7 years, as the policy is enforced at the storage level and cannot be overridden by any user, including administrators.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview
Why it's wrong here
Microsoft Purview governs data discovery, classification and lineage; it applies no retention lock on stored blobs. Immutability for seven years requires a time-based retention policy on a storage container. Purview is the right choice when cataloguing sensitive data across estates, not enforcing WORM protection.
- ✗
Azure Policy
Why it's wrong here
Azure Policy evaluates resource configurations and can audit or deny non-compliant deployments, but it cannot prevent modification or deletion of individual records already written. The stem demands WORM retention, which a storage immutability policy enforces. Azure Policy suits enforcing tagging or allowed SKUs at scale.
- ✓
Azure Blob Storage immutable storage
Why this is correct
Immutable blob storage applies time-based retention or legal hold policies, preventing modification or deletion for a specified period. This satisfies the healthcare scenario's seven-year regulatory requirement for records that cannot be altered or removed, enforced at the storage layer.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud delivers posture management and threat protection, alerting on misconfiguration rather than locking data. It cannot make records immutable for seven years; that needs a time-based retention policy on the storage container. Defender for Cloud fits continuous security assessment across subscriptions.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Schema-on-Read vs Schema-on-Write
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Blob storage
Blob storage is a cloud service for storing large amounts of unstructured data, such as text or binary data, like documents, images, and videos.
About these practice questions
This DP-900 question is part of Courseiva's 851-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DP-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A healthcare organization must store patient health records for 7 years to meet regulatory requirements. After 7 years, data must be deleted immediately. They use Azure Blob Storage. Which policy should they implement?
hard- A.Soft delete policy
- B.Legal hold policy
- C.Lifecycle management policy with deletion after 7 years
- ✓ D.Time-based retention policy
Why D: A time-based retention policy (immutability policy) in Azure Blob Storage ensures that blobs are stored in a WORM (Write Once, Read Many) state for a specified period, preventing modification or deletion. After the retention period expires, the data can be deleted immediately, meeting the 7-year regulatory requirement. This policy is designed specifically for compliance scenarios where data must be preserved for a fixed duration and then removed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.