A healthcare organization stores patient records in Azure Blob Storage and must comply with data retention policies that require deleting records after 7 years. They also need to prevent any modification or deletion of records before the retention period ends. Which Azure feature should they use?
Immutable storage with a time-based retention policy enforces a WORM (write-once, read-many) state at the container level. Once the policy is configured with a retention interval, blobs cannot be overwritten or deleted until that interval expires, and the retention period cannot be shortened. For patient records, this guarantees non-erasable, non-modifiable storage that directly satisfies regulatory and compliance mandates.
Why this answer
Immutable storage with a time-based retention policy (WORM – Write Once, Read Many) ensures that blobs cannot be modified or deleted until the retention period expires. This directly meets the dual requirement of preventing premature deletion while enforcing a 7-year retention, as the policy locks the data for the specified duration.
Exam trap
The trap here is that candidates confuse soft delete (which only protects against accidental deletion) or lifecycle management (which automates tiering/expiry) with the strict WORM guarantee required for regulatory compliance, where no modification or deletion is allowed before the retention period ends.
How to eliminate wrong answers
Option B (Azure Backup for Blob Storage) is wrong because it provides point-in-time recovery and protection against accidental deletion, but it does not prevent intentional modification or deletion of the original blobs before the retention period ends. Option C (Soft delete for Blob Storage) is wrong because it only retains deleted blobs for a configurable period (e.g., 7 days) and allows recovery, but it does not block deletion or modification during the retention period. Option D (Azure Blob Storage lifecycle management) is wrong because it automates tiering or deletion based on age, but it cannot enforce a write-once, read-many lock to prevent modification or deletion before the retention period expires.