Question
You have an Azure subscription that contains virtual machines, storage accounts, and Azure SQL databases.
All resources are backed up multiple times a day by using Azure Backup.
You are developing a strategy to protect against ransomware attacks.
You need to recommend which controls must be enabled to ensure that Azure Backup can be used to restore the resources in the event of a successful ransomware attack.
Which two controls should you include in the recommendation? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
- A. Enable soft delete for backups. Correct
- B. Require PINs for critical operations. Correct
- C. Encrypt backups by using customer-managed keys (CMKs).
- D. Perform offline backups to Azure Data Box.
- E. Use Azure Monitor notifications when backup configurations change.
Explanation
Enable soft delete for backups: if an attacker deletes backup data, Azure Backup keeps it for 14 more days, so the backup items can still be recovered with no data loss.
Require PINs for critical operations: Azure Backup's security features require a security PIN, generated in the Azure portal, before critical operations such as stopping protection with data deletion or changing a passphrase. An attacker with stolen credentials therefore cannot easily destroy or tamper with online backups.
Customer-managed keys control who manages the encryption keys, but they do not stop backups from being deleted. Offline backup to Azure Data Box is only an initial seeding method, and Azure Monitor notifications only alert you to changes; neither guarantees that the backups can be restored.
