Azure Backup Protection Against Compromised Admins

AZ-305 By islever Editorial Last updated

Design solutions for logging and monitoring Design governance

Short answer

B Configuring only PIM approval does not technically prevent modification or deletion; immutable vault settings or resource locks are required for true protection.

Question

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
Your company, named Contoso, Ltd., has a Microsoft Entra tenant named contoso.com that uses Privileged Identity Management (PIM) and is linked to an Azure subscription named Sub1.
You use Azure Backup to back up all the resources in Sub1 to a Recovery Services vault named Vault1.
An external company named Fabrikam, Inc. provides security management services to Contoso. Fabrikam has a Microsoft Entra tenant named fabrikam.com and an Azure subscription.
You need to prevent a compromised administrator account in contoso.com from modifying backup policies in and deleting backups from Sub1.
Solution: You configure a PIM role assignment that requires approval for activation by an administrator in fabrikam.com.
Does this meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

Tests understanding that procedural controls (PIM) are insufficient against compromised credentials; technical immutability is required.

Learn why PIM alone fails to protect Azure Backups from compromised admins and why immutable vaults are the correct solution for AZ-305.

Common mistake: Choosing Yes because PIM adds an approval layer, ignoring that a compromised admin can still trigger activations or that PIM doesn't block post-activation changes without additional resource-level locks.

Expert Analysis

The core of this question is about preventing a compromised administrator from modifying backup policies and deleting backups. The solution proposes using Privileged Identity Management (PIM) with approval from an external tenant (Fabrikam). While PIM adds an approval step, it does not inherently prevent a compromised account from acting if the approver is also compromised or if the approval workflow can be bypassed or manipulated. More critically, Azure Backup has specific built-in protections like Immutable Vaults (WORM - Write Once Read Many) and Resource Locks that are designed specifically to prevent deletion or modification of backups, even by administrators. Relying solely on PIM approval is insufficient because PIM controls access activation, but once activated, the user has full permissions unless additional constraints are in place. The key insight is that 'preventing modification/deletion' requires technical enforcement at the resource level (like immutable storage), not just procedural approval. Therefore, the PIM-only solution does not meet the goal.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When asked about protecting data from administrative abuse, look for technical enforcement mechanisms like Immutable Storage, Resource Locks, or RBAC roles with minimal privileges. Procedural controls like approval workflows are secondary and often insufficient as a standalone solution for critical data protection goals.

Frequently Asked Questions

Why isn't PIM enough to stop a compromised admin?

PIM requires approval for role activation, but if the approving admin is also compromised, or if the workflow is misconfigured, the attacker can gain elevated privileges. It does not technically block actions once permissions are granted.

What is the best way to prevent backup deletion?

Use Azure Backup's Immutable Vault feature, which uses WORM (Write Once Read Many) technology to prevent backups from being deleted or modified for a specified retention period, even by administrators.

More AZ-305 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. AllanHouston 👍 1 Answered B
    Need to use MUA (Multi-user authorization)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Azure Network Watcher IP Flow Verify vs Traffic Analytics

S-grade

Which components handle AKS state, pub/sub, and traffic splitting?

S-grade

Which Azure Storage setup retains blobs immutably for five years?

S-grade

Which Azure Monitor Features Provide Synthetic Transaction Monitoring for App1?

S-grade

Practice All AZ-305 Questions

Access 95 questions with complete answers and detailed explanations.

View Full AZ-305 Practice Test →

← Back to AZ-305 Study Guide