Which Azure Storage setup retains blobs immutably for five years?

AZ-305 By islever Editorial Last updated

Design data storage solutions for semi-structured and unstructured data Design solutions for backup and disaster recovery

Short answer

Box 1: General purpose v2 with hot access tier for blobs. Box 2: Container access policy, configured as a five-year immutable (time-based retention) policy.

Question

HOTSPOT
You are planning an Azure Storage solution for sensitive data. The data will be accessed daily. The dataset is less than 10 GB.
You need to recommend a storage solution that meets the following requirements:
• All the data written to storage must be retained for five years.
• Once the data is written, the data can only be read. Modifications and deletion must be prevented.
• After five years, the data can be deleted, but never modified.
• Data access charges must be minimized.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exhibit: Which Azure Storage setup retains blobs immutably for five years?

Key Takeaways

The item tests immutable blob storage (WORM retention) combined with cost-aware access-tier selection; the trap is picking a storage account resource lock or the cool tier, neither of which blocks changes to the individual blobs or minimizes per-read charges.

This AZ-305 hotspot asks you to choose an Azure Storage account type and a protection mechanism so that a small (<10 GB), daily-read dataset is write-once-read-many for five years at the lowest access cost. The page establishes that the correct pair is a General purpose v2 account with the hot access tier for blobs plus a container-level immutability (time-based retention) policy.

Common mistake: Choosing a storage account resource lock because it sounds like 'read-only' protection — a lock only protects the account or container resource, so blobs inside can still be overwritten or deleted. A second common error is picking the cool access tier to save money, which lowers storage cost but raises per-access charges for a dataset that is read every day.

Expert Analysis

Why the Answer Is Correct

The dataset is under 10 GB and read daily, so the requirement to minimize data access charges is driven by read and transaction pricing, and the hot access tier has the lowest access cost of the General purpose v2 blob tiers. General purpose v2 is the account type that supports blob access tiers, immutable storage policies and lifecycle management, so one account satisfies both the retention and the cost goals. Immutability is applied at the container level with a time-based retention policy, which makes the blobs write-once-read-many: writes are accepted, while modifications and deletions are rejected until the five-year interval elapses. After the interval expires the policy no longer blocks deletion, so the data can be removed without ever having been altered in place. Premium block blobs are provisioned for high transaction rates and low latency and carry a much higher capacity price, which does not fit a small, modestly accessed dataset.

Why Other Candidate Answers Are Wrong

A storage account resource lock acts on the account or container resource, not on the objects inside it, so blob overwrites and deletes would still succeed — exactly the protection gap the question targets. The cool tier inverts the cost model: cheaper storage but higher per-read and per-transaction charges, so it does not satisfy "data access charges must be minimized" for daily reads. Premium block blobs are also wrong here because their provisioned capacity pricing is far more expensive for a few gigabytes of data that is only read once a day. Treating the second box as a shared access signature or SAS-related policy is a misunderstanding: a container access policy holds the immutable time-based retention policy, which is unrelated to SAS tokens.

Community Comment Notes

IRISone, the highest-voted comment, argues the second box "Should be COntainer Policy for immutable storage" and points out that "A resource lock does not prevent removal of files and folders." xRiot007 reinforces this, noting a lock protects the resource itself and "not of the data inside of that resource." LeeVee and OPT_001122 both settle on the same pairing, with LeeVee summarizing it as "GPv2 and Container Policy." Elecktrus dissents, claiming that "access cost to Premium Block is cheaper than GPv2 hot tier," while MasterMans' cool-tier pick and 155e6a0's assertion that "Container Access Policy is for SAS" illustrate the two mistakes the question deliberately baits.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Read the two dropdowns as two separate requirements: the cost language ("accessed daily", "data access charges must be minimized") points to the hot tier, while the retention language ("retained for five years", "modifications and deletion must be prevented") points to a container-level immutability policy rather than a resource lock. Whenever a hotspot lists both a storage type and a protection mechanism, confirm that the account type you chose actually supports immutable container policies.

Frequently Asked Questions

Does a storage account resource lock prevent blobs from being modified or deleted?

No. A resource lock protects the account or container resource itself, while the blobs inside can still be overwritten or deleted, so a container-level immutable policy is required.

Should I use premium block blobs instead of GPv2 hot to reduce data access charges?

Premium block blobs are provisioned for high transaction rates and low latency and cost far more per GB; for a <10 GB dataset read daily, GPv2 with the hot tier minimizes overall access charges.

More AZ-305 FAQ →

Discussion 29 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 29

  1. IRISone 👍 76
    1. correct 2. Should be COntainer Policy for immutable storage. A resource lock does not prevent removal of files and folders. Prevents deleting resource inside the resource group
  2. OPT_001122 👍 32
    1 is correct 2 - Container access policy
  3. NotMeAnyWay 👍 13
    1. Storage account type: C. General purpose v2 with hot access tier for blobs The hot access tier provides lower data access costs compared to the cool access tier, making it more suitable for minimizing charges when data is accessed daily. Although the cool tier has lower storage costs, the data access charges are higher, which would not be ideal for your scenario. Premium block blobs are meant for high-performance scenarios and are not necessary for a small dataset of less than 10 GB. 2. Configuration to prevent modifications and deletions: B. Container access policy You can create a container access policy with specific permissions (in this case, read-only) and set an expiry time of five years. This policy prevents modifications and deletions, while still allowing the data to be read. After five years, the policy will expire, and the data can be deleted but not modified. Storage account resource locks and container access level settings don't offer the same granularity of control over the data as the container access policy.
  4. NagaByrd 👍 9
    Same as Question #17 1. GPv2 with hot access tier for blobs 2. Container access policy
  5. Rams_84zO6n 👍 7
    1. Premium block blobs 2. Container Policy https://azure.microsoft.com/en-us/pricing/details/storage/blobs/ Operations and data transfer
Show 24 more comments
  1. LeeVee 👍 5
    GPv2 and Container Policy
  2. Elecktrus 👍 4
    It's not the same question #17. This question have a different option (Premium Block blobs) and this is the correct answer, because access cost to Premium Block is cheaper than GPv2 hot tier
  3. xRiot007 👍 3
    Box 2 is a container access policy (for immutable storage) A resource lock will only prevent the modification/deletion of the said resource, not of the data inside of that resource.
  4. 23169fd 👍 2
    Storage account type: General purpose v2 with Hot access tier for blobs: This option provides a balance between performance and cost, ideal for daily access. Configuration to prevent modifications and deletions: Container access policy with an immutable blob policy: This ensures that data cannot be modified or deleted, strictly adhering to the requirement of read-only access until the data can be deleted after five years.
  5. Rams_84zO6n 👍 2
    premium block blob, container access policy We only need to minimize access charge, not storage cost. https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-block-blob-premium In other words, to access same amount of data within a given time - 500 million reads /second. That is much faster than GPv2 hot tier milisecond access time
  6. 155e6a0 👍 2
    Storage account type: General purpose v2 with Hot access tier for blobs. Hot access is the cheapest. Configuration to prevent modifications and deletions: Storage account resource lock. Container Access Policy is for SAS.
  7. MasterMans 👍 2
    General purpose v2 with Cool access tier for blobs - It offers lower access costs than the Hot tier. Container access policy - You can configure immutability policies.
  8. 155e6a0 👍 2
    Container Access Policy does not include immutability and retention. The question is about prevent modifications and deletions. So, use lock...
  9. ed79 👍 2
    Check it out Premium is cheaper for data access https://azure.microsoft.com/en-us/pricing/details/storage/blobs/?cdn=disable
  10. Amrx 👍 2
    For Data Storage and Access, Premium will be the cheapest. https://azure.microsoft.com/en-us/pricing/details/storage/blobs/
  11. ed79 👍 2
    Why not Premium block blobs and the storage amount is small. Access charges are cheapest in the scenario
  12. OrangeSG 👍 2
    The question mentioned "The data will be accessed daily.". Can not assume super high read frequency.
  13. Lazylinux 👍 1
    Storage account type: General purpose v2 with HOT access tier for blobs, it is most expensive in storage cost but CHEAPEST in access costs and hence meets requirements https://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview Once the data is written, the data can only be read. Modifications and deletion must be prevented. is called WORM and can only be done via policy and hence container access policy. For those who say Storage resource lock is NOT correct because it can achieve the required goal however it fails to stop it being modified i.e. in order to delete the storage/blob you need to remove the lock from read and make it modify at that moment no guarantee that no one is accessing it and modifying it and other problem is resource lock are way to administrative as compared to Container policy (automated) i.e. who will remember to remove lock of storage acc and allow for delete without ever being modified after 5 years!! Good Luck :)
  14. Aikendrum 👍 1
    Azure Blob Storage (Hot Tier) Optimized for frequent access with low data access charges. Provides high availability and redundancy options like Geo-Redundant Storage (GRS) for added protection. Immutable Blob Storage with Time-Based Retention Enforces write-once, read-many (WORM) policies to prevent modification or deletion for five years. After five years, the data can be deleted, but never modified. Configured via Storage Account Blob Immutability Policies. Data Retention Policy Apply an Immutable Policy for five years using the following command: Set-AzStorageBlobImmutabilityPolicy -ContainerName "data-container" -PolicyName "RetentionPolicy" -RetentionInDays 1825
  15. 23169fd 👍 1
    Storage account resource lock: Reason against: While a resource lock can prevent the entire storage account or container from being deleted, it doesn't inherently enforce immutability of the data. Resource locks are more suited for protecting against accidental deletion or modification of the resource itself, not the data within it. The Cool access tier is optimized for infrequently accessed data, which means lower storage costs but higher access charges. Since the data will be accessed daily, the higher access charges could lead to higher overall costs, which does not align with the requirement to minimize data access charges
  16. Chenn 👍 1
    Storage account type: General purpose v2 with Cool access tier for blobs. This option is suitable because it allows storing data that is infrequently accessed, which helps minimize data access charges, and it supports blob storage which can handle datasets under 10 GB. Configuration to prevent modifications and deletions: Storage account resource lock. This option prevents modifications or deletions of the storage account resources, ensuring that once written, the data can only be read as required.
  17. Lazylinux 👍 1
    I tend to disagree, please read my comments.. cool is more expensive in access charges than hot, resource lock will not allow you delete without remove the lock and hence too much administration
  18. PatFFM 👍 1
    The second answer is wrong. A resource lock does exactly what the name suggests - it locks the resource itself. To prevent modification of the files, a container access policy is needed.
  19. mesloth 👍 1
    However, In same table you will find access cost higher than HOT Tier. So I would go with HOT Tier as question as for "access" cost instead of "Storage" Cost
  20. mesloth 👍 1
    https://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview#summary-of-access-tier-options Cool tear too has latency in miliseconds
  21. AzureMasterChamp 👍 1
    This is correct answer!!! https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview
  22. CallmeZdzisiek 👍 1
    Imho - GPV2 will be cheaper than Premium Block Blobs. You can check with Azure pricing calculator.
  23. 155e6a0 👍 1
    Many answers in ET were from ChatGPT. Please try more AI tools to double check before posting.
  24. Thanveer 👍 1
    1. GPv2 with hot access tier for blobs 2. Container access policy

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Network Watcher IP Flow Verify vs Traffic Analytics

S-grade

Which components handle AKS state, pub/sub, and traffic splitting?

S-grade

Which Azure Monitor Features Provide Synthetic Transaction Monitoring for App1?

S-grade

How Many Azure Monitor Workspaces for Sentinel, App Insights and VM Insights?

S-grade

Practice All AZ-305 Questions

Access 95 questions with complete answers and detailed explanations.

View Full AZ-305 Practice Test →

← Back to AZ-305 Study Guide