An encrypted workload must resist permanent loss of its customer-managed key after accidental deletion. Which two vault controls should be included? Select 2 answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

A.A management lock treated as a substitute for key recovery.
B.Only a resource tag declaring the key recoverable.
C.Soft delete for recoverability within retention.
D.A plan to purge every deleted key immediately.
E.Purge protection to prevent early permanent deletion.

Show the answer and explanation

✓ Correct answers

Soft delete for recoverability within retention.
Purge protection to prevent early permanent deletion.

Soft delete retains recoverable objects, and purge protection blocks permanent deletion before the retention period ends. Tags do not provide recovery. Immediate purge undermines the requirement, and management locks do not replace object recovery controls or the availability of required key versions. Source: AZ-305 Study Guide.pdf, PDF page(s) 17.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.