An architect must secure a sensitive Blob workload and validate protection rather than infer it. Which three activities are appropriate? Select three.

Select all that apply. Every correct option and no extras are required for credit in the app.

A.Assume enabling a Blob private endpoint removes the need for identity permissions
B.Select and test recovery or immutable retention controls according to business requirements
C.Assume at-rest encryption blocks every authorized export
D.Use scoped data permissions and restrict unnecessary key retrieval or Shared Key access where compatible
E.Validate private endpoint DNS and public-access settings for the intended path

Show the answer and explanation

✓ Correct answers

Select and test recovery or immutable retention controls according to business requirements
Use scoped data permissions and restrict unnecessary key retrieval or Shared Key access where compatible
Validate private endpoint DNS and public-access settings for the intended path

Data authorization, validated network paths, and appropriate lifecycle protection cover distinct risks. Encryption alone does not block authorized exports, and private networking does not replace identity permissions.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.