<< Prev Question Next Question >>
Question 48/74
You have an Azure subscription and an on-premises datacenter. The datacenter contains 100 servers that run Windows Server. AJI the servers are backed up to a Recovery Services vault by using Azure Backup and the Microsoft Azure Recovery Services (MARS) agent.
You need to design a recovery solution for ransomware attacks that encrypt the on-premises servers. The solution must follow Microsoft Security Best Practices and protect against the following risks:
* A compromised administrator account used to delete the backups from Azure Backup before encrypting the servers
* A compromised administrator account used to disable the backups on the MARS agent before encrypting the servers What should you use for each risk? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
You need to design a recovery solution for ransomware attacks that encrypt the on-premises servers. The solution must follow Microsoft Security Best Practices and protect against the following risks:
* A compromised administrator account used to delete the backups from Azure Backup before encrypting the servers
* A compromised administrator account used to disable the backups on the MARS agent before encrypting the servers What should you use for each risk? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
Recent Comments (The most recent comments are at the top.)
Still Soft Delete is for workloads running in Azure only - not on-prem server backups with MARS agents
https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature
For Deleted Backups:
A Security PIN for Critical Operations
Why?
For on-premises workloads backed up with the MARS agent, the Security PIN adds an additional layer of protection for critical operations, including deleting backup data.
Even if an administrator account is compromised, a Security PIN must be entered before backups can be deleted, reducing the risk of ransomware attacks deleting the backups.
For Disabled Backups:
Multi-user Authorization by Using Resource Guard
Why?
Resource Guard ensures that disabling backups or modifying critical backup settings requires multi-user authorization (MUA).
This prevents a single compromised administrator account from disabling backups on the MARS agent, ensuring backups remain operational.