A reviewer claims weekly Key Vault backups make purge protection optional for the lock-lab vault. How should the security engineer respond?
Select an answer to reveal the explanation.
Short Explanation
Backups are a spare tire, not a reason to rip out purge protection. Keep soft-delete plus purge protection on the live vault so an insider can’t flush it during retention—even if weekly backups exist.
Full Explanation
Layered Key Vault recovery includes soft-delete, purge protection on the live vault, and offline encrypted backups. Weekly backups are a valuable copy for restore after loss or migration, but they do not stop a privileged insider from purging the live soft-deleted vault during retention. Purge protection remains mandatory for the lock-lab vault so malicious or accidental purge is blocked until retention elapses—even when backup jobs succeed every week.
Disabling purge protection and soft-delete because any backup schedule fully replaces live-vault protections fails by concept: backups are lagging copies and do not freeze purge of the authoritative vault. Storing only unencrypted key exports and removing all Key Vault recovery features fails confidentiality and recovery design. Replacing Key Vault with local files on a jump box that is backed up monthly fails centralized secret management, access control, and platform HSM options.
Exam caveat: backups complement purge protection; they do not substitute for it on AZ-500 recovery questions. Operational check: confirm soft-delete and purge protection Enabled, verify backup jobs produce encrypted blobs stored securely, tabletop a purge attempt (expect block), and document restore RTOs separately from live-vault purge-protection guarantees.