A reviewer claims weekly Key Vault backups make purge protection optional for the lock-lab vault. How should the security engineer respond?
Select an answer to reveal the explanation.
Short Explanation
Backups are a spare tire, not a reason to rip out purge protection. Keep soft-delete plus purge protection on the live vault so an insider can’t flush it during retention—even if weekly backups exist.
Full Explanation
Layered recovery for Key Vault includes soft-delete, purge protection on the live vault, and offline encrypted backups. Backups help after loss or migration but do not stop a privileged insider from purging soft-deleted live vault material during retention if purge protection is absent. Disabling recovery features or moving secrets to jump-box files increases risk. AZ-500 expects engineers to keep these controls complementary.