An auditor requires Recovery Services vault backup points for the lock-lab estate that a compromised admin cannot expire early. Which control best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Soft-delete helps after a hasty delete—immutability is the padlock that says you cannot shorten the lock-lab retention clock once it is set. That is what stops a compromised admin from quietly aging the evidence out.
Full Explanation
Azure Backup immutability (vault-level or equivalent WORM-style protection described in official Azure Backup docs) prevents reduction or deletion of recovery points within the locked retention period. Soft-delete alone does not stop retention from being shortened after the soft-delete window. Public SAS access and broad Owner roles expand risk rather than protecting backup integrity.