Implement and manage storage

The correct configuration is to enable the soft delete for blobs option and specify a retention policy of 7 days.

Soft delete protects blob data from being accidentally deleted or overwritten. When soft delete is enabled for blobs, deleted data is retained in the system for the specified number of days (the retention period). During this window, you can restore the blob to the state it was in before it was deleted. once the 7-day period elapses, the data is permanently erased.

Why the other options are incorrect:
- Turning on blob versioning creates and stores a new version of a blob whenever it is modified or deleted. While this helps with data protection, the specific functionality described—recovering a deleted item for a set duration before permanent erasure—is the definition of Soft Delete. Lifecycle management rules are typically used to move data to cooler tiers or delete old versions, not to facilitate the recovery of the most recently deleted blob.
- Point-in-time restore allows you to roll back a container to a previous state, which is useful for mass recovery scenarios. However, this feature relies on soft delete, versioning, and the blob change feed to function. It is not the primary setting for ensuring single blob recovery flexibility.
- Applying a delete lock serves to prevent the deletion action entirely, rather than allowing deletion and providing a recovery window. Furthermore, Azure resource locks do not support automatic expiration timers.

The correct answer is to add an assignment for the Storage File Data SMB Share Contributor role to the user.

To access Azure Files shares using identity-based authentication (such as Active Directory Domain Services), two layers of permissions are required:

1. Share-level permissions: These are configured using Azure RBAC roles specific to Azure Files. They act as the high-level gatekeeper allowing a specific identity to connect to the share.
2. Directory/File-level permissions: These are standard Windows ACLs (NTFS permissions) enforced at the file system level once the share connection is established.

Even though the user is an 'Owner' of the storage account, this is a Management Plane role that allows them to manage the Azure resource settings but does not automatically grant Data Plane access to file content over SMB when using identity-based authentication. Consequently, despite having valid ACLs, the user is blocked at the share level.

The Storage File Data SMB Share Contributor role grants read, write, and delete access to files and directories over SMB, which meets the user's requirement.

The other options are incorrect for the following reasons:
- Assigning the standard Contributor role grants management access to the resource (Control Plane) but does not provide access to the data within the file share over SMB.
- Modifying directory-level permissions (ACLs) to Full Control is ineffective because the user cannot pass the initial share-level authorization check to even reach the files.
- The Storage File Data SMB Share Elevated Contributor role allows a user to modify permissions (change ACLs) in addition to reading and writing. Since the user only requires read/write access, assigning this role would violate the principle of least privilege.

Azure General Purpose v2 storage accounts allow administrators to configure a 'Default access tier' property, which determines the access tier for blobs that do not have an explicit tier assigned. This account-level setting supports the 'Hot' and 'Cool' access tiers (and typically 'Cold' in supported regions).

The 'Archive' tier is not supported as a default account-level setting. The Archive tier is an offline tier intended for individual block blobs that are rarely accessed. To place data in the Archive tier, you must define the tier at the object level (either specifically on the blob or via Lifecycle Management rules). Therefore, when navigating to the configuration settings in the Azure portal, the Archive option will be unavailable for selection in the Default access tier dropdown menu.