Cloud and SaaS Protection
Cloud and SaaS Protection tests backup and recovery for Microsoft 365, Azure and AWS workloads, and SaaS APIs. The exam focuses on shared responsibility, API permissions, retention gaps, and cross-region recovery.
Core rules
- Native cloud retention is not backup. Soft delete and recycle bins expire. SaaS backup provides independent copies and granular restore.
- Know the shared responsibility model: the provider secures the platform; you secure data, identities, configurations, and retention.
- Scope API app consent to least privilege. Request only the workloads and actions needed, and monitor consent and token health.
- Protect against accidental deletion, ransomware, and insider risk with immutable retention and cross-region copies.
- Test granular restore for mailbox, site, or object, and test full-region recovery. Verify throttling and API limits.
Worked example
A departing administrator deletes a SharePoint site and empties the recycle bin. Native retention is 93 days for the site, but the legal hold was misconfigured. The SaaS backup has a one-year immutable copy. Restore the site to an alternate URL first, validate permissions and content, then map it to the original. Because the deletion was malicious, preserve audit logs and restrict the administrator account before restore.
Traps that cost marks
Assuming Microsoft backs up Microsoft 365. Granting tenant-wide read/write consent. Ignoring throttling. Having no cross-region copy. Restoring to the original location before validation.