Examkin

Question

Difficulty: Very hardConfigure Azure Data Box and Import/Export Services

An administrator needs to migrate 120 TB120\text{ TB} of archived virtual machine disk (VHD) files from an on-premises Windows Server 2022 failover cluster to an Azure Storage account. Due to strict corporate security policies, the data cannot be transmitted over the WAN network (Internet or VPN), and the use of Azure-owned physical appliances on-premises is prohibited. The target storage account is protected by a firewall that restricts network access to authorized virtual networks. Which of the following actions are required to configure the Azure Import/Export service and successfully prepare the drives? (Select THREE.)

  1. Format the customer-provided SATA hard drives as NTFS and run the WAImportExport tool on a Windows client to copy the VHD files and encrypt the drives.Answer
  2. Create an import job in the Azure portal and upload the journal (.jrn) files generated during drive preparation.Answer
  3. Enable the 'Allow trusted Microsoft services to access this storage account' exception in the storage account firewall settings.Answer
  4. D
    Generate an ad-hoc Shared Access Signature (SAS) token with no expiration date to authenticate the WAImportExport tool during drive preparation.
  5. E
    Assign the Microsoft Entra ID Owner role at the storage account scope to the shipping carrier to authorize import data plane access.
  6. F
    Configure Azure File Sync on the on-premises servers to sync the data directly to multiple cloud endpoints before shipping the prepared drives.

Answer

To perform the migration, you must format the drives as NTFS and use the WAImportExport tool to copy the VHDs and encrypt the drives, create an import job in the Azure portal and upload the resulting journal (.jrn) files, and enable the 'Allow trusted Microsoft services' bypass in the destination storage account firewall.
The correct options identify the mandatory steps for importing data via the Azure Import/Export service. First, customer-provided SATA drives must be formatted as NTFS, and the WAImportExport tool must copy the VHD data and encrypt the drives. Second, the generated journal (.jrn) files must be uploaded during the creation of the import job in the Azure portal to provide Microsoft with the BitLocker keys. Finally, since the destination storage account has a firewall enabled, the administrator must configure the storage account to allow trusted Microsoft services, permitting the Import/Export service to write the data from the decrypted drives.

Step-by-Step Solution

1
Analyze constraints to select the correct migration method.
Since Azure-owned hardware (like Data Box) is prohibited on-premises and network-based ingestion is disallowed, the Azure Import/Export service must be used with customer-provided hard drives.
This complies with both the prohibition of vendor hardware and the network isolation constraint.
2
Prepare the physical storage drives.
Format the customer-owned SATA drives as NTFS and run the WAImportExport tool on a Windows client to copy the VHD data, encrypt the drives via BitLocker, and output journal (.jrn) files.
NTFS is the required filesystem for Azure Import/Export, and the tool prepares the drives and gathers encryption keys.
3
Configure the import job metadata.
Create the import job in the Azure portal and upload the generated journal (.jrn) files containing the BitLocker keys.
The journal files are necessary for Azure to decrypt the physical disks once they are delivered to the Azure datacenter.
4
Configure destination storage network security.
Enable the 'Allow trusted Microsoft services to access this storage account' bypass option on the storage account firewall.
The Import/Export service runs as a trusted Microsoft service and requires this bypass to write data through the storage account firewall.

Key Concept

Preparing and configuring offline data migration using the Azure Import/Export service under network and physical hardware constraints.
Rate this question

Topics

Configure Azure Data Box and Import/Export Services

More questions from this topic