Examkin

Question

Difficulty: MediumAzure Files Backup and Restore

You manage an Azure environment containing a Standard storage account named sa-logistics-prod in the West Europe region. The storage account hosts an SMB file share named shipments and has its firewall configured to restrict access to 'Selected networks'. Backups of the shipments file share are configured using a Recovery Services vault named rsv-logistics. An administrator named Admin1 is assigned the Backup Operator role at the resource group level. Admin1 attempts to restore files to the original location using Azure Backup but receives an access denied error. Which of the following configuration changes is required to allow the restore operation to succeed?

  1. A
    Assign the Storage File Data Privileged Contributor role to Admin1 for sa-logistics-prod.
  2. Enable the 'Allow trusted Microsoft services to access this storage account' setting on the firewall of sa-logistics-prod.Answer
  3. C
    Configure a Private Endpoint for the Recovery Services vault in the virtual network connected to sa-logistics-prod.
  4. D
    Assign the Owner role to Admin1 for the Recovery Services vault rsv-logistics.

Answer

Enable the 'Allow trusted Microsoft services to access this storage account' setting on the firewall of sa-logistics-prod.
To restore files to an Azure file share where the hosting storage account restricts access to selected networks, the Azure Backup service must be allowed to bypass the firewall. Enabling the 'Allow trusted Microsoft services to access this storage account' exception on the storage account firewall grants the Azure Backup service the necessary network-level access to perform the restore. Because the administrator already holds the Backup Operator role, they have sufficient control plane rights to start the restore, but the network boundary blocks the data plane operations.

Step-by-Step Solution

1
Analyze the error context.
The restore operation to the original location is failing with an access denied error because the Standard storage account has its firewall enabled, blocking inbound traffic from unauthorized networks.
You need to determine whether the issue is caused by insufficient RBAC permissions or network-level restrictions.
2
Evaluate Admin1's RBAC role permissions.
Admin1 has the Backup Operator role at the resource group level, which is sufficient to trigger backup and restore operations in the vault. Thus, control plane authorization is not the bottleneck.
This rules out the need to assign higher control plane privileges (like Owner) or data plane privileges to the user identity.
3
Resolve the storage account firewall block for the backup service.
By enabling the 'Allow trusted Microsoft services to access this storage account' exception on the storage account's firewall, the Azure Backup service principal can bypass the firewall to write restored data to the SMB file share.
Azure Backup acts as a trusted service to write files during restore operations, requiring this network bypass configuration.

Key Concept

Configuring firewall bypass exceptions for trusted Microsoft services to perform Azure Files restore operations.
Rate this question

Topics

Azure Files Backup and Restore

More questions from this topic