Examkin

Question

Difficulty: MediumAzure Files Backup and Restore

An administrator is configuring backup and restore solutions for Azure Files. The environment contains a Recovery Services vault named Vault-EastUS in the East US region, and the following three storage accounts in the same region:

* `sa-prod-smb-std`: A Standard performance storage account hosting an SMB file share named `files-smb-std`. The firewall is configured to allow access from all networks.
* `sa-prod-smb-prem`: A Premium performance storage account hosting an SMB file share named `files-smb-prem`. The firewall is configured to allow access only from selected networks.
* `sa-prod-nfs-prem`: A Premium performance storage account hosting an NFS file share named `files-nfs-prem`. The firewall is configured to allow access only from selected networks.

Which two actions must the administrator perform to successfully configure backups for the supported file shares using Vault-EastUS?

  1. Enable the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings of sa-prod-smb-prem.Answer
  2. Configure backups only for files-smb-std and files-smb-prem, as Azure Backup does not support backing up NFS file shares.Answer
  3. C
    Assign the Backup Operator role to the administrator on the storage accounts to allow them to register the storage accounts with the Recovery Services vault.
  4. D
    Enable the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings of sa-prod-nfs-prem to enable backup of files-nfs-prem.
  5. E
    Create a private endpoint for Vault-EastUS inside the virtual network of sa-prod-smb-prem to bypass the firewall rules.

Answer

Enable the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings of sa-prod-smb-prem, and configure backups only for files-smb-std and files-smb-prem as NFS file shares are not supported.
The correct actions are enabling the firewall bypass for trusted Microsoft services on the premium SMB storage account and backing up only the SMB shares. Azure Backup for Azure Files is snapshot-based and supports standard and premium SMB file shares, but it does not support NFS file shares. When a storage account firewall restricts access to selected networks, the Azure Backup service requires the 'Allow trusted Microsoft services to access this storage account' exception to be enabled to access and manage the share snapshots.

Step-by-Step Solution

1
Identify which file shares can be backed up using Azure Backup.
Only SMB file shares (files-smb-std and files-smb-prem) are supported by Azure Backup; the NFS file share (files-nfs-prem) is unsupported.
Azure Backup for Azure Files only supports SMB file shares. NFS file shares cannot be registered or backed up using Recovery Services Vaults.
2
Determine firewall requirements for the supported SMB storage accounts.
For sa-prod-smb-prem, which has firewall rules restricting access to selected networks, the 'Allow trusted Microsoft services to access this storage account' exception must be enabled.
This allows the Azure Backup service to bypass the firewall and manage the file share snapshots. sa-prod-smb-std allows all networks, so no firewall bypass is required.
3
Verify administrator permissions for storage account registration.
Ensure the registering administrator has Contributor or Owner role on the storage accounts, not just Backup Operator.
Registering a storage account with a Recovery Services vault requires write access (control plane permissions) to configure the backup settings on the storage account itself.

Key Concept

Azure Files Backup supports SMB file shares in standard or premium storage accounts. For storage accounts with firewalls enabled, the 'Allow trusted Microsoft services to access this storage account' setting must be checked to permit Azure Backup access.
Rate this question

Topics

Azure Files Backup and Restore

More questions from this topic