Examkin

Question

Difficulty: HardAzure Virtual Machine Recovery and Restore

An administrator manages an Azure virtual machine named `VM-Finance01` that is backed up to a Recovery Services vault named `RSV-Prod`. Due to an application failure, the administrator needs to recover the virtual machine by restoring its managed disks. The administrator plans to restore the disks to an existing storage account named `safinancetarget`. The firewalls and virtual networks settings for `safinancetarget` are configured to restrict access to 'Enabled from selected networks and IP addresses'. When the administrator attempts to run the restore operation, the job fails with a permission error. Which combination of configurations is required to ensure that `RSV-Prod` can successfully restore the managed disks to `safinancetarget`?

  1. A
    Configure the storage account firewall to allow access from the public IP address of the Recovery Services vault, and assign the Reader role to the vault's managed identity on the storage account.
  2. B
    Use the 'Replace existing' VM restore option to restore the disks directly to the original virtual machine, which bypasses the need for a destination storage account and avoids firewall checks.
  3. Enable the system-assigned managed identity of the Recovery Services vault, assign it the Storage Blob Data Contributor role on the storage account, and configure the storage account firewall to allow trusted Microsoft services.Answer
  4. D
    Create a private endpoint for the Recovery Services vault in the virtual network of the storage account, and assign the Owner role to the virtual machine's system-assigned managed identity on the storage account.

Answer

Enable the system-assigned managed identity of the Recovery Services vault, assign it the Storage Blob Data Contributor role on the storage account, and configure the storage account firewall to allow trusted Microsoft services.
To restore managed disks from a Recovery Services vault to a firewalled storage account, the Azure Backup service must be able to write to the storage account. This requires enabling a managed identity on the vault, assigning it the Storage Blob Data Contributor role on the target storage account, and allowing trusted Microsoft services to bypass the storage account firewall.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Recovery Services vault.
The vault is registered in Microsoft Entra ID with its own identity, enabling role-based access control.
This is necessary so the vault can authenticate against the target storage account.
2
Assign the Storage Blob Data Contributor role to the vault's managed identity on the destination storage account.
The vault gains data-plane write access to the storage account containers.
The vault must have permissions to write the recovered managed disk VHDs to the storage account.
3
Configure the storage account firewall to allow trusted Microsoft services.
The firewall allows secure traffic from Azure Backup bypass rules.
The firewall normally blocks access from external networks, but checking this option allows the trusted Azure Backup service to bypass the block.

Key Concept

Restoring managed disks to a firewall-enabled storage account using the Recovery Services vault managed identity and trusted service bypass.
Rate this question

Topics

Azure Virtual Machine Recovery and Restore

More questions from this topic