Examkin

Question

Difficulty: MediumAzure Virtual Machine Backup Configuration

You have an Azure subscription. You deploy a virtual machine named vm-retail-prod in the UK South region. The virtual machine runs Windows Server 2022.

A network security group (NSG) named nsg-retail is associated with the subnet hosting vm-retail-prod. Currently, nsg-retail contains a custom outbound rule that blocks all outbound traffic to the internet.

You plan to configure Azure Backup for vm-retail-prod.

Which two actions should you perform to enable the backup configuration? (Select two.)

  1. Create a Recovery Services Vault in the UK South region.Answer
  2. B
    Create a Recovery Services Vault in the East US region.
  3. Configure an outbound security rule in nsg-retail that allows traffic to the AzureBackup service tag.Answer
  4. D
    Configure an inbound security rule in nsg-retail that allows traffic from the AzureBackup service tag.

Answer

To configure backup for the virtual machine, you must create a Recovery Services Vault in the UK South region and configure an outbound security rule in the network security group (NSG) that allows traffic to the AzureBackup service tag.
The Recovery Services Vault must be created in the same region as the virtual machine (UK South). Additionally, the virtual machine extension needs outbound connectivity to Azure Backup endpoints, which can be permitted by creating an outbound rule in the network security group (NSG) targeting the AzureBackup service tag.

Step-by-Step Solution

1
Identify the regional requirement for the vault.
The Recovery Services Vault must be deployed in the same region as the target virtual machine, which is UK South.
Azure Backup does not support backing up virtual machines to a Recovery Services Vault located in a different region.
2
Analyze network security group (NSG) requirements for VM backup.
The virtual machine must have outbound connectivity to the Azure Backup service.
The backup extension running inside the virtual machine communicates with Azure Backup service endpoints. If outbound traffic is blocked, backups will fail.
3
Determine the correct NSG rule configuration.
Add an outbound rule allowing traffic to the AzureBackup service tag.
Service tags simplify NSG configuration by representing groups of IP addresses. The AzureBackup tag covers all public IP addresses utilized by the backup service. Inbound rules are not required as the connection is outbound initiated.

Key Concept

Azure Virtual Machine Backup prerequisites require a Recovery Services Vault in the same region as the virtual machine, along with outbound network connectivity to the Azure Backup service.
Rate this question

Topics

Azure Virtual Machine Backup Configuration

More questions from this topic