Examkin

Question

Difficulty: MediumAzure Files Backup and Restore

You manage a Premium storage account named stcorpfiles01 in the East US 2 region. The storage account hosts an SMB file share named sharesmbcore and has its firewall configured to restrict access to selected virtual networks. You configure a Recovery Services vault named rsv-corp-backup in the same region to back up the file share. When you attempt to configure the backup, the operation fails because the vault cannot access the storage account. Which configuration is required on the storage account to resolve this issue?

  1. Enable the 'Allow trusted Microsoft services to access this storage account' bypass option under the Firewalls and virtual networks settings.Answer
  2. B
    Assign the Backup Operator role to the Recovery Services vault's system-assigned managed identity on the storage account.
  3. C
    Add the public IP address of the Recovery Services vault to the allowed IP address ranges in the storage account firewall rules.
  4. D
    Assign the Storage File Data Privileged Contributor role to the user account performing the backup configuration.

Answer

Enable the 'Allow trusted Microsoft services to access this storage account' bypass option under the Firewalls and virtual networks settings.
The correct option is to enable the 'Allow trusted Microsoft services to access this storage account' bypass option. When an Azure Storage account firewall is enabled, Azure Backup requires this bypass to interact with the storage account and take the snapshots required for backing up the file shares.

Step-by-Step Solution

1
Identify the cause of the backup failure.
The backup fails because the storage account firewall blocks incoming requests from the Recovery Services vault.
By default, when a storage account firewall is enabled, all external access is blocked unless specifically permitted.
2
Determine the correct bypass mechanism for Azure Backup.
Azure Backup is classified as a trusted Microsoft service.
Rather than allowing specific IP addresses or virtual networks, Azure provides a built-in exception setting for its own trusted services.
3
Configure the bypass option in the Azure portal or CLI.
The firewall allows the Recovery Services vault to orchestrate snapshots and perform backup tasks.
Enabling the 'Allow trusted Microsoft services...' exception resolves the connectivity issue while maintaining the firewall restriction for other network traffic.

Key Concept

Azure Files Backup and Restore
Estimated Time:1m 30s
Rate this question

Topics

Azure Files Backup and Restore

More questions from this topic