Examkin

Question

Difficulty: HardCreate and Configure Virtual Machines

An administrator is preparing to deploy a new virtual machine named VM-DB-01 in the West US 2 region to host a database workload. The deployment must satisfy the following requirements:

1. The virtual machine must be protected against the failure of an entire datacenter within the West US 2 region.
2. The virtual machine must be backed up daily using Azure Backup.
3. Database administrators must have permissions to manage database files stored on an Azure Storage account, but they must not have permissions to modify the configurations of the virtual machine or the storage account.

Which set of configurations should the administrator select during the deployment process?

  1. Deploy VM-DB-01 in an Availability Zone, create a Recovery Services vault in West US 2, and assign the database administrators the Storage Blob Data Contributor role on the storage account.Answer
  2. B
    Deploy VM-DB-01 in an Availability Set, create a Recovery Services vault in West US 2, and assign the database administrators the Storage Blob Data Contributor role on the storage account.
  3. C
    Deploy VM-DB-01 in an Availability Zone, create a Recovery Services vault in East US, and assign the database administrators the Storage Blob Data Contributor role on the storage account.
  4. D
    Deploy VM-DB-01 in an Availability Zone, create a Recovery Services vault in West US 2, and assign the database administrators the Contributor role on the resource group containing the storage account.

Answer

Deploy the virtual machine in an Availability Zone, create a Recovery Services vault in the same region (West US 2), and assign the Storage Blob Data Contributor role on the storage account to the database administrators.
Deploying the virtual machine in an Availability Zone ensures that the instance is protected against datacenter-wide failures. The Recovery Services vault must be deployed in the same region (West US 2) as the virtual machine to enable Azure Backup. Assigning the Storage Blob Data Contributor role provides the database administrators with data-plane access to manage files in the storage account without granting control-plane permissions to modify any resource configurations.

Step-by-Step Solution

1
Select the appropriate infrastructure redundancy option for datacenter-wide resilience.
Choose Availability Zones instead of Availability Sets to ensure virtual machine instances are isolated across different physical datacenters within the West US 2 region.
Availability Zones protect workloads from datacenter outages, whereas Availability Sets only protect against local hardware failures within a single datacenter.
2
Align the Recovery Services vault region with the virtual machine.
Deploy the Recovery Services vault in the West US 2 region.
Azure Backup requires the Recovery Services vault and the protected virtual machine to reside in the same region to function.
3
Configure the least-privilege access control for managing database files on the storage account.
Assign the database administrators the Storage Blob Data Contributor role.
This role grants data-plane access (reading, writing, and deleting blobs) without granting control-plane administrative access (Contributor or Owner) which would allow modifications to resource configurations.

Key Concept

Azure VM deployment configurations including availability options, region alignment for recovery services, and separation of data-plane and control-plane permissions.
Estimated Time:2m 30s
Rate this question

Topics

Create and Configure Virtual Machines

More questions from this topic