Examkin

Question

Difficulty: MediumRecovery Services Vaults and Backup Vaults

Your company has an Azure subscription named Sub-Enterprise-Ops that contains the resources shown in the following table:

Resource NameResource TypeRegionResource Group
vm-orders-01Virtual MachineWest USrg-ops-01
sa-records-01Storage Account (Blobs)East USrg-data-01
rsv-west-01Recovery Services VaultWest USrg-ops-01
bv-east-01Backup VaultEast USrg-data-01
rsv-east-01Recovery Services VaultEast USrg-data-01

You need to configure backup for vm-orders-01 and the blob containers in sa-records-01. Which configuration should you use?

  1. Back up vm-orders-01 to rsv-west-01, assign the Storage Blob Data Contributor role to the managed identity of bv-east-01, and back up the blob containers in sa-records-01 to bv-east-01.Answer
  2. B
    Back up vm-orders-01 to rsv-east-01, assign the Storage Blob Data Contributor role to the managed identity of bv-east-01, and back up the blob containers in sa-records-01 to bv-east-01.
  3. C
    Back up vm-orders-01 to rsv-west-01, and back up the blob containers in sa-records-01 to bv-east-01 without additional role assignments by relying on subscription-level Owner permissions.
  4. D
    Back up vm-orders-01 to rsv-east-01, and back up the blob containers in sa-records-01 to rsv-west-01.

Answer

Back up vm-orders-01 to the Recovery Services Vault in West US, assign the Storage Blob Data Contributor role to the managed identity of the Backup Vault in East US, and back up the blob containers in sa-records-01 to that Backup Vault.
The correct configuration respects both regional and vault type requirements. Virtual machines must be backed up to a Recovery Services Vault in the same region, meaning the VM in West US must use the Recovery Services Vault in West US. Storage account blob backups are managed via Backup Vaults, requiring the Backup Vault and the storage account to be in the same region (East US). Additionally, because Azure Backup requires data-plane access to target storage accounts, the Backup Vault's managed identity must be granted the Storage Blob Data Contributor role.

Step-by-Step Solution

1
Determine the vault type and regional requirements for the virtual machine backup.
Azure Virtual Machines require a Recovery Services Vault, and the vault must reside in the same region as the VM. Therefore, vm-orders-01 (West US) must use rsv-west-01.
Azure Backup enforces regional boundaries for VM protection to prevent cross-region network latency and compliance issues during backup operations.
2
Determine the vault type and regional requirements for the blob container backup.
Azure Storage Blobs require a Backup Vault, and the vault must reside in the same region as the storage account. Therefore, sa-records-01 (East US) must use bv-east-01.
Operational backup for blobs is managed through Backup Vaults, which must align regionally with the target storage account.
3
Configure the required data-plane access permissions on the storage account.
Assign the Storage Blob Data Contributor role to the system-assigned managed identity of bv-east-01.
Azure Backup requires explicit data-plane access to read and write blob data. Control-plane permissions (such as Owner or Contributor at the subscription or resource group level) do not inherently grant these data-plane rights.

Key Concept

Azure Backup regional alignment and vault compatibility constraints
Rate this question

Topics

Recovery Services Vaults and Backup Vaults

More questions from this topic