Examkin

Question

Difficulty: HardAzure Files Backup and Restore

You have an Azure subscription that contains the following resources in the North Europe region:
- A Recovery Services vault named `rsv-ne-backup`.
- A Premium storage account named `sa-hr-records` that hosts an SMB file share named `hr-documents`.
- A resource group named `rg-hr-prod` containing both resources.

The firewall for `sa-hr-records` is enabled and configured to allow access only from selected virtual networks.
An administrator named Admin1 is assigned the Storage Account Contributor role for the `sa-hr-records` storage account and the Backup Operator role for the `rsv-ne-backup` vault.
When Admin1 attempts to configure backup for the `hr-documents` file share using the `rsv-ne-backup` vault, the configuration fails because the storage account is network-isolated and inaccessible to the vault.
Which configuration change should you make to resolve the issue?

  1. A
    Add the outbound IP addresses of the Recovery Services vault to the allowed IP ranges in the firewall settings of the storage account.
  2. Enable the 'Allow Azure services on the trusted services list to access this storage account' setting in the firewall configuration of the storage account.Answer
  3. C
    Assign the Storage File Data Privileged Contributor role to the managed identity of the Recovery Services vault on the storage account.
  4. D
    Assign the Backup Operator role to the system-assigned managed identity of the storage account.

Answer

Enable the 'Allow Azure services on the trusted services list to access this storage account' setting in the firewall configuration of the storage account.
To back up an Azure File Share hosted in a storage account with an active firewall, you must allow Azure Backup to bypass the firewall. This is achieved by enabling the 'Allow Azure services on the trusted services list to access this storage account' setting in the storage account's network configuration.

Step-by-Step Solution

1
Analyze the configuration failure
The configuration fails because the Premium storage account hosting the SMB file share has a firewall enabled, blocking the Recovery Services vault from communicating with it.
Azure Backup needs control-plane access to the storage account to manage snapshots and register the file share.
2
Evaluate network access options for Azure Backup
Since Recovery Services vaults do not have static outbound IP addresses, standard IP firewall rules cannot be used to permit vault access.
Dynamic IP resources require a service-level exception rather than static IP whitelisting.
3
Configure the trusted services exception
Enable the 'Allow Azure services on the trusted services list to access this storage account' setting on the storage account firewall.
This allows Azure Backup, which is a trusted Microsoft service, to bypass the firewall rules and orchestrate backups of the file share.

Key Concept

Backing up Azure Files in a firewall-secured storage account using Recovery Services Vault
Rate this question

Topics

Azure Files Backup and Restore

More questions from this topic