Examkin

Question

Difficulty: Very hardAzure Virtual Machine Recovery and Restore

An organization requires the recovery of an encrypted production virtual machine named `vm-sec-prod` that runs Windows Server 2025. The virtual machine's disks are encrypted using Azure Disk Encryption (ADE) with keys managed in an Azure Key Vault. The virtual machine has suffered operating system corruption, and you must restore it to the original virtual network and subnet.

Which sequence of steps must you perform to restore the encrypted virtual machine?

  1. 1Initiate a 'Restore Disks' operation from the Recovery Services vault to a staging storage account using the selected recovery point.
  2. 2Wait for the restore job to complete, and then navigate to the staging storage account container containing the deployment templates.
  3. 3Download the generated Azure Resource Manager (ARM) template and parameters file.
  4. 4Modify the parameters file to specify the target virtual network, subnet, and new virtual machine name.
  5. 5Deploy the customized template using PowerShell, Azure CLI, or the Azure portal to recreate the virtual machine.

Answer

To restore an Azure Disk Encryption (ADE) encrypted virtual machine, you must first initiate a 'Restore Disks' operation to a staging storage account. Once the restore job finishes, navigate to the storage account container to download the generated ARM template and parameters file. Next, modify the parameters file with the target virtual network, subnet, and VM name. Finally, deploy the modified template using PowerShell, Azure CLI, or the Azure portal to recreate the VM.
For virtual machines encrypted with Azure Disk Encryption (ADE), direct restoration via 'Create virtual machine' or 'Replace existing' is not supported. The administrator must first perform a 'Restore Disks' operation to copy the encrypted VHDs to a staging storage account. Azure Backup automatically generates an ARM template and parameters file in the storage account. The administrator must download these files, modify the parameters (such as the target virtual network, subnet, and VM name), and deploy the template to recreate the VM.

Step-by-Step Solution

1
Initiate 'Restore Disks' in the Recovery Services vault.
Disks are copied to the staging storage account, and deployment templates are generated.
Direct VM restore ('Create virtual machine' or 'Replace existing') is not supported for ADE-encrypted VMs.
2
Locate and download the template files in the staging storage account.
You obtain the `template.json` and `parameters.json` files.
These templates contain the configuration and disks reference required to deploy the VM with its encryption settings.
3
Edit the `parameters.json` file.
The parameters are customized with target network, subnet, and VM names.
This configuration maps the restored resources to the correct infrastructure components.
4
Deploy the template using Azure CLI, PowerShell, or the portal.
A new VM is provisioned using the restored disks.
This registers the VM with the Azure fabric and attaches the encryption keys from Key Vault.

Key Concept

Restoring Azure Disk Encryption (ADE) Encrypted Virtual Machines
Rate this question

Topics

Azure Virtual Machine Recovery and Restore

More questions from this topic