Examkin

Question

Difficulty: HardRecovery Services Vaults and Backup Vaults

Your company has an Azure environment with the resources shown in the following table:

SubscriptionResource GroupResource NameResource TypeRegion
Sub-ProductionRG-App-EastVM-App-EastVirtual MachineEast US
Sub-ProductionRG-App-EastsaappprodStorage Account (Blobs)East US
Sub-ProductionRG-App-EastRSV-App-EastRecovery Services VaultEast US
Sub-ProductionRG-App-EastBV-App-EastBackup VaultEast US
Sub-ProductionRG-Backup-WestRSV-App-WestRecovery Services VaultWest US
Sub-DevelopmentRG-Dev-EastVM-Dev-EastVirtual MachineEast US

You need to configure Azure Backup for VM-App-East and enable operational backup for the blobs in saappprod.

Which two actions should you perform? (Select two.)

  1. Configure a backup policy in RSV-App-East and associate it with VM-App-East.Answer
  2. B
    Configure a backup policy in RSV-App-West and associate it with VM-App-East.
  3. Configure a backup policy in BV-App-East for saappprod, and assign the Storage Account Backup Contributor role to the managed identity of BV-App-East.Answer
  4. D
    Configure a backup policy in BV-App-East for saappprod, and assign the Contributor role on RG-App-East to the managed identity of BV-App-East.

Answer

Configure a backup policy in RSV-App-East for VM-App-East, and configure a backup policy in BV-App-East for saappprod while assigning the Storage Account Backup Contributor role to the managed identity of BV-App-East.
To back up Azure VMs, you must use a Recovery Services Vault in the same region and subscription as the VM. In this scenario, VM-App-East is in East US, so it must be associated with RSV-App-East. For operational backup of blobs, you must use a Backup Vault in the same region, and you must assign the data-plane Storage Account Backup Contributor role to the vault's managed identity on the target storage account (saappprod) so the service has direct read and write access to the blob data.

Step-by-Step Solution

1
Determine the backup vault type and regional requirements for the virtual machine.
VM-App-East is a virtual machine and requires a Recovery Services Vault. The vault must be located in the same region (East US) and subscription (Sub-Production) as the virtual machine. Therefore, RSV-App-East is selected.
Azure VM backup only supports same-region, same-subscription Recovery Services Vaults.
2
Determine the backup vault type and access requirements for Azure Blob backup.
Azure Blob operational backup requires a Backup Vault rather than a Recovery Services Vault. The Backup Vault (BV-App-East) must be selected.
Backup Vaults support Azure Blobs, Azure Disks, and Azure PostgreSQL databases, whereas Recovery Services Vaults do not support Blob operational backups.
3
Configure the necessary data-plane permissions for the Blob backup process.
Assign the Storage Account Backup Contributor role to the system-assigned managed identity of BV-App-East on the storage account saappprod.
Azure Backup needs data-plane level permissions on the storage account. Standard control-plane roles (like Owner or Contributor) assigned at higher scopes do not automatically grant the required data-plane access for the Backup service.

Key Concept

Recovery Services Vaults are used for VM backups and must match the VM's region/subscription, whereas Backup Vaults are used for operational backups of blobs/disks and require direct data-plane role assignments (like Storage Account Backup Contributor) for permission authentication.
Rate this question

Topics

Recovery Services Vaults and Backup Vaults

More questions from this topic