Examkin

Question

Difficulty: Very hardAzure Files Backup and Restore

You manage an Azure environment that includes a Recovery Services vault named `rsv-prod-eastus` in the East US region. Your department has a Premium storage account named `stfinprod` in the East US region. This storage account hosts two file shares:

1. `sharesmb` - an SMB-based file share.
2. `sharenfs` - an NFS-based file share.

The networking configuration of `stfinprod` has firewalls and virtual networks enabled, with access restricted to selected networks only. An administrator named Admin1 needs to configure Azure Backup for the file shares in `stfinprod` using the existing Recovery Services vault. Currently, Admin1 has only the `Backup Operator` role assigned on `rsv-prod-eastus` and the `Reader` role assigned on `stfinprod`.

You need to ensure that Admin1 can configure the backup successfully while maintaining the firewall restrictions on the storage account.

Which three of the following actions should you perform? (Select three.)

  1. In the firewall settings of `stfinprod`, enable the option to allow trusted Microsoft services to access the storage account.Answer
  2. Assign Admin1 the `Storage Account Contributor` role on `stfinprod` and the `Backup Contributor` role on `rsv-prod-eastus`.Answer
  3. Configure backup only for the `sharesmb` file share, as Azure Backup does not support backups for NFS file shares.Answer
  4. D
    Disable the storage account firewall on `stfinprod`, as Azure Backup cannot bypass firewall rules for Azure Files.
  5. E
    Assign Admin1 the `Storage File Data Privileged Reader` role on `stfinprod` and keep the `Backup Operator` role on `rsv-prod-eastus`.
  6. F
    Configure backup for both `sharesmb` and `sharenfs` since both are hosted on a Premium storage account.

Answer

To configure the backup, you must enable the trusted Microsoft services bypass on the storage account firewall, assign the Storage Account Contributor role on the storage account and the Backup Contributor role on the Recovery Services vault to the administrator, and target only the SMB-based file share since NFS-based file shares are not supported by Azure Backup.
To configure backup for the file share under network and permission constraints, you must configure the storage account's firewall to allow trusted Microsoft services to access it, which permits Azure Backup to orchestrate snapshots. You must also assign management plane roles (Storage Account Contributor on the storage account and Backup Contributor on the vault) to enable the administrator to configure the policy and register the resource. Finally, you can only protect the SMB share, as Azure Backup does not support NFS shares.

Step-by-Step Solution

1
Determine protocol support for Azure Files Backup.
Identify that only the SMB file share can be backed up because Azure Backup does not support NFS file shares.
This establishes which resource is eligible for registration and prevents configuration errors due to protocol incompatibility.
2
Address network restrictions on the storage account.
Configure the storage account firewall to allow trusted Microsoft services.
This allows the Azure Backup service to communicate with the storage account and manage snapshots while keeping the public network access restricted to selected networks.
3
Elevate permissions on the Recovery Services vault.
Assign the Backup Contributor role to the administrator.
The Backup Operator role only permits triggering backups and restores; configuring backup policies and registering storage accounts requires Backup Contributor or Owner permissions.
4
Configure management plane permissions on the storage account.
Assign the Storage Account Contributor role to the administrator.
Registering the storage account with the Recovery Services vault writes registration metadata to the storage account, which requires control plane write permissions.

Key Concept

Azure Files Backup configuration requirements, including protocol limitations, firewall bypass settings, and RBAC control plane requirements.
Rate this question

Topics

Azure Files Backup and Restore

More questions from this topic