Examkin

Question

Difficulty: MediumCreate and Configure Virtual Machines

A company's infrastructure team is preparing to provision a virtual machine named VM-Finance in the East US region. The virtual machine must satisfy the following criteria:
- Provide protection against physical datacenter-wide outages within the region.
- Enable daily backups to be managed automatically via Azure Backup.
- Ensure that authorized administrative users can read files inside the virtual machine's associated storage account blob containers, while preventing users with subscription-level Contributor roles from having direct data-plane read access.

Which deployment configuration should the team implement for VM-Finance?

  1. A
    Deploy VM-Finance to an Availability Set, create a Recovery Services vault in the East US region, and assign the Storage Blob Data Reader role to authorized administrative users for the associated storage account.
  2. B
    Deploy VM-Finance to an Availability Zone, configure backups using an existing Recovery Services vault in the West US region, and assign the Storage Blob Data Reader role to authorized administrative users for the associated storage account.
  3. C
    Deploy VM-Finance to an Availability Zone, create a Recovery Services vault in the East US region, and rely on the subscription-level Contributor role to grant authorized administrative users direct data-plane access to the associated storage account blob containers.
  4. Deploy VM-Finance to an Availability Zone, create a Recovery Services vault in the East US region, and assign the Storage Blob Data Reader role to authorized administrative users for the associated storage account.Answer

Answer

Deploy VM-Finance to an Availability Zone, create a Recovery Services vault in the East US region, and assign the Storage Blob Data Reader role to authorized administrative users for the associated storage account.
Deploying the virtual machine to an Availability Zone protects it against physical datacenter-wide failures by placing the instance in a separate, isolated physical location within the region. Since Recovery Services vaults can only back up resources within the same region, a vault must be deployed in the East US region. Finally, subscription-level roles like Contributor do not automatically grant direct access to blob data; therefore, the Storage Blob Data Reader role must be assigned to grant administrative users access to the storage account's data plane.

Step-by-Step Solution

1
Identify the high availability requirement to protect against physical datacenter-wide outages.
Determine that Availability Zones must be used instead of Availability Sets.
Availability Zones provide separate physical datacenters within a region with independent power, cooling, and networking, whereas Availability Sets only distribute VMs across update and fault domains within a single datacenter.
2
Verify the backup configuration requirement for the virtual machine.
Determine that the Recovery Services vault must reside in the East US region.
Azure Backup restricts VM backup operations to Recovery Services vaults located in the same region as the virtual machine being protected.
3
Determine the correct security role for data-plane access to blob storage.
Identify that the Storage Blob Data Reader role must be assigned to the administrators.
Subscription-level Contributor or Owner roles only manage the control plane (management operations) of the storage account. Accessing actual container data (data plane) requires specific Azure Active Directory (Microsoft Entra ID) roles such as Storage Blob Data Reader.

Key Concept

Azure Virtual Machine creation parameters including Availability Zones, Recovery Services Vault region matching, and storage data-plane access controls.
Estimated Time:1m 30s
Rate this question

Topics

Create and Configure Virtual Machines

More questions from this topic