Examkin

Question

Difficulty: HardAzure Files Backup and Restore

You have an Azure subscription that contains a Recovery Services vault named `rsv-finance-backup` and a Premium storage account named `sa-finance-prod` in the West US 2 region. The storage account hosts two file shares: `share-smb-data` (an SMB file share) and `share-nfs-repos` (an NFS file share).

The firewall of `sa-finance-prod` is configured to allow access only from selected virtual networks and IP addresses.

You need to enable Azure Backup for the file shares in `sa-finance-prod` using `rsv-finance-backup`. The configuration must adhere to the principle of least privilege.

An administrator named Admin1 is assigned the Backup Operator role for `rsv-finance-backup`.

Which configuration steps should you perform to ensure Admin1 can successfully configure the backup?

  1. Configure the firewall of `sa-finance-prod` to allow trusted Microsoft services to access the storage account, assign Admin1 the Contributor role on `sa-finance-prod`, and configure backup for only `share-smb-data`.Answer
  2. B
    Configure the firewall of `sa-finance-prod` to allow trusted Microsoft services to access the storage account, assign Admin1 the Storage Blob Data Contributor role on `sa-finance-prod`, and configure backup for both `share-smb-data` and `share-nfs-repos`.
  3. C
    Add the outbound IP addresses of `rsv-finance-backup` to the firewall of `sa-finance-prod`, assign Admin1 the Owner role on `sa-finance-prod`, and configure backup for both `share-smb-data` and `share-nfs-repos`.
  4. D
    Configure the firewall of `sa-finance-prod` to allow trusted Microsoft services to access the storage account, assign Admin1 the Backup Operator role on `sa-finance-prod`, and configure backup for only `share-smb-data`.

Answer

Configure the firewall of the storage account to allow trusted Microsoft services, assign the administrator the Contributor role on the storage account, and configure backup for only the SMB file share.
To configure backups for an Azure file share when the storage account firewall is enabled, the administrator must enable the 'Allow trusted Microsoft services to access this storage account' bypass. In addition, the administrator needs control-plane write access (such as the Contributor role) on the storage account to perform the registration. Furthermore, Azure Backup only supports the SMB protocol, meaning only the SMB file share can be backed up.

Step-by-Step Solution

1
Evaluate the file share protocol support for Azure Backup.
Only the SMB file share can be backed up using the Recovery Services Vault. The NFS file share is unsupported.
Azure Backup for Azure Files currently only supports the SMB protocol; NFS file shares cannot be registered or backed up.
2
Configure the storage account firewall settings to allow vault access.
Enable the 'Allow trusted Microsoft services to access this storage account' bypass option on the storage account firewall.
Since the storage account is restricted to selected networks, the Recovery Services Vault needs this exception enabled to access the storage account.
3
Assign the necessary Azure RBAC role to the administrator configuring the backup.
Assign the administrator the Contributor role (or Owner) on the storage account.
Although the administrator has the Backup Operator role on the vault, registering a storage account with the vault requires control-plane write permissions on the storage account itself.

Key Concept

Azure Files Backup prerequisites, including network firewall exceptions, RBAC permissions for storage registration, and protocol limitations.
Rate this question

Topics

Azure Files Backup and Restore

More questions from this topic