Examkin

Question

Difficulty: HardAzure Files Backup and Restore

An organization deploys a Premium storage account named sa-ops-share in the West US 2 region. The network routing configuration for sa-ops-share is set to 'Enabled from selected virtual networks and IP addresses'. The storage account contains two file shares:
- share-smb-conf: An SMB file share.
- share-nfs-conf: An NFS file share.

A Recovery Services vault named rsv-ops-backup is deployed in the same region. An administrator named Alex is assigned the built-in Backup Operator role for the resource group containing both resources. Alex needs to configure Azure Backup for the file shares using rsv-ops-backup.

When Alex attempts to configure the backup, the operation fails due to permission errors and network connectivity issues.

Which of the following actions must be performed to ensure that backup can be successfully configured for the supported file shares? (Select two)

  1. Assign Alex the Storage Account Contributor role on the sa-ops-share storage account.Answer
  2. Enable the 'Allow trusted Microsoft services to access this storage account' setting under the firewall configuration of sa-ops-share.Answer
  3. C
    Assign Alex the Storage File Data Privileged Reader role on the sa-ops-share storage account.
  4. D
    Configure a separate backup policy in rsv-ops-backup for the share-nfs-conf file share.

Answer

Assign Alex the Storage Account Contributor role on the sa-ops-share storage account, and enable the 'Allow trusted Microsoft services to access this storage account' setting under the firewall configuration of sa-ops-share.
To successfully configure backup for the SMB file share, the administrator must resolve both the registration permission issue and the network firewall restriction. Assigning the Storage Account Contributor role ensures the administrator has the control plane write access required to register the storage account with the Recovery Services vault. Enabling the 'Allow trusted Microsoft services to access this storage account' setting allows the backup service to bypass the storage firewall and access the file shares.

Step-by-Step Solution

1
Determine protocol supportability for Azure Files backup.
Identify that share-smb-conf (SMB) is supported, whereas share-nfs-conf (NFS) is not supported by Azure Backup.
Azure Files backup using Recovery Services vaults only supports SMB file shares.
2
Analyze control plane RBAC permissions required for configuring backup.
Identify that the Backup Operator role is insufficient because registering a storage account requires write permissions (Microsoft.Storage/storageAccounts/write).
Assigning the Storage Account Contributor role to Alex provides the required permissions to write backup metadata and register the storage account with the vault.
3
Address network connectivity restrictions.
Identify that the vault cannot access the storage account due to the firewall restricting access to selected networks.
Enabling the 'Allow trusted Microsoft services...' bypass allows Azure Backup to communicate with the storage account and access the SMB file share.

Key Concept

Configuring Azure Files Backup requires specific control plane permissions (Storage Account Contributor or Owner) to register the storage account, network firewall bypass configurations for trusted services, and adheres to protocol limitations (only SMB is supported).
Rate this question

Topics

Azure Files Backup and Restore

More questions from this topic