Examkin

Question

Difficulty: MediumAzure Virtual Machine Backup Configuration

An administrator plans to configure Azure Backup for an Azure virtual machine named vm-shipping-prod. The virtual machine has the following configuration:

* Operating System: Red Hat Enterprise Linux 8.6
* Location: West US 2 region
* Disks: Multiple managed disks encrypted at rest using Server-Side Encryption (SSE) with Customer-Managed Keys (CMK)
* Key Vault: kv-shipping-keys (located in the West US 2 region, holds the customer-managed keys)

You need to set up a Recovery Services Vault named rsv-shipping-backup and enable backup for vm-shipping-prod.

Which of the following actions must you perform to successfully configure and run the backup? (Select TWO)

  1. Create the Recovery Services Vault in the West US 2 regionAnswer
  2. Enable a system-assigned managed identity for the Recovery Services Vault and grant it permissions to the Key VaultAnswer
  3. C
    Create the Recovery Services Vault in the West US region and enable Cross-Region Restore
  4. D
    Configure the Key Vault access policy to grant permissions to the Backup Management Service enterprise application

Answer

To successfully configure the backup, you must create the Recovery Services Vault in the West US 2 region and enable a system-assigned managed identity for the Recovery Services Vault, granting it permissions to the Key Vault.
For successful VM backup configuration, the Recovery Services Vault must be in the same region (West US 2) as the VM. Additionally, because the VM utilizes Server-Side Encryption with Customer-Managed Keys, the Recovery Services Vault's system-assigned managed identity must be enabled and granted permissions to the Key Vault containing those keys so that the backup service can read the keys during operations.

Step-by-Step Solution

1
Determine the required region for the Recovery Services Vault.
The Recovery Services Vault must be created in the West US 2 region.
Azure Virtual Machine backups require the vault and the target virtual machine to reside in the exact same Azure region.
2
Determine the encryption mechanism used by the virtual machine.
The disks use Server-Side Encryption (SSE) with Customer-Managed Keys (CMK).
SSE with CMK has different identity and permission requirements compared to Azure Disk Encryption (ADE).
3
Configure vault identity and access permissions for SSE with CMK.
Enable a system-assigned managed identity on the Recovery Services Vault and assign it permissions to access the Key Vault.
Azure Backup uses the Recovery Services Vault's managed identity to access the Customer-Managed Keys in the Key Vault for SSE-encrypted disks.

Key Concept

Azure Virtual Machine backup configuration prerequisites, regional constraints, and encryption configuration requirements.
Rate this question

Topics

Azure Virtual Machine Backup Configuration

More questions from this topic