Examkin

Question

Difficulty: Very hardAzure Virtual Machine Recovery and Restore

An administrator manages an Azure virtual machine named VM-AppDb01 that runs Windows Server 2022. The virtual machine has Azure Disk Encryption (ADE) enabled, with keys stored in an Azure Key Vault. VM-AppDb01 is backed up to a Recovery Services vault named Vault01.

Following a database corruption event, you need to restore the entire virtual machine to its last known good state. When navigating to the restore options in Vault01, you must select the appropriate recovery configuration.

Which restore option is supported and must be selected to recover the virtual machine?

  1. A
    Replace existing to swap the current disks of VM-AppDb01 directly with the disks from the restore point.
  2. B
    Create new to deploy a new virtual machine directly from the backup restore point using the Azure portal.
  3. Restore disks to a storage account, and then recreate the virtual machine using a template or PowerShell.Answer
  4. D
    File recovery to mount the recovery point as a virtual drive on another virtual machine and manually copy the system directories.

Answer

Restore disks to a storage account, and then recreate the virtual machine using a template or PowerShell.
For virtual machines encrypted with Azure Disk Encryption (ADE), Azure Backup does not support direct virtual machine recovery options such as creating a new VM or replacing the existing disks directly from the portal. The only supported method is to restore the virtual machine's disks to an Azure storage account. Once the disks are successfully restored, the administrator can recreate the virtual machine using the generated Azure Resource Manager (ARM) template or custom PowerShell scripts, referencing the original key vault and secret URLs.

Step-by-Step Solution

1
Identify the encryption status of the virtual machine.
The virtual machine VM-AppDb01 has Azure Disk Encryption (ADE) enabled.
Encryption status dictates which restore methods are supported by Azure Backup.
2
Determine the supported restore options for Azure Disk Encryption (ADE) encrypted VMs.
Direct VM restore options (Create new VM and Replace existing VM) are disabled/unsupported for ADE-encrypted VMs. The only supported restore option is to restore the VM disks to a storage account.
Azure Backup cannot directly orchestrate the VM recreation for ADE-encrypted VMs due to security configurations and access to Key Vault secrets.
3
Recreate the virtual machine from the restored disks.
Use the deployment templates or PowerShell script generated during the disk restore process to provision the new VM and associate it with the existing encryption keys in the Key Vault.
This completes the full recovery of the encrypted virtual machine.

Key Concept

Azure Virtual Machine recovery options and limitations for encrypted (ADE) VMs
Estimated Time:3m 0s
Rate this question

Topics

Azure Virtual Machine Recovery and Restore

More questions from this topic