You have an Azure subscription containing an Azure Virtual Machine named VM1. VM1 runs Windows Server 2025 and has its OS and data disks encrypted using Server-Side Encryption (SSE) with Customer-Managed Keys (CMK). The customer-managed key is stored in an Azure Key Vault named KV1.
You need to configure Azure Backup for VM1 by using a Recovery Services vault named Vault1.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
- 1Enable a system-assigned managed identity for Vault1.
- 2In KV1, assign the Key Vault Crypto Service Encryption User role to the managed identity of Vault1.
- 3Create a backup policy in Vault1.
- 4Enable backup for VM1 and associate it with the backup policy.
Cevap
To configure backup for VM1, you must enable a system-assigned managed identity for Vault1, assign the Key Vault Crypto Service Encryption User role to Vault1's managed identity in KV1, create a backup policy in Vault1, and enable backup for VM1 by associating it with the backup policy.
To back up an Azure Virtual Machine encrypted with Server-Side Encryption using Customer-Managed Keys, the Recovery Services vault must be authorized to access the Key Vault key. You must first enable a system-assigned managed identity for the vault, as the identity must exist before you can assign roles to it. Second, you assign the Key Vault Crypto Service Encryption User role to the vault's managed identity on the Key Vault to grant the necessary wrap/unwrap key permissions. Third, you create the backup policy defining retention and schedule parameters. Finally, you enable backup for the VM and select the policy. This sequence ensures all identity and authorization dependencies are resolved before the backup protection is configured and validated.
Adım Adım Çözüm
Anahtar Kavram
Configuring Azure VM Backup for VMs encrypted with Server-Side Encryption and Customer-Managed Keys.