Examkin

Soru

Zorluk: OrtaAzure Virtual Machine Backup Configuration

You configure a backup solution for an Azure virtual machine named vm-hr-prod with the following parameters:
- Operating system: Windows Server 2022
- Region: East US
- Disk type: Premium SSD
- Encryption: Azure Disk Encryption (ADE) with keys stored in a key vault named kv-hr-prod in the East US region

The key vault kv-hr-prod has its firewall configured to restrict access to 'Selected networks' only.

You deploy a Recovery Services vault named rsv-hr-prod in the East US region. When you attempt to enable backup for vm-hr-prod, the initial validation fails due to key vault access restrictions.

You need to ensure that vm-hr-prod can be successfully backed up while maintaining the key vault's firewall restrictions.

What should you do?

  1. A
    Enable a system-assigned managed identity on vm-hr-prod and assign it the Backup Contributor role at the subscription scope.
  2. B
    Recreate the Recovery Services vault rsv-hr-prod in the West US region and link it to the virtual machine.
  3. Configure the network security settings of the key vault kv-hr-prod to allow trusted Microsoft services to bypass the firewall.Cevap
  4. D
    Add the public IP addresses of the Recovery Services vault to the firewall whitelist of the key vault kv-hr-prod.

Cevap

Configure the network security settings of the key vault to allow trusted Microsoft services to bypass the firewall.
When backing up an Azure virtual machine encrypted with Azure Disk Encryption (ADE), the Recovery Services vault must be able to access the encryption keys stored in the key vault. If the key vault has a firewall enabled that restricts access to selected networks, the Azure Backup service will be blocked from accessing the keys. Allowing trusted Microsoft services to bypass the key vault's firewall resolves this blocker, enabling the Recovery Services vault to retrieve the keys and complete the backup.

Adım Adım Çözüm

1
Verify that the Recovery Services vault and the virtual machine reside in the same region.
Both the vault and the virtual machine are in the East US region, which is the required configuration.
Azure VM Backup requires the vault and the target VM to be in the same geographic region.
2
Identify the blocker preventing the backup of the Azure Disk Encryption (ADE) encrypted virtual machine.
The key vault storing the encryption keys has a firewall enabled, preventing the Azure Backup service from reading the keys.
To backup ADE-encrypted VMs, the Recovery Services vault must retrieve keys from the key vault.
3
Enable the trusted Microsoft services bypass on the key vault firewall settings.
The Recovery Services vault can bypass the firewall and retrieve the keys needed to perform the backup.
Enabling this bypass allows Azure Backup to access the key vault securely without disabling the firewall.

Anahtar Kavram

Configuring backups for Azure Disk Encryption (ADE) virtual machines with key vault firewalls.
Bu soruyu puanla

Konular

Azure Virtual Machine Backup Configuration

Bu konudan daha fazla soru