AZ-104 Question 267
Single answerYou are an Azure Administrator for Contoso, Inc. They have a critical line-of-business application running on an Azure Virtual Machine. To meet regulatory requirements, you must store daily backups of the VM for 30 days and keep them in an offsite location. You also need to ensure that the backups are encrypted at rest and in transit. Which configuration should you implement to meet these requirements?
- A
Configure an Azure Recovery Services vault with Locally Redundant Storage (LRS).
- B
Configure an Azure Recovery Services vault with Geo-Redundant Storage (GRS).
- C
Enable Cross-Region Restore on your existing LRS-based Recovery Services vault.
- D
Enable encryption at the disk level for the VM's managed disks.
Show answer and explanation
Correct answer: B
Explanation
Geo-Redundant Storage in the Recovery Services vault creates a secondary backup copy in a different region, meeting the offsite requirement. Combined with Azure Backup’s built-in encryption, this setup ensures backups remain encrypted at rest and in transit while fulfilling the regulatory need for 30-day retention in a separate location.
- A. Incorrect.
LRS replicates data only within a single data center. This does not meet the requirement of having an offsite copy of your backups, so data is not protected if there is a regional outage.
- B. Correct.
GRS replicates the data to a secondary geographically distant data center, ensuring an offsite copy. Azure Backup also provides built-in encryption for data both at rest and in transit.
- C. Incorrect.
While Cross-Region Restore allows you to restore in a different region, it does not automatically store your backups offsite for 30 days unless GRS is enabled. Cross-Region Restore alone is insufficient for maintaining compliance.
- D. Incorrect.
Enabling encryption for the VM's managed disks ensures disk data at rest is encrypted, but it does not enable offsite backup storage nor address the 30-day retention requirement.