Skip to main content

Technical Lab: Create a Recovery Services vault

Questions​

Question 1 — Multiple Choice​

You need to create a Recovery Services vault to protect production virtual machines in the East US region. During creation, you notice that the storage redundancy option can still be changed.

What is the necessary condition for this change to still be allowed?

A) The vault must be empty, with no backup items configured or protected.

B) Redundancy can only be changed if the vault was created less than 24 hours ago.

C) It's necessary to disable soft delete before changing redundancy.

D) Changes are only allowed if the vault is in a region that supports Zone-Redundant Storage (ZRS).

Question 2 — Technical Scenario​

An administrator creates a Recovery Services vault in the West Europe region and configures virtual machine backups. Three weeks later, the team decides to migrate all resources to North Europe and requests that the vault be moved to the new region along with the resources.

What happens when attempting to move the vault to another region?

A) The move is allowed, but all existing recovery points are invalidated.

B) Cross-region movement is not supported for Recovery Services vaults; a new vault must be created in the destination region.

C) The vault can be moved between regions, as long as backup is paused during the process.

D) Movement is only possible via Azure CLI with the az backup vault move command.

Question 3 — True or False​

A Recovery Services vault and the resources it protects must be in the same Azure region for backup to work correctly.

Question 4 — Technical Scenario​

Analyze the command sequence below:

az group create \
  --name rg-backup-prod \
  --location eastus

az backup vault create \
  --name vault-prod-01 \
  --resource-group rg-backup-prod \
  --location westus

An administrator executes these commands successfully, without errors. Then tries to register a VM located in East US for backup in this vault.

What is the expected consequence of this configuration?

A) VM registration fails with an authentication error, as the vault is in another region.

B) Registration is accepted, but backup is never executed due to connectivity limitations between regions.

C) The vault in West US cannot protect a VM in East US; the vault and protected resource must be in the same region.

D) Registration is performed successfully, but recovery points are automatically stored in East US through geo-replication.

Question 5 — Multiple Choice​

When creating a Recovery Services vault, you must choose the storage replication type. Consider the following context:

The company does not have a secondary datacenter and accepts data loss in case of catastrophic regional failure, prioritizing the lowest possible operational cost.

Which replication option is most suitable for this scenario?

A) Geo-Redundant Storage (GRS), as it automatically replicates data to a paired region.

B) Zone-Redundant Storage (ZRS), as it distributes data across availability zones in the same region.

C) Locally Redundant Storage (LRS), as it maintains replicas within a single datacenter without additional replication.

D) Read-Access Geo-Redundant Storage (RA-GRS), as it offers data reading in the secondary region in case of failure.

Answer Key and Explanations​

Answer Key — Question 1​

Answer: A

Storage redundancy for a Recovery Services vault can only be changed while no items are protected or registered in the vault. Once the first backup is configured, this setting is locked, as changing redundancy after data is written would require migration of all existing recovery points, which is not supported.

The central conceptual error in the distractors is associating change permission with time windows (B), security settings like soft delete (C), or regional availability of ZRS (D). None of these factors govern this restriction. The rule is simple and objective: vault without protected data allows changes; vault with protected data does not allow changes.

Answer Key — Question 2​

Answer: B

Recovery Services vaults do not support cross-region movement. Region is an immutable property of the vault after creation. To meet the regional change demand, the correct procedure is to create a new vault in the destination region and reconfigure backups.

The distractors explore common misconceptions: the idea that movement is possible with restrictions (A, C) or that a specific command exists to enable this (D). In practice, Azure allows moving vaults between resource groups and subscriptions within the same region, but never between regions. Confusing resource group mobility with region mobility is a frequent error.

Answer Key — Question 3​

Answer: True

The Recovery Services vault and the resources it protects, such as VMs, must be in the same Azure region. This is a service design restriction: the vault operates locally to the region to ensure controlled latency in backup data transfer and compliance with data residency requirements.

This statement is frequently underestimated because Azure allows creating vaults in any region independently, which may lead to the belief that the combination is free. In practice, when trying to register a resource from another region, the portal simply won't display the vault as a valid option.

Answer Key — Question 4​

Answer: C

The vault was created in West US while the VM is in East US. This combination is invalid: the Recovery Services vault can only protect resources that are in the same region. Registration of a VM in a different region is not allowed by the platform.

Alternative B is the most dangerous distractor, as it suggests that registration occurs but backup fails silently, which does not reflect actual behavior. The system prevents registration from the start. Alternative D introduces the concept of automatic geo-replication of recovery points, which doesn't exist in this context and confuses storage replication with resource portability.

Answer Key — Question 5​

Answer: C

The scenario describes two objective criteria: absence of regional recovery requirement and priority for lowest cost. LRS is the lowest cost option, maintaining three synchronous replicas within a single datacenter in the same region, without replication to additional zones or regions.

GRS (A) and RA-GRS (D) replicate data to a paired region, which would be superfluous given that the company accepts loss in regional failure. ZRS (B) distributes across availability zones, offering more resilience than LRS, but at a higher cost and without meeting the absolute lowest cost criterion. Choosing GRS as the vault default leads many administrators to forget that LRS is a valid and more economical option when the business context justifies it.