Microsoft AZ-104 Exam Dumps, Practice Test Questions

Support for a Recovery Services vault move depends on specific prerequisites and protected workloads. A generic Move click without validating them can fail or interrupt the intended protection design.

The vault is a separately managed resource with its own move requirements. Changing a protected VM resource-group association does not implicitly migrate the vault.

Backup policies describe schedules and retention; exporting a policy does not move historical vault recovery points or satisfy resource-move requirements. Check the supported vault/workload conditions first.

Stopping future backups affects protection scheduling but does not make already retained recovery points immutable or prevent a privileged operator from changing vault settings. It can also leave the business without new recovery points, which is a serious operational regression. The security decision concerns the vault’s immutability state, not halting backups.

Azure Backup soft delete provides a recovery grace period for deleted backup data, but it is not the irreversible WORM-style retention protection of a locked immutable vault. A privileged attacker can exploit other administrative controls after the soft-delete window. The compliance requirement is that the enabled immutable-vault state itself be locked so it cannot later be disabled.

A resource-group ReadOnly lock is an Azure Resource Manager management guard that can block certain control-plane writes, but it is not the Backup vault immutability setting. It does not supply the same retention-protection semantics or irreversible WORM state. Treating a removable ARM lock as equivalent would misrepresent the security guarantee being requested.

Resource-group movement does not convert a snapshot-tier recovery point into a vault-tier point. It does not satisfy the cross-zonal recovery requirement.

Replacing disks in the protected VM does not create the desired separate zone-targeted workload. It risks overwriting current production instead of demonstrating recovery in another zone.

NSG filtering controls packets and does not determine Azure Backup recovery-point tier eligibility for cross-zonal restoration. The missing capability is in backup storage and restore configuration.

Recovery Services vaults are used for standard Azure VM backup, but they do not replace the Backup vault requirement of Azure Disk Backup in the stated disk-only workflow.

A single snapshot may preserve one data state, but it is not the centrally managed Azure Disk Backup policy, protection instance and vault workflow specified in the scenario.

Whole-VM protection requires a VM backup policy and is distinct from disk-only Azure Disk Backup. A recovery vault with no configured protected VM will not meet the disk-specific need.

Azure Disk Backup is an agentless crash-consistent disk snapshot solution, not an automatic VSS-coordinated application-consistent VM recovery system. Database transactions spanning disks may need workload-aware consistency.

Increasing disk capacity stores more data but does not preserve earlier application state, create scheduled recovery points, or provide a file recovery workflow.

Disk-level snapshots without supported guest/database coordination don't automatically provide application-consistent multi-disk recovery or the VM-level file restore workflow. Use supported Azure VM Backup and application-consistent protection in a Recovery Services vault.

A general management Reader assignment doesn't supply Azure Disk Backup's required data-action permissions on the source disk or snapshot-write permissions at the snapshot resource group. Grant Disk Backup Reader and Disk Snapshot Contributor at their documented scopes to the backup vault identity.

Disk Backup Reader on the source disk supports reading disk metadata and required disk access, but it does not grant snapshot write/delete operations in the snapshot resource group. Azure Disk Backup also needs Disk Snapshot Contributor at that snapshot scope for the vault managed identity, so this incomplete assignment leaves backup jobs failing.

Snapshot operations are performed by the Backup vault managed identity, not by whichever operator initiated or inspected the policy. Granting the contributor role to a human account leaves the vault identity unauthorized. The required Disk Backup Reader and Disk Snapshot Contributor assignments must be made to that managed identity at their proper scopes.

Operational backup uses recovery features within the source storage account. Increasing local retention does not create independent offsite backup data.

Blob index tags classify data and can help filtering. They do not preserve an isolated recoverable copy when the original account is lost.

Alerts can detect control-plane activity but do not retain a recovery point containing Blob payloads. Detection alone is not offsite data protection.

Restoring directly into the source account is associated with operational point-in-time recovery; vaulted Blob restore currently has a distinct target-account restriction.

Operational Blob point-in-time restore is a separate backup mode that restores data within the same account using the operational recovery window. It cannot be used as an in-place target-selection shortcut for a vaulted Backup vault recovery point. For the vaulted restore described, the destination must be a separate eligible storage account.

A different target account is required, but that is not sufficient when its existing container names conflict with those in the selected vaulted recovery point. Azure Backup documents that a container-name conflict causes the restore to fail; it does not automatically merge or overwrite those containers. Use a separate eligible target without conflicting container names.

The Backup vault’s GRS setting applies to supported vault-tier backup data, not the operational incremental snapshots managed by Azure Disk Backup in the snapshot resource group. Selecting GRS does not migrate those snapshots into the vault storage tier.

Cross Region Restore eligibility for supported vault backups is not a feature that geo-replicates Azure Disk Backup operational snapshots. Disk snapshots in the subscription remain in their source region; a disk backup policy cannot become paired-region protection solely by enabling a vault restore setting.

Azure Disk Backup incremental snapshots remain in the supported source-disk region; moving a resource group container does not relocate managed disk snapshot blocks to another region. Cross-region backup requires a separate supported protection architecture, not a resource-group move.

Ephemeral OS storage has different lifecycle and protection capabilities; conversion would not create an unlimited backup history. The problem is the finite disk snapshot retention limit.

Reader is a management-plane visibility role and does not raise Azure's managed-disk incremental snapshot limits. Even with correct vault permissions, retention remains constrained by supported disk backup policy limits.

More frequent incremental snapshots consume the supported recovery-point count faster and don't bypass Azure Disk Backup retention or managed-disk snapshot constraints. Rework retention and backup strategy within supported limits.

Disabling source lifecycle rules removes the mechanism that was managing local blob versions. The vaulted backup policy does not automatically replace version-level retention controls on the source service.

Soft delete is a source-account data protection capability, not a setting that rewrites Vault-level recovery-point retention or cleans up historical source versions.

Increasing vault retention affects how long stored backup recovery points remain, not the expiration rules for versions in the source account. It cannot perform the requested source cleanup.