Path 3 · Module 2
Design a solution for backup and disaster recovery
Read the module on Microsoft Learn, then come back here: test yourself with the quiz and apply it in the design exercise. Write down what you want to remember with the ✎ Note buttons.
Step 1 · Read the module
Open Design a solution for backup and disaster recovery on Microsoft Learn. The units:
- Introduction
- Design for backup and recovery
- Design for Azure Backup
- Design for Azure blob backup and recovery
- Design for Azure files backup and recovery
- Design for Azure virtual machine backup and recovery
- Design for Azure SQL backup and recovery
- Design for Azure Site Recovery
- Module assessment
- Summary and resources
Close the Learn tab. Answering from memory is what makes it stick; looking it up just measures how fast you can scroll.
Quiz
20 exam-style questions, roughly in the order of the units. Click an answer to see the explanation. Your best score is saved and shown on the path page; use Retry at the end to go again.
1. What's the first step in designing a backup and recovery solution?
D. Requirements drive every later choice: frequency, retention, redundancy and tooling.
2. Which vault type backs up Azure VMs, SQL Server in VMs and Azure Files?
C. Recovery Services vaults handle VMs, SQL/SAP HANA in VMs, Azure Files and MARS agent backups.
3. Which vault type is used for Azure Blob backup, Azure Disk backup and PostgreSQL?
C. Backup vaults host the newer datasources: blobs, managed disks, Database for PostgreSQL, AKS.
4. Ransomware could delete backups. Which features protect backup data?
A. Soft delete keeps deleted backups recoverable, immutability blocks deletion, MUA needs a second approver.
5. Backups must be restorable in another region if the primary region is lost. Which vault setting?
B. GRS replicates backup data to the paired region; Cross Region Restore lets you restore there at any time.
6. Accidentally deleted or overwritten blobs must be recoverable to any point in the last 14 days, within the same account. What do you enable?
C. Operational backup is local, continuous protection within the storage account.
7. Blob data must be protected from deletion of the whole storage account. Which blob backup type?
B. Operational backup lives in the source account; vaulted backup keeps copies outside it.
8. How does Azure Backup protect Azure file shares?
B. Snapshot-based backup is the default; vaulted backup adds offsite copies.
9. A user deleted one file from an Azure file share. What's the fastest restore?
C. Azure Backup supports item-level restore of files and folders from snapshots.
10. Which is true for Azure VM backup?
B. The VM backup extension coordinates snapshots; file-level recovery is supported.
11. Restores must be very fast because the VM backup snapshot is kept locally for a few days. What's this feature called?
C. Instant restore keeps snapshots (1–5 days by default) for quick recovery before data reaches the vault.
12. A VM backup policy must take backups every 4 hours. Which policy type?
C. Enhanced policies support hourly schedules (every 4 hours etc.) and Trusted Launch VMs.
13. How long are Azure SQL Database automated point-in-time restore backups kept by default?
A. PITR retention defaults to 7 days. Long-term retention covers weekly/monthly/yearly backups up to 10 years.
14. Monthly SQL Database backups must be kept for 7 years. What do you configure?
C. LTR keeps full backups for up to 10 years.
15. SQL Server databases in Azure VMs must be backed up with 15-minute log backups and no backup infrastructure to manage. Which option?
A. Azure Backup's SQL workload backup supports full, differential and log backups (every 15 minutes) from a Recovery Services vault.
16. What's the difference between Azure Backup and Azure Site Recovery?
B. Backup is about data protection and retention; Site Recovery is about business continuity with low RTO.
17. Which Site Recovery feature lets you fail over a multi-tier app in the right order with scripts in between?
B. Recovery plans group VMs, order them and run automation runbooks or manual steps.
18. How do you prove a Site Recovery DR plan works without affecting production?
C. Test failover creates VMs in an isolated VNet while replication continues.
19. Which workloads can Azure Site Recovery replicate to Azure?
A. Site Recovery covers Azure-to-Azure and on-premises-to-Azure replication.
20. What does the app-consistent recovery point frequency in a Site Recovery replication policy affect?
A. Crash-consistent points are frequent; app-consistent points capture application state at the configured interval.
Design exercise
On paper · about 25 minutes
Cobalt Engineering runs in West Europe:
- 20 Windows VMs running a three-tier ERP (web, app, SQL Server on a VM). RTO 2 h, RPO 15 min for a region loss.
- An Azure file share with project documents; users often delete files by mistake.
- A storage account with CAD drawings in blobs; must survive accidental deletion of the account.
- An Azure SQL Database for timesheets; auditors need monthly backups for 5 years.
- The security officer worries about ransomware deleting backups.
-
Task
Choose vaults and backup types
For each data source: which vault (or built-in feature) and which backup type?
Done when- Every source is covered.
- Vault types are correct for each datasource.
Model answer
- VMs + SQL in VM: Recovery Services vault (VM backup + SQL workload backup).
- File share: Recovery Services vault, snapshot backup.
- Blobs: Backup vault, operational + vaulted backup.
- SQL Database: built-in PITR + LTR monthly for 5 years.
-
Task
Design the DR for the ERP
How do you meet RTO 2 h / RPO 15 min for a region loss?
Done when- Replication target and tool are named.
- Failover order is defined.
- Testing is planned.
Model answer
Azure Site Recovery to North Europe; recovery plan: SQL group → app group → web group, with a runbook for DNS/load balancer updates; test failover each quarter into an isolated VNet. (Alternative for SQL: AG async replica in North Europe.)
-
Task
Harden the backups
List the settings that protect backups from deletion and regional loss.
Done when- At least three protective settings.
- Cross-region restore is possible.
Model answer
Soft delete (always-on), immutable vault (locked), multi-user authorization via Resource Guard in another subscription, GRS with Cross Region Restore, backup alerts to the security team, RBAC with Backup Operator instead of Contributor.