Microsoft
AZ-104 · Question #519
Case Study 5 - Contoso, Ltd Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing…
The correct answer is Recovery Services vaults: 3; Backup policies: 6. The user must select '3' for Recovery Services vaults and '6' for Backup policies, based on an assumed requirement for regional backup isolation and multiple workload-specific retention policies across three distinct geographical deployments.
Submitted by olafpl· Mar 4, 2026Manage identities and governance
Question
Case Study 5 - Contoso, Ltd Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing Environment Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant. The Azure AD tenant contains the users shown in the following table. Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table. User1 manages the resources in RG1. User4 manages the resources in RG2. Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table No network security groups (NSGs) are associated to the network interfaces or the subnets. Sub1 contains the storage accounts shown in the following table. Requirements Planned Changes Contoso plans to implement the following changes: Create a blob container named container1 and a file share named share1 that will use the Cool storage tier. Create a storage account named storage5 and configure storage replication for the Blob service. Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table. Associate NSG1 to the network interface of VM1. Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table. Associate NSG2 to VNET1/Subnet2. Technical Requirements Contoso must meet the following technical requirements: Create container1 and share1. Use the principle of least privilege. Create an Azure AD security group named Group4. Back up the Azure file shares and virtual machines by using Azure Backup. Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C. Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1. Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1 Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months. Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares. Hotspot Question You need to configure Azure Backup to back up the file shares and virtual machines. What is the minimum number of Recovery Services vaults and backup policies you should create? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:
Exhibit
Answer Area
- Recovery Services vaults312347
- Backup policies6123456
Explanation
The user must select '3' for Recovery Services vaults and '6' for Backup policies, based on an assumed requirement for regional backup isolation and multiple workload-specific retention policies across three distinct geographical deployments.
Approach. The user must interact with the dropdown menu next to 'Recovery Services vaults' and select the option '3'. Subsequently, the user must interact with the dropdown menu next to 'Backup policies' and select the option '6'.
Common mistakes.
- common_mistake. Common mistakes stem from an incomplete understanding of Recovery Services vault scope and backup policy granularity:
- Incorrect number of vaults (e.g., 1 or 2): Selecting '1' vault would be incorrect if Contoso's resources are spread across multiple Azure regions, as a single Recovery Services vault cannot protect resources in different Azure regions. Selecting '2' would imply resources in only two regions, ignoring the third potential region.
- Incorrect number of policies (e.g., 1, 2, or fewer than 6): Selecting a lower number of policies often indicates a failure to account for different workload requirements or the need for regional policy distinctions. For instance, selecting '2' policies might cover two types of workloads but might not satisfy a requirement for separate management or compliance for each region, leading to a global policy that isn't granular enough. Each specific combination of retention and frequency, applied across different logical/geographic groupings of resources, often necessitates its own policy.
- why_other_choices_are_wrong. Any choice other than '3' for Recovery Services vaults would be incorrect if Contoso has resources across three distinct Azure regions requiring regional backup isolation. Any choice other than '6' for Backup policies would be incorrect if the scenario demands multiple granular backup strategies (e.g., based on workload criticality, compliance, or regional management) that, when combined with the number of regions, sum up to 6 unique policies.
Concept tested. The core technical concepts being tested are:
- Azure Backup Architecture: Understanding the components of Azure Backup, specifically Recovery Services vaults and Backup policies.
- Regionality of Recovery Services Vaults: Knowing that Recovery Services vaults are regional resources and typically one vault is deployed per Azure region where resources need protection.
- Backup Policy Design: Ability to design granular backup policies considering factors such as different workload types, RPO/RTO requirements, retention periods, and compliance needs for a multi-region or complex environment.
Topics
#Hybrid Identity#Azure RBAC#Virtual Networking#Azure Storage Accounts
Community Discussion
No community discussion yet for this question.