1. Backup Architecture

  • Recovery Services Vault — stores backups for VMs, SQL, Files, SAP HANA; supports GRS with CRR.
  • Backup Vault — newer resource for Blobs, Disks, AKS, PostgreSQL; simpler model, vault-tier only.
  • MARS Agent — installs on Windows for file/folder backup direct to vault (no VM extension needed).
  • Storage redundancy: LRS (3 copies, single DC), ZRS (3 zones), GRS (paired region) — choose before first backup.

2. Cross-Region Restore (CRR)

  • Requires GRS redundancy on the Recovery Services Vault — data replicates asynchronously to the paired region.
  • RPO impact: secondary region data lags up to 12 hours behind primary (Azure Storage GRS replication lag).
  • RTO lever: if primary region is down, restore from secondary without waiting for Microsoft to declare a disaster.
  • CRR is opt-in (Vault → Properties → Cross Region Restore → Enable).
  • Supported for Azure VMs and SQL in Azure VMs; not yet for all workload types.
  • Cost: GRS storage pricing applies; no extra CRR fee except egress during restore.

3. Backup Policy Design

  • Daily — operational recovery; retain 7–30 days.
  • Weekly — short-term compliance; retain 4–12 weeks.
  • Monthly — regulatory checkpoints; retain 12–60 months.
  • Yearly — long-term legal hold; retain 1–10+ years.
  • Tiering: move older recovery points from snapshot tier → standard tier → archive tier to reduce cost.
  • Archive tier — 99.999% durability, low cost, but rehydration takes up to 15 hours (impacts RTO).
  • Map tiers to compliance: PCI-DSS (1 yr), HIPAA (6 yr), financial regulations (7 yr+).

4. Ransomware Protection

Soft Delete
Deleted backup data retained 14 additional days; can be undeleted
Enabled by default (14 days)
Recover from accidental or malicious deletion
Immutable Vault
WORM policy — prevents deletion, shortening retention, or disabling security
Opt-in; irreversible once locked
Compliance guarantee; no admin can purge backups
Multi-User Authorization (MUA)
Critical operations require approval from a second identity (Resource Guard)
Opt-in; uses Azure Resource Guard
Prevents single compromised admin from destroying backups
  • Enhanced Soft Delete — extend to 180 days; make it "always-on" (cannot be disabled).
  • Resource Guard — a separate resource in a different subscription/tenant; owner must approve destructive ops.
  • Combine all three for defense-in-depth: Soft Delete + Immutable + MUA.

5. Supported Workloads

  • Azure VMs — agentless snapshot; application-consistent (VSS on Windows, pre/post scripts on Linux).
  • SQL Server in VM — stream-based, log backup every 15 min, RPO ≤ 15 min.
  • Azure Files — share snapshot-based; instant restore.
  • Azure Blobs — operational & vaulted backup; point-in-time restore up to 365 days.
  • AKS — via Backup Vault; backs up cluster state + persistent volumes (CSI).
  • SAP HANA — Backint-certified; full, differential, and log backups.

💼 Real-World Scenario

A regulated investment bank requires 7-year backup retention with tamper-proof guarantees and regional disaster recovery. The architect configures a GRS Recovery Services Vault with CRR enabled for all Azure VMs and SQL workloads. Backup policies use daily (30-day), monthly (84-month), and yearly (7-year, archive tier) retention. The vault is marked immutable with the lock applied, Soft Delete is set to always-on at 180 days, and MUA is enabled via a Resource Guard in a separate security subscription. Compliance teams receive monthly reports proving no recovery points were modified or deleted — satisfying SEC 17a-4 and MiFID II obligations.

🎯 Exam Tip

AZ-305 loves asking about RTO/RPO trade-offs. Remember: CRR gives you cross-region RTO improvement but secondary data can lag up to 12 hours (RPO). Archive tier saves cost on long retention but rehydration adds hours to RTO. For ransomware questions, the answer is almost always "enable Soft Delete + immutable vault + MUA" as a combined solution.

🧪 Knowledge Check