AZ-104 Azure Backup Questions Explained

Azure Backup questions on the AZ-104 exam cover the vault types, what each can protect, backup policies, retention rules, and the soft delete feature. These questions often hinge on small but important distinctions.

The Two Vault Types

Recovery Services vault — The original Azure Backup vault. Protects:

• Azure VMs
• Azure Files shares
• SQL Server in Azure VMs
• SAP HANA in Azure VMs
• On-premises workloads (via MARS agent or MABS)

Backup vault — A newer vault type. Protects:

• Azure Blobs (operational backup)
• Azure Disks
• Azure Database for PostgreSQL

Exam trap: Azure VM backups go to a Recovery Services vault, not a Backup vault. The Backup vault is for the newer, disk-level and blob-level backup scenarios.

Backup Policy

A backup policy defines:

• Backup frequency — Daily, weekly
• Backup time — When the backup runs
• Retention range — How long to keep daily, weekly, monthly, and yearly recovery points

You assign a backup policy to a vault and then associate protected items (VMs) with that policy. All VMs sharing a policy use the same schedule and retention settings.

If you need different retention periods for different VMs (production = 90 days, development = 7 days), create separate policies.

Backup vs Snapshot

Azure VM backup creates a snapshot of each VM's disks and stores it in the Recovery Services vault. There are two snapshot tiers:

• Snapshot tier — Instant recovery point stored locally. Faster recovery, shorter retention.
• Vault tier — Transferred to the vault for longer retention and off-site protection.

The exam asks about instant restore — recovering from a snapshot without waiting for data to be transferred from the vault. This is faster than vault-tier recovery.

Soft Delete

Soft delete protects backup data from accidental or malicious deletion:

• When a backup item is deleted, the data is retained for 14 additional days in a "soft deleted" state
• Soft deleted data can be undeleted (restored to active state) within those 14 days
• After 14 days, data is permanently deleted
• Soft delete is enabled by default on Recovery Services vaults

Exam scenario: "An administrator accidentally deleted a VM backup. How can the backup be recovered?"

If soft delete is enabled (the default), the backup data is still available for 14 days. The administrator can undelete the backup item from the vault.

RPO and RTO

• RPO (Recovery Point Objective) — How much data loss is acceptable? If backups run daily, the maximum RPO is 24 hours.
• RTO (Recovery Time Objective) — How quickly must systems be restored? Snapshot-based instant restore has a lower RTO than vault-tier recovery.

Exam questions sometimes ask which backup frequency achieves a certain RPO. If RPO = 4 hours, daily backup is not sufficient — you need more frequent backups or a different solution like Azure Site Recovery for continuous replication.

Azure Site Recovery vs Azure Backup

Exam trap: if a question asks about recovering a VM if the entire Azure region fails, the answer is Azure Site Recovery (replicate to another region), not Azure Backup (which stores the vault in the same region by default — use GRS storage to protect the vault itself).

Practice AZ-104 backup and recovery questions to build confidence with vault types and recovery scenarios.

Recovery Services Vault vs Backup Vault — The New Split

Microsoft has been gradually splitting backup workloads across two vault types, and the exam now expects you to know which workload belongs where.

Recovery Services Vault (RSV) — The original backup vault. Handles: Azure VMs, SQL Server in Azure VMs, Azure Files, SAP HANA in Azure VMs, on-premises workloads via MARS agent or Azure Backup Server. This is what most AZ-104 questions are about. When a question doesn't specify workload type, assume RSV.

Backup Vault — Newer resource type introduced for: Azure Kubernetes Service (AKS), Azure Database for PostgreSQL, Azure Blobs (operational backup), Azure Disks. Backup Vault uses a different API and different backup policies. It does not support VM backups.

The exam trap: "A company needs to back up their AKS cluster. What type of vault should they create?" → Backup Vault, not Recovery Services Vault. Most candidates choose RSV because it's what they've studied, but AKS backup requires a Backup Vault.

For AZ-104 exam purposes, RSV is the primary focus. Know that Backup Vault exists and is used for newer workloads, but deep configuration knowledge of Backup Vault is not heavily tested yet.

Backup Policy Configuration — RPO and Retention Numbers

Backup policies define when backups happen and how long data is retained. The default VM backup policy creates one daily backup at 1:00 AM UTC and retains recovery points for 30 days.

Custom policies let you configure:

• Daily backups — up to 9,999 days (approximately 27 years) retention
• Weekly backups — up to 5,163 weeks retention
• Monthly backups — up to 1,188 months retention
• Yearly backups — up to 99 years retention

The exam sometimes asks: "A company requires backups to be retained for 7 years for compliance purposes. Is this possible with Azure Backup?" Yes — configure a yearly backup policy with 7-year retention. Azure Backup supports up to 99 years, which covers any compliance requirement you'll see in an exam scenario.

RPO (Recovery Point Objective) with daily backups is 24 hours — if a failure occurs just before the next scheduled backup, you could lose up to 24 hours of data. For lower RPO, SQL Server in Azure VMs supports log backups every 15–60 minutes alongside daily full backups.

Portal path: Recovery Services Vault → Backup policies → Add policy → Azure Virtual Machine → configure schedule and retention.

Soft Delete — The Accidental Deletion Protection

Soft delete for Azure Backup prevents permanent data loss when backup data is deleted — intentionally or accidentally.

When soft delete is enabled and someone deletes backup data (stops backup and deletes data, or deletes the entire backup item), the data isn't immediately removed. It enters a soft-deleted state and is retained for 14 additional days at no extra storage cost (though after the free period, standard backup storage costs apply).

During those 14 days, you can either:

• Undelete — restore the backup item to its previous protected state
• Delete permanently — confirm you want permanent removal (irreversible)

Soft delete has been enabled by default for new RSVs since 2020. Disabling it requires explicitly toggling it off in vault security settings — which the exam tests as: "What must be done before a backup administrator can permanently delete backup data from a vault?" → Disable soft delete first.

Portal path: Recovery Services Vault → Properties → Security settings → Soft delete → Disable.

Cross-Region Restore — The DR Scenario Option

By default, Azure VM backups are restored within the same region. Cross-Region Restore (CRR) lets you restore a VM backup into a different Azure region — specifically the vault's paired secondary region.

Requirements:

• The RSV must use GRS or RA-GRS replication. LRS and ZRS vaults don't replicate to a secondary region and cannot use CRR.
• CRR must be explicitly enabled on the vault (it's disabled by default even with GRS).
• There's a replication lag — recovery points in the secondary region may be up to 12 hours behind the primary.

Portal path: Recovery Services Vault → Properties → Cross Region Restore → Enable.

To restore to secondary region: Backup items → [VM] → Restore VM → Secondary region.

The exam scenario: "A company requires the ability to restore their Azure VMs in a secondary Azure region in the event the primary region becomes unavailable. What must be configured?" → Enable Cross-Region Restore on a GRS-replicated Recovery Services Vault.

Backup Center — The Centralized Management Option

Backup Center is a unified management interface that provides a single pane of glass across all vaults, subscriptions, and resource groups in your tenant.

From Backup Center you can:

• View backup health and job status across all workloads
• Create and assign backup policies across multiple vaults
• Configure alerts at scale
• Generate compliance reports showing which resources are protected and which aren't

The key exam point: Backup Center itself is not a new type of vault or storage — it's a management overlay. Vaults still hold the backup data. Backup Center just aggregates the view.

Portal path: Search "Backup center" → Overview dashboard shows all protected items, jobs, alerts across tenant.

Exam pattern: "A company has 10 subscriptions with Azure VMs spread across multiple regions. A backup administrator needs to manage all backup policies and monitor backup health from a single interface." → Backup Center.

Azure Site Recovery vs Azure Backup — The Distinction

Both services use Recovery Services Vault, which confuses candidates into treating them as interchangeable.

Azure Backup — Point-in-time data protection. Takes scheduled snapshots or backups. Used to recover from data loss, accidental deletion, corruption. RTO measured in hours (time to restore a VM from backup). Example use cases: "Recover a file that was deleted 3 days ago," "Restore a VM to yesterday's state after a ransomware attack."

Azure Site Recovery (ASR) — Disaster recovery orchestration. Continuously replicates VMs to a secondary region. On failover, VMs come online in the secondary region with minimal data loss. RTO measured in minutes. RPO measured in seconds to minutes. Example use cases: "If the East US region fails, fail over to West US and continue operating," "Meet a 15-minute RTO SLA for production workloads."

The two services complement each other: Backup protects data, Site Recovery protects availability.

Exam pattern clues:

• "Recover accidentally deleted data" → Backup
• "Business continuity during a regional outage" → Site Recovery
• "RTO of 15 minutes" → Site Recovery (Backup RTO is hours)
• "Restore a VM to a specific point in time" → Backup
• "Fail over to secondary region" → Site Recovery

Practice Question Sets