What You Need Before Using Azure Backup File-Level Recovery
A user deleted a file from an Azure VM, and the administrator wants to use Azure Backup file-level recovery rather than restore the whole VM. Which two prerequisites are required before mounting the recovery point from the portal? Select two.
Quick Answer
The answer is vault credentials and selecting the appropriate recovery point. Vault credentials are required to authenticate the portal session to the Recovery Services vault, ensuring secure access when mounting the iSCSI target on the VM for file-level recovery. Selecting the correct recovery point is equally essential because the portal uses that specific snapshot to create the iSCSI target, allowing you to browse and restore individual files without restoring the entire VM. On the AZ-104 exam, this scenario tests your understanding of Azure Backup’s granular restore capabilities, often appearing as a distractor where candidates mistakenly think you need to install an agent or stop the VM first. A common trap is assuming file-level recovery requires the VM to be deallocated, but it actually works on running VMs. Remember the mnemonic “Vault and View” — you need the vault credentials to authenticate and the view (recovery point) to mount.
⚠ Common exam trap
Many exam-takers confuse file-level recovery with restoring a VM from a storage account snapshot, leading them to think a storage account key is needed, when in fact the iSCSI mount uses vault credentials and the Backup service's managed identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Download the vault credentials file
Vault credentials are required to authenticate the portal session to the Recovery Services vault when performing file-level recovery. Option B is correct because you must select a specific recovery point (snapshot) from which to mount the files; the portal uses this point to create an iSCSI target on the VM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Download the vault credentials file
Why this is correct
Vault credentials authenticate the temporary mount process used for file-level recovery.
- ✓
Select the appropriate recovery point
Why this is correct
A recovery point provides the backup snapshot from which the file can be restored.
- ✗
Provide the storage account access key
Why it's wrong here
Storage account keys are unrelated to Azure VM backup file recovery workflows.
When this WOULD be correct
When restoring a VM backup to a new VM using Azure Backup, you may need to provide the storage account access key if you are using PowerShell or CLI to restore disks to a storage account, or when configuring backup for a VM that uses unmanaged disks.
- ✗
Assign a public IP address to the VM
Why it's wrong here
File recovery mounts backup data through the portal workflow, not through public VM connectivity.
When this WOULD be correct
This would be correct in a question about enabling RDP or SSH access to a VM that is not reachable from the internet, or when configuring a load balancer to route traffic to a VM.
- ✗
Create an Azure AD application secret
Why it's wrong here
Application secrets are not part of the standard Azure Backup file-level recovery process.
When this WOULD be correct
An Azure AD application secret would be required when configuring Azure Backup for VMs using Azure Policy or automation scripts that need service principal authentication, or when setting up backup for Azure VMs using PowerShell/CLI with a service principal for non-interactive authentication.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Download the vault credentials fileCorrect answer▾
Why this is correct
Vault credentials authenticate the temporary mount process used for file-level recovery.
✗Provide the storage account access keyWrong answer — click to see why▾
Why this is wrong here
File-level recovery from Azure Backup does not require the storage account access key; the recovery point is mounted via the portal using vault credentials and the selected recovery point, not by directly accessing the storage account.
★ When this WOULD be the correct answer
When restoring a VM backup to a new VM using Azure Backup, you may need to provide the storage account access key if you are using PowerShell or CLI to restore disks to a storage account, or when configuring backup for a VM that uses unmanaged disks.
Why candidates choose this
Candidates may confuse file-level recovery with restoring VM disks to a storage account, where the access key is needed to access the storage account containing the restored disks.
✗Assign a public IP address to the VMWrong answer — click to see why▾
Why this is wrong here
Assigning a public IP address to the VM is not required for Azure Backup file-level recovery; the recovery point is mounted via a script that uses the vault credentials and does not require direct network access to the VM.
★ When this WOULD be the correct answer
This would be correct in a question about enabling RDP or SSH access to a VM that is not reachable from the internet, or when configuring a load balancer to route traffic to a VM.
Why candidates choose this
Candidates may think that mounting a recovery point requires network connectivity or that the VM needs to be accessible from the portal, leading them to assume a public IP is necessary.
✗Create an Azure AD application secretWrong answer — click to see why▾
Why this is wrong here
Azure Backup file-level recovery does not require an Azure AD application secret. The process involves downloading vault credentials and selecting a recovery point, then mounting the recovery point using a script that runs on the VM, which does not need Azure AD authentication.
★ When this WOULD be the correct answer
An Azure AD application secret would be required when configuring Azure Backup for VMs using Azure Policy or automation scripts that need service principal authentication, or when setting up backup for Azure VMs using PowerShell/CLI with a service principal for non-interactive authentication.
Why candidates choose this
Candidates may confuse Azure Backup with other Azure services that require Azure AD authentication, or think that any Azure operation involving credentials needs an Azure AD app secret, not realizing that vault credentials are specific to Backup and Recovery Services.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Recovery Services vault
A Recovery Services vault is a secure storage container in Microsoft Azure that holds backup data and replication settings for virtual machines, databases, and other cloud resources, enabling you to restore them if something goes wrong.
Key term
Azure Backup
Azure Backup is a cloud-based service from Microsoft that protects your data by creating and storing backups of files, folders, virtual machines, databases, and entire servers in the Azure cloud.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user deleted several files from an Azure VM, and the administrator wants to use Azure Backup file recovery. Which two items are needed to start the recovery process? Select two.
easy- ✓ A.A recovery point
- B.An application security group
- ✓ C.The file recovery script downloaded from the vault
- D.A metric alert rule
- E.A user-assigned managed identity
Why A: Azure Backup file recovery requires a recovery point (A) because it represents the snapshot of the VM's data at a specific time from which files can be restored. The file recovery script (C) is downloaded from the Recovery Services vault and mounts the recovery point as a drive on the VM, enabling file-level access. Without both, the recovery process cannot proceed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.