SC-100 Certification Practice Question #241

Question

You have the resources shown in the following table.

You need to configure multi-user authorization (MUA) for Azure Backup to protect the Recovery Services vaults. The solution must maximize the security of the MUA configuration.

To which location should you deploy Resource Guard, and which role-based access control (RBAC) role should you assign to the team responsible for managing the backup of Resource Guard? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

To maximize MUA security the Resource Guard must be isolated from the vaults (place it in a different subscription, ideally a different tenant) while remaining in the **same Azure region** as the Recovery Services vaults. The vaults live in Sub1 / US East, so the only option that is both a different subscription and the same region is **Sub2 in the East US Azure region** (Sub2 is currently unused, giving clean isolation). For the backup management team, MS Learn is explicit that the Backup admin needs only the **Reader** role on the Resource Guard and must NOT hold Contributor, Backup MUA Admin, or Backup MUA Operator — anything higher defeats the purpose of multi-user authorization. This aligns the highest-voted comment, two supporting comments, and MS Learn.

More SC-100 practice questions