Backup, DR, and the Limits of Stamp-Level Protection
Northwind runs a connected Azure Stack Hub stamp with 8 nodes. The operator has configured infrastructure backup to a storage account on the stamp itself and takes a backup weekly. The business asks whether this protects against a full stamp loss. The operator also has tenant workloads with a 4-hour recovery point objective and a 12-hour recovery time objective. The stamp is in a single datacenter. The business has an Azure subscription available for disaster recovery. The operator proposes to rely on infrastructure backup for both infrastructure and tenant data recovery.
1. Evaluate the proposed backup design against the stated RPO and RTO, and identify the gaps.
Read the worked answer
The proposed design does not meet the requirements. Infrastructure backup captures stamp infrastructure configuration and service data, not tenant workload data. It is used to restore the stamp's infrastructure, not to recover tenant VMs and applications. Storing the backup on the stamp itself also fails the full-stamp-loss scenario, because the backup is lost with the stamp.
Gaps against the objectives:
- RPO of 4 hours: a weekly infrastructure backup provides no tenant data recovery point at all, and even infrastructure recovery points are weekly. Tenant data needs its own backup or replication with a 4-hour or better cadence.
- RTO of 12 hours: restoring a stamp from infrastructure backup is a lengthy process that depends on hardware availability and Microsoft support. It is unlikely to meet 12 hours for tenant applications.
- Full stamp loss: the backup must be stored off the stamp, in an external location, to survive stamp loss.
- Single datacenter: there is no local redundancy against a site-level event.
The judgment: infrastructure backup is not a tenant DR solution. Tenant workloads need their own protection, and backups must be stored externally.
2. Propose a DR approach that meets the RPO and RTO, using the available Azure subscription.
Read the worked answer
Use a two-layer approach: protect tenant workloads directly, and keep infrastructure backup external for stamp rebuild.
Tenant layer:
- Replicate tenant VM data and application data to Azure using an approved replication mechanism, with a replication frequency that meets the 4-hour RPO. For databases, use log shipping or replication that meets the RPO.
- Define a runbook for failover to Azure that the team rehearses, so the 12-hour RTO is achievable.
- Classify tenant applications by criticality and apply the RPO and RTO only to those that require it.
Infrastructure layer:
- Configure infrastructure backup to write to an external storage location outside the stamp so it survives stamp loss.
- Document the stamp rebuild procedure and the dependencies on hardware and support.
Validation:
- Test failover quarterly and measure actual RPO and RTO against the targets.
- Confirm that the external backup can be read and used in a rebuild scenario.
The judgment: meet tenant RPO and RTO with tenant-level replication to Azure, and use infrastructure backup only for stamp rebuild, stored externally.