Veeam VMCA2022 Veeam Certified Architect 2022 Exam Practice Test

Reducing the recovery point objective (RPO) for silver tier workloads means that the backup frequency will increase, resulting in more backup data being generated and transferred. This will affect the sizing requirements of the Veeam components that are responsible for storing and processing the backup data, namely the Veeam repository and proxy roles1.

The Veeam repository is a storage location where the backup files are stored. The repository size depends on the amount of data to be backed up, the backup method, the retention policy, and the compression and deduplication settings2. Reducing the RPO will increase the amount of data to be backed up, and may require more frequent synthetic full backups or active full backups to maintain the retention policy. This will increase the repository size and the disk space consumption.

The Veeam proxy is a data mover that performs backup, replication, and restore tasks. The proxy size depends on the number of concurrent tasks, the transport mode, the backup method, and the compression and deduplication settings3. Reducing the RPO will increase the number of concurrent tasks and the amount of data to be processed by the proxy. This will increase the proxy size and the CPU and memory consumption.

You can find more information about the sizing requirements and best practices for the Veeam repository and proxy roles in the following resources:

• Veeam Backup & Replication Best Practices
• Veeam Backup Repository Sizing Calculator
• Veeam Proxy Sizing Calculator

The best way to accomplish the goal of ensuring backups are free of malware before data is restored is to ensure a compatible antivirus solution is available on mount servers for secure restores. Secure restore is a feature of Veeam Backup & Replication that allows you to scan backup files for malware before performing a restore operation, using a built-in or third-party antivirus solution1. Mount servers are components of Veeam Backup & Replication that mount backup files to the backup server or backup proxy2. By having a compatible antivirus solution on mount servers, you can leverage the secure restore feature to check the backup data for malware and prevent any infection from spreading to the production environment. The other options are either not feasible (option A and B, as staged restore and Veeam Data Integration API are not designed for malware detection34) or not sufficient (option C, as Veeam Data Integration API alone cannot scan backup files for malware). References: Secure Restore, Mount Servers, Staged Restore, Veeam Data Integration API.

The best way to deploy the proxies for the remote office is to deploy eight virtual proxies with eight CPUs and 16 GB of RAM each. This option allows to leverage the Virtual appliance (Hot-Add) mode, which is the recommended transport mode for VSAN storage1. Virtual appliance mode enables LAN-free data transfer between the source datastore and the proxy, as well as load balancing and fault tolerance across multiple proxies2. The other options are either not optimal (option A and B, as physical proxies require LAN or SAN connection to access the source data, which may impact the networkperformance and backup SLAs3) or not supported (option C, as virtual proxies with more than eight CPUs are not compatible with Virtual appliance mode). References: Transport Modes, Virtual Appliance Mode, Direct Storage Access Mode, [Requirements and Limitations for VMware Backup Proxies].

Backup from Storage Snapshots and Direct NFS are the preferred processing modes for NFS datastores, as they offer the best performance and reliability for backup and restore operations12.

Backup from Storage Snapshots is a feature of Veeam Backup & Replication that leverages the native snapshot capabilities of the storage system to create a consistent point-in-time copy of the VM data. Veeam Backup & Replication then reads data directly from the storage snapshot, bypassing the ESXi host and reducing the impact on the production environment3. Backup from Storage Snapshots is supported for NFS datastores on NetApp, Nimble, Dell EMC, HPE, and Pure Storage systems4.

Direct NFS is a proprietary transport mode of Veeam Backup & Replication that uses a native NFS client deployed on the backup proxy to read and write data directly from and to the NFS datastore. Veeam Backup & Replication also bypasses the ESXi host and reduces the load on the production environment. Direct NFS is supported for NFS datastores on any storage system that supports NFS version 3 or 4.1.

The other options are not preferred because:

• B) Network (NBD) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network. This mode produces additional load on the ESXi host and the network, and may result in slower backup and restore performance.
• C) Virtual Appliance (HotAdd) mode is a transport mode that uses the VMware VDDK to attach the disks of the processed VM to the backup proxy VM. This mode also produces additional load on the ESXi host and the network, and may cause issues with disk alignment or SCSI controller limitations.
• D) Network mode with Encryption (NBDSSL) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network with SSL encryption. This mode provides an extra layer of security, but also adds more overhead and reduces the backup and restore performance.

You can find more information about the processing modes and how to choose the best one for your environment in the following resources:

• Transport Modes
• Selecting a Transport Mode
• Backup from Storage Snapshots
• Storage Systems Supported for Backup from Storage Snapshots
• [Direct NFS Access]
• [Network Mode]
• [Virtual Appliance Mode]
• [Network Mode with Encryption]

Network traffic rules are settings that allow you to control the network traffic transferred between backup infrastructure components, such as backup proxies, repositories, and WAN accelerators. You can use network traffic rules to throttle or encrypt the network traffic, or to specify preferred networks for data transfer1.

By configuring network traffic rules, you can reduce the bandwidth consumption for the offloading of data to public cloud storage, and avoid affecting the performance of business applications on the branch sites. You can set limits for the network traffic speed, or schedule the offloading tasks to run during off-peak hours2. You can also select the optimal network routes for the offloading tasks, and avoid congested or slow networks3.

You can find more information about network traffic rules and how to configure them in the following resources:

• Configuring Network Traffic Rules
• Enabling Traffic Throttling
• Specifying Preferred Networks

Snapshot stun is a phenomenon that occurs when a VMware snapshot is removed and the virtual machine (VM) experiences a temporary freeze or performance degradation1. This can affect the availability and consistency of mission critical applications running on the VM.

To avoid snapshot stun, Veeam Backup & Replication offers several options for backing up Linux VMs, such as backup from storage snapshots, direct SAN access, or hot-add2. However, based on the business requirements, the best option is to run pre-freeze and post-thaw scripts before backing up the workload.

Pre-freeze and post-thaw scripts are custom scripts that you can configure to run on the Linux VM before and after the snapshot is taken. The pre-freeze script can be used to quiesce the application and flush its data to disk, ensuring a consistent backup. The post-thaw script can be used to resume the application and perform any necessary cleanup actions3.

By using pre-freeze and post-thaw scripts, you can achieve application consistency and minimize the impact of snapshot stun on the Linux VM. You can use the Veeam Backup & Replication user interface or the Veeam PowerShell snap-in to configure the scripts for the backup job3.

You can find more information about pre-freeze and post-thaw scripts and how to use them in the following resources:

• Pre-Freeze and Post-Thaw Scripts
• Best Practice for Backing Up Linux VMs
• Snapshot Stun Issue

Data scrubbing is the process of removing sensitive or confidential data from backups before restoring them, to comply with regulatory or legal requirements1. Veeam Backup & Replication supports data scrubbing for VMware VMs by using a custom script that runs inside the virtual lab2.

To perform data scrubbing, you need to create a virtual lab, an application group, and a SureBackup job. The virtual lab is a fenced-off environment where you can test and verify your backups without affecting the production network3. The application group is a collection of VMs that you want to restore and scrub. The SureBackup job is a task that automates the verification and restoration of VMs in the virtual lab.

The custom script is a PowerShell script that you need to write and configure to run on the VMs in the application group. The script should perform the necessary actions to delete or modify the data that you want to scrub, such as files, folders, registry keys, database records, etc2. You can use the Veeam PowerShell snap-in to access the Veeam functionality and objects from the script.

You can find more information about data scrubbing and how to configure it in the Veeam Backup & Replication User Guide for VMware vSphere2.

The additional condition of the offsite backup that is presumed by the immutability requirement is that a copy of backup data must reside in a public cloud local to each region. Immutability means that the backup data cannot be modified, deleted, or overwritten by anyone, including the backup administrator, the cloud provider, or malicious actors1. Veeam Backup & Replication v11 supports immutability for backups stored in Amazon S3 and Microsoft Azure Blob Storage, using the Object Lock feature2. Therefore, the offsite backup must use one of these cloud providers, and must be located in the same region as the source data, to comply with the data locality and privacy laws. The other options are not related to the immutability requirement, as they are either already stated in the business requirements (option A), technical requirements (option B), or not relevant for the Veeam solution (option C). References: Immutability, Object StorageImmutability.

The Veeam backup method that should be used for the virtualized stock trading application is to separate the virtual machine into its own job and enable application aware processing. This method allows Veeam Backup & Replication to create transactionally consistent backups of the application, by quiescing the application and creating a snapshot of its data1. This ensures that the application can be restored to a working state, without data loss or corruption. The other options are either not suitable for the application (option A, as Veeam agent is designed for physical machines or cloud instances2), not sufficient for the application (option C, as pre-freeze and post-thaw scripts do not guarantee transactional consistency3), or not related to the backup method (option D, as replication is a different process from backup). References: Application-Aware Processing, Veeam Agent Management, Pre-Freeze and Post-Thaw Scripts, [Replication].

The component sizing that should be adjusted is the physical storage in the repositories. The repositories are the backup storage locations where Veeam Backup & Replication stores backup files, VM copies and metadata for replicated VMs1. Increasing the retention period from four to five years means that more backup files will be kept on the repositories, and thus more storage space will be required. The other options are not affected by the retention period change, as they are either related to off-site backups (option A), Veeam Backup & Replication server performance (option C), or backup proxy performance (option D). References: Backup Repositories.

The configuration that is unsupported by Veeam Plug-in for Oracle RMAN based on the technical requirements is physical windows server with Oracle. Veeam Plug-in for Oracle RMAN only supports Oracle databases running on Linux, Solaris, or AIX operating systems1. The other configurations are supported by either Veeam Plug-in for Oracle RMAN or Veeam Backup & Replication. References: Veeam Plug-in for Oracle RMAN, Oracle | Veeam Backup & Replication Best Practice Guide.

To design a solution that meets the replication requirement for Veeam University Hospital, you need to consider some of the mitigating techniques that might be required for the virtual machines that have several separate large VMDKs with a high change rate per virtual machine on the same datastore. This will help you to overcome some of the challenges and limitations that may affect the replication performance and efficiency, as well as the recovery point objective (RPO) of the organization.

According to the Veeam Backup & Replication Best Practice Guide, some of the mitigating techniques that might be required are:

•Implement WAN accelerator. This technique can help you to reduce the amount of data that needs to be transferred and processed between the source and target sites, by using caching, deduplication, compression, and encryption. You need to deploy a pair of WAN accelerators, one at the source site and one at the target site, and configure them in the replication job settings. This technique can improve the replication speed and efficiency, as well as save network bandwidth and storage space.

•Recommend migrating some of the VMDKs to alternative datastores. This technique can help you to avoid performance degradation and resource contention on the source datastore, by distributing the load and I/O across multiple datastores. You need to use VMware tools or commands, such as Storage vMotion or svmotion, to migrate some of the VMDKs to other datastores that have enough capacity and performance. This technique can improve the replication stability and reliability, as well as reduce the impact on the production environment.

Therefore, based on these techniques, the answer that describes which mitigating techniques might be required is A and C.

•Backup copy jobs with GFS enabled. This type of job does not support using immutability from S3 Object Lock because it uses synthetic full backups, which require modifying existing backup files. Synthetic full backups are not compatible with immutability settings, as they violate the principle of not changing the backup files.

•Use Linux repositories as the performance tier, which are more secure and resilient than Windows repositories, as they support immutable backups and prevent ransomware from accessing or deleting backup files1.

•Use immutable cloud storage as the capacity tier, which will offload older backup files to a public cloud object storage that supports immutability, such as Amazon S3 Object Lock or Azure Blob Storage with immutable policies2. This will ensure that the backup files cannot be modified or deleted by ransomware or malicious users for a specified period of time.

•Use Scale-out Backup Repository, which is a logical entity that groups several backup repositories into a single pool of storage, allowing for better backup performance, scalability, and management3.

References: 1: Protect against Ransomware with Immutable Backups - Veeam 2: Ransomware Protection: Learn How Veeam Can Protect Your Data 3: Scale-Out Backup Repository - Veeam Backup & Replication Best Practice Guide

WAN accelerators are dedicated components that Veeam Backup & Replication uses for WAN acceleration. WAN accelerators are responsible for global data caching and data deduplication, which reduce the amount of data that needs to be transferred over the network. By adding WAN accelerators to each site, you can improve the performance of backup copy jobs between sites, and reduce the bandwidth consumption and network traffic3

References:

1: Gateway Server - User Guide for VMware vSphere 2: Gateway Server - User Guide for VMware vSphere 3: WAN Accelerators - User Guide for VMware vSphere

•MFA is a security method that requires users to provide two or more pieces of evidence to verify their identity, such as a password, a code, a token, or a biometric factor3.

•MFA adds an extra layer of protection against ransomware attacks, as it prevents attackers from accessing the Veeam components even if they manage to steal or guess the passwords of the administrative accounts12.

•MFA also helps to prevent unauthorized changes or deletions of backup data, as well as unauthorized restores or failovers of VMs or applications12.

The other options are not as effective or feasible, as they either do not provide enough security, limit the functionality, or disrupt the integration of the Veeam infrastructure.

References: 1: 6 Best Practices For Ransomware Protection | Veeam 2: Ransomware Prevention Best Practices - Veeam 3: Multi-factor authentication - Wikipedia

According to the Veeam Backup & Replication Best Practice Guide1, one of the possible ramifications of shortening the backup window to eight hours is that the CPU and memory requirements of the proxies will be increased. This is because:

•The proxies are responsible for retrieving data from the source and sending it to the target. They perform data compression, deduplication, encryption, and other tasks that consume CPU and memory resources.

•To shorten the backup window, the proxies need to process more data in less time, which means they need more CPU cores and memory to handle concurrent tasks and avoid bottlenecks.

•The backup window can also be affected by other factors, such as the network bandwidth, the storage throughput, the backup methods, and the backup settings. Therefore, it is important to consider all these aspects when designing a backup solution.

References: 1: Proxy - Veeam Backup & Replication Best Practice Guide

To design a solution that meets the SureBackup job design requirements for Veeam University Hospital, you need to consider some of the environmental parameters that may affect the possible SureBackup job design. This will help you to ensure the functionality and reliability of the SureBackup feature, which allows you to verify the recoverability of your backups in an isolated environment.

According to the Veeam Backup & Replication Best Practice Guide, some of the environmental parameters that may affect the possible SureBackup job design are:

•Virtual machines are stored on VMware encrypted datastores. This parameter may affect the possible SureBackup job design because VMware encrypted datastores require special handling and configuration for backup and restore operations. You need to enable encryption support in the backup infrastructure settings, as well as provide the necessary credentials and permissions for accessing the encrypted datastores. You also need to ensure that the virtual lab where the SureBackup jobs run supports encrypted datastores, which may require additional resources and licenses.

•Each site has 20 vLANs in use, with 16 being used for VMware workloads. This parameter may affect the possible SureBackup job design because vLANs require network mapping and routing for backup and restore operations. You need to configure the network settings and rules for the virtual lab where the SureBackup jobs run, as well as for the application group and backup job that are included in the SureBackup job. You also need to ensure that the network isolation and connectivity are maintained and tested for the virtual machines that are verified by the SureBackup job.

To design a solution that meets the database requirements for Veeam University Hospital, you need to consider some of the assumptions and implications of using the script for the in-house database. This will help you to ensure the consistency and reliability of the database backups and restores, as well as the compatibility and supportability of the script with Veeam products and features.

According to the Veeam Backup & Replication Best Practice Guide, one of the assumptions that using the script for the in-house database presents is C. The script already exists and is solely managed by the customer.

This assumption means that:

•The script is not provided or maintained by Veeam, but by the customer or a third-party vendor. Therefore, Veeam is not responsible for the functionality or quality of the script, nor for any issues or errors that may arise from using it.

•The script is already tested and verified by the customer or a third-party vendor. Therefore, Veeam does not need to validate or certify the script, nor to provide any documentation or guidance on how to use it.

•The script is already integrated and configured with the in-house database. Therefore, Veeam does not need to modify or customize the script, nor to provide any support or troubleshooting for it.

This assumption has some implications for designing a solution with Veeam products and features, such as:

•The customer or a third-party vendor must ensure that the script is compatible and compliant with the latest versions and updates of Veeam Backup & Replication, as well as with the in-house database.

•The customer or a third-party vendor must provide Veeam with the necessary information and access to run the script before and after the backup or restore operations, such as the script location, parameters, credentials, etc.

•The customer or a third-party vendor must monitor and manage the script performance and results, as well as handle any exceptions or failures that may occur during or after the backup orrestore operations.

Based on the customer Windows and Linux file server backup requirements, the best component to help them meet their stated objectives is Backup Enterprise Manager with indexing enabled on virtual machine and Agent backups with RBAC policies. This is because:

•Backup Enterprise Manager allows the customer to manage and monitor backup jobs across multiple backup servers from a single web-based interface1.

•Indexing enables the customer to perform file-level recovery from the backups of Windows and Linux servers, as well as search for files across all backups2.

•RBAC policies allow the customer to delegate permissions to different users and groups for performing file-level recovery, based on their roles and restore scopes3.

References: 1: Veeam Backup Enterprise Manager Guide 2: Veeam Backup & Replication User Guide 3: Veeam Backup Enterprise Manager Guide > Configuring Accounts and Roles

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to consider some of the risks and challenges that may affect the success and quality of the project. This will help you to identify and mitigate any potential issues or errors that may arise during the implementation or operation of the solution.

According to the Veeam Backup & Replication Best Practice Guide, a risk is a factor that may negatively impact the performance, reliability, security, or functionality of the backup and replication solution. A risk may be caused by internal or external factors, such as technical limitations, environmental constraints, human errors, etc.

Based on this definition, one of the possible risks for this project is C. Data must be replicated with one-hour recovery point objective.

This risk means that:

•The recovery point objective (RPO) is a business requirement that defines the maximum acceptable amount of data loss in case of a disaster or failure. It is measured in time units, such as minutes, hours, or days.

•The data replication is a technical solution that allows you to create replicas of your running workloads on another host or site. It is used for disaster recovery purposes, as it enables you to quickly fail over and fail back in case of a disaster.

•The one-hour RPO is a challenging and demanding requirement that may be difficult toachieve or maintain, depending on various factors, such as the data change rate, the available bandwidth, the replication frequency, etc.

•The one-hour RPO may also conflict or contradict with other requirements or expectations, such as the backup window, the backup retention, the backup storage capacity, etc.

This risk has some implications for designing a solution with Veeam products and features, such as:

•The customer or a third-party vendor must monitor and measure the data change rate of the workloads that need to be replicated, as well as the available bandwidth between sites. This will help to plan and optimize the replication infrastructure, such as the proxy servers, repository servers, WAN accelerators, and failover plans, based on the data change rate.

•The customer or a third-party vendor must configure and adjust the replication settings and policies, such as the replication method, schedule, frequency, retention, compression, deduplication, etc., based on the one-hour RPO. This will help to improve the replication performance and efficiency, as well as to meet the RPO requirement.

•The customer or a third-party vendor must test and verify the replication results and processes, as well as perform regular failover and failback drills. This will help to ensure the reliability and consistency of the replicas, as well as to validate and improve the RPO achievement.

To make backup files immutable in a Scale-out Backup Repository, you need to use XFS extents with the reflink attribute enabled. This attribute allows Veeam Backup & Replication to create immutable backup files using the fast clone technology. If some of the XFS extents do not have this attribute enabled, they will not support immutability and the backup files stored on them will not be protected from deletion or modification1

The component that will help the customer meet their stated objectives of role-based access control (RBAC) and alternative decryption capabilities is Veeam Backup Enterprise Manager. Veeam Backup Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides RBAC policies that enable granular control over user permissions and access to backup data. For example, you can assign different roles to different users or groups based on their responsibilities and needs, such as backup administrator, restore operator, securityofficer, etc. Veeam Backup Enterprise Manager also provides password loss protection feature that enables authorized users to restore encrypted backups without entering passwords if they forget or lose them.

The preferred method to achieve the requirement of excluding the H: drive on MSSQL server virtual machines is to set up VMDK exclusion for the disk on which the H: resides in the Virtual Machines > Exclusions page for each virtual machine. This method allows you to exclude specific virtual disks from being processed by backup jobs based on their SCSI IDs or disk labels. This can save backup time and storage space by skipping unnecessary data. This method also works reliably regardless of whether the MSSQL servers are built on demand or from virtual machine templates.

The retention requirement for gold tier virtual machines is that they must have 14 daily, eight weekly, three monthly and seven yearly backups. This requirement can be derived from the technical requirement of having eight weekly backups, three monthly backups, and seven yearly backups for regulatory purposes, as well as the business requirement of having daily backups for gold tier virtual machines.

The assumption that can be made for the conceptual design is that Veeam Agent backups of sale staff laptops should be managed by the backup server. This assumption is based on the best practice and recommendation for using Veeam Backup & Replication. Veeam Agent backups of sale staff laptops should be managed by the backup server to enable centralized management, monitoring, and reporting of all agent-based backups. This can also simplify the backup configuration, scheduling, and retention for the laptop agents.

The types of jobs that do not support using immutability from S3 Object Lock or hardened repositories are NAS backups and Agent for Mac backups. These types of jobs do not have the option to enable immutability in their settings, unlike VMware, Hyper-V, Linux Agent, or Windows Agent backup jobs. Therefore, they cannot leverage the immutability feature of S3 Object Lock or hardened repositories to protect their backups from ransomware or malicious deletion.

References: [S3 Object Lock Immutability], [Hardened Linux Repository], [NAS Backup], [Agent for Mac]

The areas that would benefit from additional analysis on areas mentioned in the case study are MSSQL, NAS, and PostgreSQL. These areas have specific backup and restore requirements that need to be considered and addressed in the design and sizing of the Veeam backup infrastructure. For example, MSSQL requires transaction log backup and application-aware processing to ensure consistent backups and point-in-time recovery. NAS requires file-level backup and storage integration to optimize backup performance and storage efficiency. PostgreSQL requires pre-freeze and post-thaw scripts to quiesce the database before backup and resume it after backup.

References: [MSSQL Server Backup], [NAS Backup], [PostgreSQL Backup]

The best way to configure backups for a group of MSSQL systems running in an Always-On cluster and sensitive to virtual machine stun is to deploy Veeam agents configured for failover clustering. Veeam agents can provide application-aware processing and transaction log backup for MSSQL servers, as well as support for failover clustering and cluster shared volumes. Veeam agents can also reduce the impact of virtual machine stun by performing backups at the guest OS level, without using VMware snapshots.

The recovery point objective (RPO) requirement of periodic backups every hour for gold tier virtual machines directly conflicts with the technical requirement of all backups must complete within the hours of 5 p.m. to 8 a.m. local time. This is because these two requirements are mutually exclusive, as hourly backups would need to run during the daytime as well as the nighttime, while the backup window only allows backups to run during the nighttime. Therefore, you need to get clarification from the customer on which requirement has priority and how to adjust the other one accordingly.

The component that can help meet the requirement of alternative decryption capabilities on encrypted backups in the event of lost passwords is Veeam Backup Enterprise Manager. Veeam Backup Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides a password loss protection feature that enables authorized users to restore encrypted backups without entering passwords if they forget or lose them. This feature requires enabling password loss protection in Veeam Backup Enterprise Manager settings and assigning a security officer role to a user who can approve password recovery requests.

References: [Veeam Backup Enterprise Manager], [Password Loss Protection]

The information that is missing from discovery is what the available bandwidth is between Fresno and Carson City. This information is important for designing and sizing the backup copy jobs that need to run daily between the two sites. The available bandwidth can affect the backup copy performance, duration, and size. For example, you can use the available bandwidth to estimate how much data can be transferred between the sites within the backup copy window. You can also use theavailable bandwidth to determine whether you need to use compression, deduplication, or WAN acceleration to optimize the backup copy traffic.