COH-285 Cohesity Certified Protection Professional – NetBackup Appliances Questions and Answers

The correct answer is media servers and clients. Cohesity NetBackup documentation defines VxUpdate as a deployment-management mechanism for updating non-primary NetBackup hosts. The official NetBackup Upgrade Guide states that “VxUpdate provides a policy-based upgrade tool for media servers and clients,” and further explains that the policy format simplifies media server and client upgrades while signed packages are added to the VxUpdate repository on the primary server for later deployment. Cohesity’s Repository management topic reinforces this by stating that the VxUpdate repository resides on the primary server and contains packages that can be deployed to media servers and clients. It also explicitly says that administrators can upgrade NetBackup media servers and clients to a newer NetBackup version with VxUpdate.

Therefore, option D is correct. Option A is incorrect because the primary server hosts the VxUpdate repository and controls deployment, but it is not itself upgraded through VxUpdate deployment policies. Option B and option C are incomplete because VxUpdate is not limited to only one of those host roles. Reference topics: NetBackup Deployment Management with VxUpdate, About VxUpdate, and Repository management.

The correct prerequisites are to enable granular recovery in the policy and ensure Network File System (NFS) is enabled/installed on the Active Directory client. Cohesity NetBackup documentation states that an Active Directory backup policy can be configured to allow restore of “objects and attributes” and that, in the policy Attributes tab, the administrator must select MS-Windows as the policy type and then Enable the Enable granular recovery option; if it is not enabled, the backup can run, but it cannot produce granular restores. Cohesity also defines the system requirement for Active Directory granular backup and recovery: NFS must be installed on the media server and all Active Directory domain controllers or ADAM/LDS hosts. This matches option E because the Active Directory domain controller is the NetBackup client in this workflow. Option C is incorrect because NBFSD is not installed as a client prerequisite; the client mounts a mapped drive, while the media server handles requests through the NBFS/NBFSD service. Option B is wrong because the documented policy type is MS-Windows, not FlashBackup-Windows. References/topics: Active Directory granular backups and recovery, GRT, NFS configuration, and Creating a policy that allows Active Directory granular restores.

The unavailable credential type is Secret key. In the Cohesity NetBackup Web UI Cloud Administrator’s Guide topic “Add a cloud provider for a Snapshot Manager,” the Microsoft Azure configuration table identifies the supported credential types as Application service principal, System managed identity, and User managed identity. For an Application service principal, the wizard requires related parameters such as Tenant ID, Client ID, and Secret key; however, Secret key is listed as a field used by the application service principal, not as an independent credential type. Cohesity describes the secret key simply as “the secret key of the application,” while the actual credential type heading remains Application service principal. The same table separately lists System managed identity, which requires enabling system-managed identity on the Snapshot Manager host in Azure and assigning the role, and User managed identity, which uses the Client ID of the user-managed identity connected to the Snapshot Manager host. Therefore, options A, B, and D are valid Azure Snapshot Manager credential types, while option C is only an authentication parameter under service-principal configuration. Reference topics: NetBackup Web UI Cloud Administrator’s Guide, Configure Snapshot Manager in NetBackup, and Add a cloud provider for a Snapshot Manager.

The correct resources are the operating system logs and the robtest command. The failure is not a client file-read problem; it occurs when bptm requests tape media and the robot cannot complete the operation. Cohesity NetBackup documentation describes the tape workflow: bptm reserves drives and issues mount requests through the Media Manager and robotic daemons, which perform the physical media mount. When the job detail reports “Robot operation failed” and “All drives down,” the fault domain is tape device access, robotic control, drive visibility, zoning, library state, or OS-level SCSI communication. Official troubleshooting guidance states that NetBackup uses OS-level commands and drivers for tape operations, and recommends starting at the OS and hardware layer and checking OS system/event logs. The robtest utility is also directly relevant because it issues basic SCSI commands to a robotic device attached to a NetBackup media server and can test drive status, slot status, move operations, and robot readiness. Options B, C, and D are less relevant: bpbkar is a backup client read process, nbdevconfig is primarily disk-storage configuration, and bpmedia manages media records rather than robotic motion or drive connectivity.

The correct answer is C because the failure is an authorization problem on the NetBackup client, not a basic network-connectivity failure. The job output explicitly states that nbumaster8 “is not an authorized server for host nbclient1,” followed by status 59: access to the client was not allowed. Cohesity NetBackup documentation maps status code 59 to “Access to the client was not allowed.” The controlling configuration is the client’s SERVER list. Cohesity states that the SERVER entry defines the list of NetBackup primary and media servers that can access the NetBackup client, and that media servers or other primary servers must be added for that client. Cohesity also explains that on UNIX servers and clients, the SERVER entries in bp.conf define the NetBackup servers that are allowed access, with additional entries identifying servers that can initiate scheduled backups. Therefore, the client rejected the backup request because the requesting server name was missing from the client’s server list or did not match the expected resolved name. References/topics: Status code 59, SERVER option for NetBackup clients, bp.conf, Host Properties > Clients > Servers, and NetBackup host-name authorization.

The correct logs are the NetBackup bpfis logs on the client and the operating system logs on the client. The job details show a Windows snapshot failure: GLOBALROOT\Device\HarddiskVolumeShadowCopy..., status: 156: snapshot error encountered, and status: 1542: An existing snapshot is no longer valid. In Cohesity NetBackup snapshot processing, bpbrm starts bpfis on the client, and bpfis creates the snapshot of the client data and returns snapshot completion status. Therefore, the bpfis client log is the primary NetBackup log for the snapshot creation, mount, and delete phases.

Because this is a Microsoft Windows client snapshot issue, the Windows operating system logs are equally important. Cohesity’s status 156 troubleshooting topic identifies VSS framework failures and notes that VSS-related application events may be written on the affected Windows system; it also references bpfis log content for snapshot failures. The media server bpbrm log can show orchestration status, but it usually reports what the client-side snapshot component returned. The bptm log is for media/data movement and is not the best source for VSS snapshot root cause.

( NetBackup Compatibility Lists provide a comprehensive list of supported operating systems, applications, and hardware for NetBackup, enabling users to ensure that their backup environment is compatible with NetBackup and avoid potential compatibility issues.)

( Storage unit groups in NetBackup enable load balancing and failover for backup jobs, by allowing you to define multiple storage units for a backup policy and specify the order in which they are used for backups.)

The correct command is nbstlutil. In NetBackup, lifecycle-managed images are controlled by Storage Lifecycle Policies (SLPs), and the dedicated command-line utility for inspecting and intervening in SLP processing is nbstlutil. Cohesity’s NetBackup Commands Reference defines nbstlutil as the command used to “run the NetBackup storage lifecycle policies utility,” and its description states that it provides a way for users to intervene in storage lifecycle policy operations. Most directly, the same official command reference lists the report function under nbstlutil and states that report shows a rollup of incomplete copies of lifecycle-managed images. Therefore, the practical command would be nbstlutil report, with optional filters such as lifecycle name, client, media ID, media server, storage server, or SLP version.

The other commands do not target this SLP-specific view. bpimage is associated with backup image operations, bpimmedia reports media/image relationships, and bpimagelist lists backup image catalog information. They do not provide the SLP incomplete-copy rollup requested in the question. Reference topics: NetBackup Commands Reference Guide, nbstlutil, Storage Lifecycle Policy operations, and lifecycle-managed image status reporting.

( The NetBackup 10.0 Release Notes provide a comprehensive list of new features, enhancements, and bug fixes in the latest version of NetBackup, enabling users to get up-to-date information on the product.)

The correct permissions are View and Subscribe. In NetBackup RBAC, adding an asset to a Protection Plan is treated as subscribing the asset to that plan, not creating, updating, or managing the plan itself. Cohesity documentation describes the workflow as selecting one or more assets, clicking Add protection, choosing a protection plan, and clicking Protect; it also states that a single asset or group of assets can be subscribed to one or more protection plans. The RBAC permissions model separates plan administration from asset subscription. The role-permissions topic defines protection plans as the area used to manage how backups are performed with protection plans, while assets are managed separately under the Assets permission category. Official NetBackup RBAC guidance states that to add assets to a protection plan, the user requires View and Subscribe permissions on the protection plan, with corresponding asset permissions to view and protect the assets. Therefore, View and Subscribe is the permission pair directly aligned with adding an asset to a Protection Plan. References/topics: RBAC role permissions, Protection Plans, Subscribe an asset or asset group, and Workload asset protection workflow.

The required prerequisite is to set an encryption passphrase for disaster recovery packages. In a NetBackup catalog backup workflow, the catalog backup creates disaster recovery information that is required during catalog recovery. Cohesity NetBackup documentation places the passphrase step before the catalog policy is configured. In the manual catalog backup procedure, after creating the DRPackages directory and setting ownership, the guide instructs the administrator to “set the passphrase to be used at time of catalog recovery,” then open the NetBackup Administrator Console and navigate to Security Management > Global Security Setting > Disaster Recovery. In the Encryption for Disaster Recovery section, the administrator must add, confirm, and save the passphrase. Only after these steps does the documented procedure proceed to “Configure NetBackup catalog backup policy.”

This makes option D correct. A universal share is not required; the DR package path can be a configured persistent directory. An email address is optional and only used to send DR packages when email is configured. Logging in as Systems Administrator is not the specific prerequisite identified by the catalog backup procedure. Reference topics: Performing catalog backup and recovery, Backing up a catalog, and Disaster Recovery encryption settings.

The correct log to analyze is the nbdb log. The nbdb_ping utility is specifically used to check and display the status of the NetBackup database, including NBDB, NBAZDB, and BMRDB. Cohesity’s NetBackup Commands Reference states that running nbdb_ping with no options displays the status of NBDB, which directly matches the diagnostic command in the question. When nbdb_ping reports “Database [NBDB] is not available,” the most relevant NetBackup diagnostic logging is produced under the nbdb log area, not emm.log or nbrb-style service logs. Official NetBackup support examples show the same failure being diagnosed from the nbdb log at /usr/openv/netbackup/logs/nbdb, including entries from nbdb_ping, configuration-file read failures, and the exact message Database [NBDB] is not available. Another NetBackup case with the same nbdb_ping error shows server.log containing no useful errors while /usr/openv/netbackup/logs/nbdb contains the actionable nbdb_admin and nbdb_ping failures. Therefore, the log identified by option A is the appropriate troubleshooting source.

The correct feature is Synthetic backups. Cohesity NetBackup documentation explains that, in a traditional full backup, all files are copied from the client to the primary or media server, even if the files have not changed. With a synthetic full backup, NetBackup combines the previous full backup with subsequent incremental backups on the media server to create a new full image. Because the processing occurs on the primary and media servers rather than repeatedly reading all data from the client, synthetic backups reduce client-to-server network traffic; files are transferred over the network only once. Synthetic backups can also be written to disk storage units, making them appropriate for an AdvancedDisk target backed by a high-speed disk array. This fits the scenario because Windows and Linux file servers map to MS-Windows and Standard policy types, which are supported for synthetic backups. NetBackup Accelerator is not the best answer here because Accelerator requires supported disk targets such as MSDP, NetBackup appliance storage, cloud storage, or qualified OST storage, not a generic AdvancedDisk storage unit. Client-side deduplication similarly requires deduplication storage, and network resiliency improves fault tolerance rather than reducing backup traffic. References/topics: Synthetic backups, AdvancedDisk storage units, backup traffic optimization, and Accelerator requirements.