VMCA2022 Veeam Certified Architect 2022 Questions and Answers

The information related to the virtual infrastructure that is missing and must be collected during the discovery are the total number of virtual machines and the size of the source data set. These are essential metrics for sizing the backup components, such as proxies, repositories, and transporters, as well as estimating the backup storage requirements and bandwidth consumption. The other options are either already provided in the scenario (recovery time objective, backup window) or not relevant for the Veeam solution (speed of Fibre Channel fabric).  References:   Veeam Certified Architect 2022 Exam Guide , page 10;  Veeam Backup & Replication v11: Architecture and Design course , module 3.

The requirement C is vague and needs more clarification from the customer. It does not specify which public cloud provider, service, or storage tier should be used for the backup data. It also does not indicate how the backup data should be transferred, secured, or managed in the public cloud. The other requirements are more clear and specific, and can be met with the Veeam solution features and best practices.  References:   Veeam Certified Architect 2022 Exam Guide , page 9;  Veeam Backup & Replication v11: Architecture and Design course , module 6.

The additional condition of the offsite backup that is presumed by the immutability requirement is that a copy of backup data must reside in a public cloud local to each region.  Immutability means that the backup data cannot be modified, deleted, or overwritten by anyone, including the backup administrator, the cloud provider, or malicious actors 1 .  Veeam Backup & Replication v11 supports immutability for backups stored in Amazon S3 and Microsoft Azure Blob Storage, using the Object Lock feature 2 . Therefore, the offsite backup must use one of these cloud providers, and must be located in the same region as the source data, to comply with the data locality and privacy laws. The other options are not related to the immutability requirement, as they are either already stated in the business requirements (option A), technical requirements (option B), or not relevant for the Veeam solution (option C).  References:   Immutability ,  Object Storage Immutability .

The best option to still satisfy the requirement for offsite, immutable or air gapped backups if the cloud provider selected for archive storage does not support immutability is to set up Scale-out Backup Repository capacity tier to a different cloud provider than the archive tier.  Scale-out Backup Repository is a logical entity that groups several backup repositories into a single pool of storage, and allows to move backup files between performance and capacity tiers 1 .  The capacity tier can be configured to use Amazon S3 or Microsoft Azure Blob Storage, which support Object Lock feature for immutability 2 . By using a different cloud provider for the capacity tier than the archive tier, the backup data can be stored in two separate locations, with one copy being immutable or air gapped. The other options are either not feasible (option A, as the scenario does not mention another site), not secure (option C, as the backup data can still be accessed or modified when the repository is online), or not offsite (option D, as the scenario requires a copy of backup data in a public cloud).  References:   Scale-out Backup Repository ,  Object Storage Immutability .

Changing the backup window from 12 hours to 14 hours means that the backup jobs will have more time to complete, and therefore less concurrency will be required.  This will reduce the load on the proxies, which are the data movers that perform backup, replication, and restore tasks 1 . The proxies will need fewer resources, such as CPU and memory, to handle the same amount of data.

The other options are incorrect because:

A) Proxies will not require more resources, as explained above.

B) Mount servers will not require fewer resources, as they are not affected by the backup window.  Mount servers are used to mount backup files and restore data from them 2 . Their resource consumption depends on the restore frequency and performance, not the backup window.

D) Repositories will not require more storage space, as the backup window does not affect the backup size.  Repositories are storage locations where the backup files are stored 3 . Their storage space consumption depends on the amount of data to be backed up, the backup method, the retention policy, and the compression and deduplication settings, not the backup window.

You can find more information about the backup window and the Veeam components in the following resources:

Backup Window

Mount Server

Backup Repository

The Veeam backup method that should be used for the virtualized stock trading application is to separate the virtual machine into its own job and enable application aware processing.  This method allows Veeam Backup & Replication to create transactionally consistent backups of the application, by quiescing the application and creating a snapshot of its data 1 . This ensures that the application can be restored to a working state, without data loss or corruption.  The other options are either not suitable for the application (option A, as Veeam agent is designed for physical machines or cloud instances 2 ), not sufficient for the application (option C, as pre-freeze and post-thaw scripts do not guarantee transactional consistency 3 ), or not related to the backup method (option D, as replication is a different process from backup).  References:   Application-Aware Processing ,  Veeam Agent Management ,  Pre-Freeze and Post-Thaw Scripts , [Replication].

• Virtual machine backup jobs with log shipping enabled allow you to create image-level backups of SQL Server databases and also back up the transaction logs periodically12.

• Scale-out Backup Repository is a logical entity that groups several backup repositories into a single pool of storage, allowing for better backup performance, scalability, and management3.

• Scale-out Backup Repository capacity tier is a feature that allows you to offload older backup files to a public cloud object storage, such as Amazon S3 or Azure Blob Storage .

The other options are not as effective or efficient, as they either do not use Veeam features, do not offload to object storage, or do not create image-level backups.

References: 1: Transaction Log Shipping - User Guide for VMware vSphere 2: How to Back Up SQL Server Transaction Logs - Veeam 3: Scale-Out Backup Repository - Veeam Backup & Replication Best Practice Guide : Capacity Tier - User Guide for VMware vSphere : How to Use Capacity Tier in Veeam - Veeam

Veeam University Hospital is considering using Veeam ONE to collect alarms from the virtual and backup infrastructure. Veeam ONE is a powerful monitoring and reporting tool that provides visibility and insight into the performance, configuration, and utilization of your backup and virtual infrastructure. Veeam ONE can also alert you about any issues or problems that may affect the availability or reliability of your data protection and recovery processes.

One of the options that is available for integrating Veeam ONE with ticketing systems is A. Configure Veeam ONE to send SNMP traps to the ticketing system.

This option means that:

• SNMP (Simple Network Management Protocol) is a protocol that allows network devices to communicate and exchange information with each other.

• SNMP traps are messages that are sent by network devices to notify a management system about events or conditions that require attention or action.

• Veeam ONE can be configured to send SNMP traps to a ticketing system when an alarm is triggered or resolved. This allows you to automate the creation and update of tickets based on the alarm data, such as the alarm name, severity, status, description, etc.

• To configure Veeam ONE to send SNMP traps to a ticketing system, you need to enable SNMP notifications in the Veeam ONE settings, as well as specify the SNMP server address, port, community string, and trap format. You also need to configure the ticketing system to receive and process the SNMP traps from Veeam ONE.

This option is a good choice for integrating Veeam ONE with ticketing systems, as it allows you to leverage the benefits and features of both solutions, such as:

• You can use Veeam ONE to monitor and analyze your backup and virtual infrastructure, as well as to detect and alert you about any issues or problems that may affect your data protection and recovery processes.

• You can use the ticketing system to manage and track the resolution of the issues or problems that are reported by Veeam ONE, as well as to assign and prioritize tickets to the appropriate staff or team members.

• MFA is a security method that requires users to provide two or more pieces of evidence to verify their identity, such as a password, a code, a token, or a biometric factor3.

• MFA adds an extra layer of protection against ransomware attacks, as it prevents attackers from accessing the Veeam components even if they manage to steal or guess the passwords of the administrative accounts12.

• MFA also helps to prevent unauthorized changes or deletions of backup data, as well as unauthorized restores or failovers of VMs or applications12.

The other options are not as effective or feasible, as they either do not provide enough security, limit the functionality, or disrupt the integration of the Veeam infrastructure.

References: 1: 6 Best Practices For Ransomware Protection | Veeam 2: Ransomware Prevention Best Practices - Veeam 3: Multi-factor authentication - Wikipedia

To design a disaster recovery solution that meets the needs and requirements of Veeam University Hospital, you need to identify some information during the discovery phase. This information will help you to understand the scope and scale of the replication and failover processes, the network and storage resources and limitations, and the recovery time objectives and recovery point objectives.

According to the Veeam Backup & Replication Best Practice Guide, some of the information that is necessary to design the disaster recovery solution and must be identified during discovery are:

• The number of virtual machines to be replicated. This information will help you to determine the number and size of the replication jobs, as well as the replication performance and scalability, based on the number and type of virtual machines.

• The available bandwidth between locations. This information will help you to estimate the network bandwidth and throughput that are available for replication traffic, as well as the impact of replication activities on the network performance and latency.

• Which sites will be the source of replication and which sites will be the targets for recovery. This information will help you to plan and configure the replication infrastructure, such as the proxy servers, repository servers, WAN accelerators, and failover plans, based on the source and target locations.

The things that can be done to validate that the design meets target SLAs and reduces the headcount required to manage the solution are:

Use tagging and scripts to auto-generate backup jobs, set the start time and windows, letting the backup server manage resource allocation.  This option allows to automate the backup job creation and configuration, based on the tags assigned to the source objects, such as VMs, hosts, or clusters 1 .  This reduces the manual effort and human error involved in managing the backup jobs, and ensures that the backup server allocates the optimal resources for each job, based on the load balancing and performance settings 2 .

Explain how to detect configuration changes, reporting and using backup job templates to maintain consistency. Document self-service restore the streamline service desk engagement.  This option allows to monitor the backup infrastructure and detect any changes that may affect the backup performance or reliability, such as adding or removing VMs, hosts, or clusters 3 .  It also allows to use backup job templates to create consistent and standardized backup policies, and apply them to multiple backup jobs 4 .  Additionally, it allows to document the self-service restore process, which enables end-users to perform file-level restores from their own backups, without involving the backup administrator or the service desk 5 .

Review the design so that the slowest part of the infrastructure is fast enough to meet backup window requirements. This option allows to identify and optimize the bottleneck in the backup infrastructure, which is the component that limits the backup speed and throughput. By reviewing the design and ensuring that the slowest part of the infrastructure can meet the backup window requirements, the backup SLAs can be achieved and the backup performance can be improved.

The other options are either not relevant for validating the design (option A and E, as exporting the configuration, scheduling a review, and reviewing the design for bottlenecks are part of the design process, not the validation process) or not effective for meeting the SLAs and reducing the headcount (option C, as using inventory information, backup chaining, and fine tuning are manual and complex tasks that may not guarantee the backup window compliance or resource efficiency).  References:   Tagging ,  Load Balancing and Performance ,  Configuration Change Tracking ,  Backup Job Templates ,  Self-Service File Restore , [Bottleneck Statistics]

The configuration that is unsupported by Veeam Plug-in for Oracle RMAN based on the technical requirements is physical windows server with Oracle.  Veeam Plug-in for Oracle RMAN only supports Oracle databases running on Linux, Solaris, or AIX operating systems 1 . The other configurations are supported by either Veeam Plug-in for Oracle RMAN or Veeam Backup & Replication.  References:   Veeam Plug-in for Oracle RMAN ,  Oracle | Veeam Backup & Replication Best Practice Guide .

The component that will help the customer meet their stated objectives of role-based access control (RBAC) and alternative decryption capabilities is Veeam Backup Enterprise Manager. Veeam Backup Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides RBAC policies that enable granular control over user permissions and access to backup data. For example, you can assign different roles to different users or groups based on their responsibilities and needs, such as backup administrator, restore operator, security officer, etc. Veeam Backup Enterprise Manager also provides password loss protection feature that enables authorized users to restore encrypted backups without entering passwords if they forget or lose them.

The configuration that would verify the SLA compliance during audits and protection against exposure to personally identifiable information in the event of exposure is to create a virtual lab environment and periodically perform staged restores with custom scripts. A virtual lab is an isolated environment where you can run your backups or replicas without affecting the production environment. A staged restore is a process that allows you to run custom scripts on the restored data before publishing it to the production environment. By using these features, you can demonstrate that your backups are recoverable and compliant with legal regulations, as well as remove or mask any sensitive data before restoring it.

If the recovery point objective (RPO) of gold tier machines changes from one hour to three hours with daily retention set to seven days, the impact on the Veeam design is that proxies will require fewer resources. This is because the backup frequency and the number of restore points for gold tier machines will decrease, which means that less data will need to be processed and transferred by the proxies. Therefore, the proxies will have lower CPU, memory, disk, and network utilization and can handle more backup tasks with the same resources.

The assumption that can be made for the conceptual design is that Veeam Agent backups of sale staff laptops should be managed by the backup server. This assumption is based on the best practice and recommendation for using Veeam Backup & Replication. Veeam Agent backups of sale staff laptops should be managed by the backup server to enable centralized management, monitoring, and reporting of all agent-based backups. This can also simplify the backup configuration, scheduling, and retention for the laptop agents.

The factor that should be considered in the physical design when implementing backup copy jobs between sites is to use physical servers for the Veeam backup proxies at each site. A Veeam backup proxy is a data mover component that performs data processing and transfer tasks for backup and backup copy jobs. A physical server is preferred over a virtual server for better performance, reliability, and isolation. A physical server can also leverage hardware encryption offload to reduce CPU load and network traffic encryption to secure data in transit.

The retention requirement for gold tier virtual machines is that they must have 14 daily, eight weekly, three monthly and seven yearly backups. This requirement can be derived from the technical requirement of having eight weekly backups, three monthly backups, and seven yearly backups for regulatory purposes, as well as the business requirement of having daily backups for gold tier virtual machines.

A possible cause of failures to meet the requirement to test gold tier backups is that you cannot firewall traffic between vLANs in the SureBackup job configuration. This could prevent the gold tier virtual machines from communicating with each other or with other required services in the isolated virtual lab. For example, if a gold tier virtual machine needs to access a database server or a domain controller in another vLAN, it might fail to start or function properly in the SureBackup job. Therefore, it is important to ensure that all necessary vLANs and network settings are configured correctly in the SureBackup job.

The recommended storage option for the backups kept on-premises is a physical server with Veeam Hardened Repository. A Veeam Hardened Repository is a type of backup repository that provides immutability and ransomware protection for backup files by using Linux XFS file system features and Linux access control mechanisms. A physical server is preferred over a virtual server for better performance, security, and scalability. A Veeam Hardened Repository meets the customer’s requirements for compliance, security, and retention, as well as supports all backup types and features.

The best way to accomplish the recoverability testing of backup files for gold tier virtual machines to meet the customer’s requirements is to create a virtual lab in the customer’s environment, and then use SureBackup jobs to verify backups. A virtual lab is an isolated environment where you can run your backups or replicas without affecting the production environment. A SureBackup job is a process that allows you to automatically verify the recoverability of your backups by running them in a virtual lab. By using these features, you can ensure that your backups are consistent, functional, and compliant with SLAs and regulations.

The gold tier backup jobs have the most stringent recovery point objective (RPO) of one hour for image backup and 15 minutes for transaction log backup. This means that they need to run more frequently than the other backup jobs and create more restore points per day. Therefore, to properly plan the backup copy job settings, you will need more information on the gold tier backup jobs, such as the number of VMs, the size of backups, the change rate, the retention policy, and the bandwidth available for copying backups to the offsite location.

References: [Backup Copy], [Backup Methods] , [Continuous Data Protection]

The preferred method to achieve the requirement of excluding the H: drive on MSSQL server virtual machines is to set up VMDK exclusion for the disk on which the H: resides in the Virtual Machines > Exclusions page for each virtual machine. This method allows you to exclude specific virtual disks from being processed by backup jobs based on their SCSI IDs or disk labels. This can save backup time and storage space by skipping unnecessary data. This method also works reliably regardless of whether the MSSQL servers are built on demand or from virtual machine templates.

• Use Hardened Repositories as the primary target, which are Linux-based repositories that support immutability and prevent ransomware from accessing or deleting backup files12.

• Use backup copy jobs to create a second copy of the backups to a different site, which will provide additional protection and redundancy in case of a disaster or data loss34.

• Use Veeam Backup & Replication servers at one location, which will simplify the management and monitoring of the backup infrastructure and reduce the operational costs.

The other configurations are not as effective or secure, as they either do not use immutability, do not create a second copy of the backups, or do not leverage the benefits of Veeam Backup & Replication servers.

References: 1: Protect against Ransomware with Immutable Backups - Veeam 2: Hardened Repository - User Guide for VMware vSphere 3: Backup Copy Modes - User Guide for VMware vSphere 4: Backup copy jobs - Veeam Backup & Replication Best Practice Guide : Veeam Backup & Replication Architecture Overview

To access encrypted datastores in VMware, you need to use a transport mode that supports encryption. The following transport modes support encryption:

• Network mode with Encryption (NBDSSL): This mode uses an encrypted network connection between the backup proxy and the ESXi host to read and write data from the encrypted datastore. This mode does not require direct access to the datastore, but it can be slower than other modes due to network traffic and encryption overhead2

• Virtual Appliance (HotAdd) mode: This mode uses a virtual backup proxy that runs on an ESXi host and attaches virtual disks of the encrypted VMs to itself using the VMware vSphere API. This mode requires that the backup proxy and the source VMs reside on the same datastore or on datastores that are accessible by the same ESXi host. This mode can offer better performance than network mode, but it can also cause SCSI reservation conflicts if multiple backup proxies access the same datastore simultaneously3

• Direct SMB: This mode uses a physical backup proxy that accesses the encrypted datastore over the SMB protocol. This mode requires that the datastore is configured as an SMB share and that the backup proxy has read and write permissions on it. This mode can offer high performance and scalability, but it also requires additional configuration steps and security considerations4

The following transport modes do not support encryption:

• Network (NBD) mode: This mode uses an unencrypted network connection between the backup proxy and the ESXi host, which cannot access encrypted datastores2

• Direct SAN: This mode uses a physical backup proxy that accesses the encrypted datastore over the SAN fabric, which cannot decrypt encrypted data5

• Direct NFS: This mode uses a physical backup proxy that accesses the encrypted datastore over the NFS protocol, which does not support encryption6

References:

1: Hardened Repository - User Guide for VMware vSphere 2: Network Mode - User Guide for VMware vSphere 3: Virtual Appliance Mode - User Guide for VMware vSphere 4: Direct SMB Access Mode - User Guide for VMware vSphere 5: Direct SAN Access Mode - User Guide for VMware vSphere 6: Direct NFS Access Mode - User Guide for VMware vSphere

To design a solution that meets the immutability requirement for Veeam University Hospital, you need to consider how this constraint affects the other requirements and expectations of the customer. This will help you to avoid any conflicts or inconsistencies that may arise from applying immutability settings to the backup data.

According to the Veeam Backup & Replication Best Practice Guide, immutability is a feature that prevents backup files from being deleted or modified by anyone until the specified retention period expires. Immutability can be achieved by using S3 Object Lock or Hardened Repository, which are two different solutions that Veeam Backup & Replication supports.

Based on this definition, the requirement that is impacted by the immutability constraint is D. Backup must take advantage of public cloud storage for long-term retention.

This requirement is impacted by the immutability constraint because:

• Public cloud storage is a type of storage that is provided by a third-party service provider over the internet, such as Amazon S3, Microsoft Azure, Google Cloud, etc.

• Public cloud storage can be used for long-term retention, which is a policy that defines how long backup data should be kept for compliance or historical purposes, such as months, years, or decades.

• Public cloud storage can also support immutability, which is a feature that prevents backup data from being deleted or modified by anyone until the specified retention period expires, such as days, weeks, or months.

• However, not all public cloud storage providers or services support immutability, or support it in the same way. For example, Amazon S3 supports S3 Object Lock, which allows you to apply a legal hold or a retention period to individual objects or object versions. Microsoft Azure supports Immutable Blob Storage, which allows you to create time-based policies or legal holds for blob containers. Google Cloud supports Bucket Lock, which allows you to lock a bucket and prevent objects from being overwritten or deleted.

• Therefore, the choice of the public cloud storage provider or service may affect the immutability setting and requirement for the backup data. You need to verify and compare the compatibility and supportability of the public cloud storage providers or services with Veeam Backup & Replication and with the customer expectation.

Thank you for your question. I’m glad to help you with your VMCA 2022 project. ????

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to consider the impact and benefit of adding extra proxy servers to your backup infrastructure. This will help you to optimize the performance and efficiency of your backup and restore operations, as well as to prepare for future growth and expansion.

According to the web search results, a proxy server is a component that retrieves data from the source host, processes it and transfers to the backup repository. It also performs data compression, deduplication, encryption, etc. You can deploy backup proxies both in the primary site and in remote sites1.

The immediate result of adding the extra proxy server is A. The time for backup to complete could be reduced.

This result means that:

• The time for backup to complete is a metric that measures how long it takes to perform a backup job from start to finish. It depends on various factors, such as the size and type of data, the backup method and frequency, the network bandwidth and latency, etc.

• Adding an extra proxy server can reduce the time for backup to complete, by distributing the backup workload between available proxy servers. This can improve the backup performance and efficiency, as well as reduce the impact on the production environment.

• Reducing the time for backup to complete can also help you to meet your backup window and recovery point objective (RPO) requirements, as well as to free up more resources for other tasks or jobs.

To design a solution that meets the backup retention requirements for Veeam University Hospital, you need to consider the minimum requirement for on-premises backup retention for this project. This will help you to ensure the availability and reliability of your backup data, as well as the compliance and security of your backup storage.

According to the case study, the minimum requirement for on-premises backup retention for this project is B. On-premises retention must be 14 daily, and two weekly backups.

This requirement means that:

• The on-premises backup retention is the policy that defines how long the backup data should be kept on the local backup storage, such as NFS storage, deduplication appliance, etc.

• The on-premises backup retention must be 14 daily and two weekly backups, which means that you need to keep at least 14 copies of the daily backups and two copies of the weekly backups on the local backup storage.

• The on-premises backup retention must be applied to all types of workloads that are backed up by Veeam Backup & Replication, such as virtual machines, physical servers, NAS systems, etc.

This requirement is based on the business and compliance needs of Veeam University Hospital, which are:

• To have a fast and reliable restore option for the most recent backups in case of a disaster or failure.

• To comply with the HIPAA regulations that require health care organizations to retain backup data for at least six years1.

Thank you for your question. I’m glad to help you with your VMCA 2022 project. ????

To design a solution that meets the database requirements for Veeam University Hospital, you need to consider some of the options and features that can support and integrate with Oracle databases. This will help you to ensure the consistency and reliability of the Oracle backups and restores, as well as the compatibility and supportability of the native Oracle tools with Veeam products and features.

According to the Veeam Backup & Replication Best Practice Guide, the option that most closely matches the requirements of having native Oracle utilities available for backups and restores is D. Install the Veeam RMAN Plug-in to allow native RMAN backups and restores to leverage Veeam repository directly from the Oracle servers.

This option means that:

• The Veeam RMAN Plug-in is a solution that integrates with Oracle Recovery Manager (RMAN) and allows you to back up and restore Oracle databases using Veeam repositories as targets.

• The Veeam RMAN Plug-in supports both virtual and physical Oracle servers, as well as different versions and editions of Oracle databases.

• The Veeam RMAN Plug-in enables you to use native Oracle tools and commands, such as RMAN, SQL*Plus, Data Pump, etc., to perform backups and restores of Oracle databases, without requiring any additional scripts or configurations.

• The Veeam RMAN Plug-in leverages the benefits and features of Veeam Backup & Replication, such as backup compression, deduplication, encryption, immutability, etc., to improve the backup performance and efficiency, as well as the backup security and integrity.

This option is the best match for the requirements, as it allows you to use native Oracle utilities for backups and restores, while also taking advantage of Veeam products and features.