VMCA2022 Practice Exam Questions with Answers Veeam Certified Architect 2022 Certification

The Gateway Server is a component that acts as a data mover between the backup proxy and the NFS storage. By placing the backup proxy and the Gateway Server together at the source site, you can reduce the network traffic and latency between them, and improve the data transfer speed. The Gateway Server will read data from the NFS storage and send it to the backup proxy over a local connection, and the backup proxy will process and compress the data before sending it to the target site1

•Veeam CDP is a technology that helps you protect mission-critical VMware virtual machines when data loss for seconds or minutes is unacceptable12.

•Veeam CDP leverages vSphere APIs for I/O filtering (VAIO) to constantly replicate I/O operations performed on VMs without creating snapshots12.

•Veeam CDP allows you to configure the RPO per second and achieve near-zero RPO, which means almost no data loss12.

•Veeam CDP also provides minimum recovery time objective (RTO) in case of a disaster, as CDP replicas are in a ready-to-start state1.

Veeam image-based replication is not the best option, as it relies on snapshots and has a higher RPO than CDP3. Custom PowerShell scripting is not a reliable or scalable solution, as it requires manual coding and maintenance. Veeam Backup Copy with immediate mode is not suitable for replication, as it is designed for copying backup files, not VM replicas4.

References: 1: Continuous Data Protection (CDP) - User Guide for VMware vSphere 2: Veeam v11: Continuous Data Protection (CDP) configuration 3: Replication - User Guide for VMware vSphere 4: Backup Copy Modes - User Guide for VMware vSphere

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to consider some of the risks and challenges that may affect the success and quality of the project. This will help you to identify and mitigate any potential issues or errors that may arise during the implementation or operation of the solution.

According to the Veeam Backup & Replication Best Practice Guide, a risk is a factor that may negatively impact the performance, reliability, security, or functionality of the backup and replication solution. A risk may be caused by internal or external factors, such as technical limitations, environmental constraints, human errors, etc.

Based on this definition, one of the possible risks for this project is C. Data must be replicated with one-hour recovery point objective.

This risk means that:

•The recovery point objective (RPO) is a business requirement that defines the maximum acceptable amount of data loss in case of a disaster or failure. It is measured in time units, such as minutes, hours, or days.

•The data replication is a technical solution that allows you to create replicas of your running workloads on another host or site. It is used for disaster recovery purposes, as it enables you to quickly fail over and fail back in case of a disaster.

•The one-hour RPO is a challenging and demanding requirement that may be difficult toachieve or maintain, depending on various factors, such as the data change rate, the available bandwidth, the replication frequency, etc.

•The one-hour RPO may also conflict or contradict with other requirements or expectations, such as the backup window, the backup retention, the backup storage capacity, etc.

This risk has some implications for designing a solution with Veeam products and features, such as:

•The customer or a third-party vendor must monitor and measure the data change rate of the workloads that need to be replicated, as well as the available bandwidth between sites. This will help to plan and optimize the replication infrastructure, such as the proxy servers, repository servers, WAN accelerators, and failover plans, based on the data change rate.

•The customer or a third-party vendor must configure and adjust the replication settings and policies, such as the replication method, schedule, frequency, retention, compression, deduplication, etc., based on the one-hour RPO. This will help to improve the replication performance and efficiency, as well as to meet the RPO requirement.

•The customer or a third-party vendor must test and verify the replication results and processes, as well as perform regular failover and failback drills. This will help to ensure the reliability and consistency of the replicas, as well as to validate and improve the RPO achievement.

To design a solution that meets the requirements for off-site immutable backups for Veeam University Hospital, you need to consider some of the options and features that Veeam products and features offer. This will help you to ensure the security and integrity of your backup data, as well as the compatibility and supportability of the cloud provider that does not currently support immutability.

According to the Veeam Backup & Replication Best Practice Guide, immutability is a feature that prevents backup files from being deleted or modified by anyone until the specified retention period expires. Immutability can be achieved by using S3 Object Lock or Hardened Repository, which are two different solutions that Veeam Backup & Replication supports.

Based on this definition, the best option to still satisfy the requirements for off-site immutable backups is A. Backup copy to a hardened repository.

This option means that:

•The backup copy is a type of job that allows you to create and maintain copies of your backup data on a secondary backup repository. You can use backup copy jobs to send your backup data off-site, as well as to apply different retention settings and policies.

•The hardened repository is a solution that allows you to add a hardened repository based on a Linux server to your backup infrastructure. You can use hardened repository with Veeam Backup & Replication to make your backups immutable on-premises or off-site.

•The backup copy to a hardened repository can be configured and managed by Veeam Backup & Replication, regardless of the cloud provider that does not currently support immutability. You only need to deploy and connect a Linux server with a hardened repository in the cloud environment, and then use it as a target for your backup copy jobs.

Veeam University Hospital is considering using Veeam ONE to collect alarms from the virtual and backup infrastructure. Veeam ONE is a powerful monitoring and reporting tool that provides visibility and insight into the performance, configuration, and utilization of your backup and virtual infrastructure. Veeam ONE can also alert you about any issues or problems that may affect the availability or reliability of your data protection and recovery processes.

One of the options that is available for integrating Veeam ONE with ticketing systems is A. Configure Veeam ONE to send SNMP traps to the ticketing system.

This option means that:

•SNMP (Simple Network Management Protocol) is a protocol that allows network devices to communicate and exchange information with each other.

•SNMP traps are messages that are sent by network devices to notify a management system about events or conditions that require attention or action.

•Veeam ONE can be configured to send SNMP traps to a ticketing system when an alarm is triggered or resolved. This allows you to automate the creation and update of tickets based on the alarm data, such as the alarm name, severity, status, description, etc.

•To configure Veeam ONE to send SNMP traps to a ticketing system, you need to enable SNMP notifications in the Veeam ONE settings, as well as specify the SNMP server address, port, community string, and trap format. You also need to configure the ticketing system to receive and process the SNMP traps from Veeam ONE.

This option is a good choice for integrating Veeam ONE with ticketing systems, as it allows you to leverage the benefits and features of both solutions, such as:

•You can use Veeam ONE to monitor and analyze your backup and virtual infrastructure, as well as to detect and alert you about any issues or problems that may affect your data protection and recovery processes.

•You can use the ticketing system to manage and track the resolution of the issues or problems that are reported by Veeam ONE, as well as to assign and prioritize tickets to the appropriate staff or team members.

According to the Veeam Backup & Replication Best Practice Guide1, the proxy and repository servers are the components that should be sized correctly to ensure that synthetic operations and backup copy jobs can be completed in the desired window. This is because:

•The proxy server is responsible for retrieving data from the source and sending it to the target. The proxy server performance depends on the CPU, memory, network, and storage resources available. The proxy server should have enough CPU cores and memory to handle concurrent tasks, as well as sufficient network bandwidth and storage throughput to transfer data efficiently.

•The repository server is responsible for storing backup files on the target storage. The repository server performance depends on the CPU, memory, network, and storage resources available. The repository server should have enough CPU cores and memory to handle concurrent tasks, as well as sufficient network bandwidth and storage throughput to write data efficiently. The repository server should also support the backup format and retention policy chosen for the backup copy job.

References: 1: Backup copy jobs - Veeam Backup & Replication Best Practice Guide

Changing the backup window from 12 hours to 14 hours means that the backup jobs will have more time to complete, and therefore less concurrency will be required. This will reduce the load on the proxies, which are the data movers that perform backup, replication, and restore tasks1. The proxies will need fewer resources, such as CPU and memory, to handle the same amount of data.

The other options are incorrect because:

• A) Proxies will not require more resources, as explained above.
• B) Mount servers will not require fewer resources, as they are not affected by the backup window. Mount servers are used to mount backup files and restore data from them2. Their resource consumption depends on the restore frequency and performance, not the backup window.
• D) Repositories will not require more storage space, as the backup window does not affect the backup size. Repositories are storage locations where the backup files are stored3. Their storage space consumption depends on the amount of data to be backed up, the backup method, the retention policy, and the compression and deduplication settings, not the backup window.

You can find more information about the backup window and the Veeam components in the following resources:

• Backup Window
• Mount Server
• Backup Repository

The retention requirement for this project is 12 weekly backups, six monthly backups and seven yearly backups. This is stated in the business requirements section of the scenario, where it says “To meet regulatory requirements, backups must be retained for four years.” This implies that the backup data must be archived for long-term retention, and the Veeam solution supports the 3-2-1 rule, which means having three copies of data, on two different types of media, with one copy off-site1. The other options are not retention requirements, but rather technical requirements or design choices, such as having on-premises backups on hardened repositories, having at least one copy of data on-premises, or having 14 daily backups on-site. References: Veeam Certified Architect 2022 Exam Guide, page 9; Veeam Backup & Replication v11: Architecture and Design course, module 4.

The best way to accomplish the goal of ensuring backups are free of malware before data is restored is to ensure a compatible antivirus solution is available on mount servers for secure restores. Secure restore is a feature of Veeam Backup & Replication that allows you to scan backup files for malware before performing a restore operation, using a built-in or third-party antivirus solution1. Mount servers are components of Veeam Backup & Replication that mount backup files to the backup server or backup proxy2. By having a compatible antivirus solution on mount servers, you can leverage the secure restore feature to check the backup data for malware and prevent any infection from spreading to the production environment. The other options are either not feasible (option A and B, as staged restore and Veeam Data Integration API are not designed for malware detection34) or not sufficient (option C, as Veeam Data Integration API alone cannot scan backup files for malware). References: Secure Restore, Mount Servers, Staged Restore, Veeam Data Integration API.

Snapshot stun is a phenomenon that occurs when a VMware snapshot is removed and the virtual machine (VM) experiences a temporary freeze or performance degradation1. This can affect the availability and consistency of mission critical applications running on the VM.

To avoid snapshot stun, Veeam Backup & Replication offers several options for backing up Linux VMs, such as backup from storage snapshots, direct SAN access, or hot-add2. However, based on the business requirements, the best option is to run pre-freeze and post-thaw scripts before backing up the workload.

Pre-freeze and post-thaw scripts are custom scripts that you can configure to run on the Linux VM before and after the snapshot is taken. The pre-freeze script can be used to quiesce the application and flush its data to disk, ensuring a consistent backup. The post-thaw script can be used to resume the application and perform any necessary cleanup actions3.

By using pre-freeze and post-thaw scripts, you can achieve application consistency and minimize the impact of snapshot stun on the Linux VM. You can use the Veeam Backup & Replication user interface or the Veeam PowerShell snap-in to configure the scripts for the backup job3.

You can find more information about pre-freeze and post-thaw scripts and how to use them in the following resources:

• Pre-Freeze and Post-Thaw Scripts
• Best Practice for Backing Up Linux VMs
• Snapshot Stun Issue

The component that will help the customer meet their stated objectives is to leverage Backup Enterprise Manager to allow end-users to restore files within their scope. Backup Enterprise Manager is a web-based interface that provides access to Veeam Backup & Replication functionality, such as backup, replication, and restore1. One of the customer’s business requirements is to develop a self-service portal and integrate it with the new backup solution. Backup Enterprise Manager can fulfill this requirement by enabling self-service file-level restores for end-users, as well as integration with help desk systems2. The other options are not related to the customer’s recovery requirements, as they are either not necessary (option A, as indexing and RBAC policies are optional features), not sufficient (option B, as deploying the console and setting RBAC policies do not enable self-service restores), or not native to Veeam software (option C, as the technical requirements state that Oracle backups must be managed by Veeam, not RMAN). References: Backup Enterprise Manager, Self-Service File Restore.

The information related to the virtual infrastructure that is missing and must be collected during the discovery are the total number of virtual machines and the size of the source data set. These are essential metrics for sizing the backup components, such as proxies, repositories, and transporters, as well as estimating the backup storage requirements and bandwidth consumption. The other options are either already provided in the scenario (recovery time objective, backup window) or not relevant for the Veeam solution (speed of Fibre Channel fabric). References: Veeam Certified Architect 2022 Exam Guide, page 10; Veeam Backup & Replication v11: Architecture and Design course, module 3.

The information that is still needed for a complete architectural design is how often backups are required for silver machines. This is not stated in the technical requirements, where only the recovery time objective and recovery point objective are given for the silver tier. The backup frequency affects the backup storage consumption, the backup window, and the restore point granularity. The other options are either already provided in the technical requirements (daily backup retention, amount of time required for a successful restore for gold machine) or not relevant for the architectural design (RMAN configuration guidelines). References: Veeam Certified Architect 2022 Exam Guide, page 10; Veeam Backup & Replication v11: Architecture and Design course, module 4.

The additional information that is necessary for sizing the backup solution and must be gathered during further discovery are the amount of virtual machines to be protected and the total amount of production storage provisioned space. These metrics are used to calculate the backup storage requirements, the backup proxy and transporter resources, and the backup job configuration. The other options are either not relevant for sizing the backup solution (repository storage file system, replication schedule) or already provided in the scenario (the available bandwidth per site). References: Veeam Certified Architect 2022 Exam Guide, page 10; Veeam Backup & Replication v11: Architecture and Designcourse, module 3.

Immutable repositories are backup storage locations that prevent unauthorized modifications or deletions of backup data, ensuring its integrity and recoverability. Immutable repositories are essential for protecting backups against ransomware attacks, accidental deletions, or malicious insiders1.

Veeam Backup & Replication supports several types of immutable repositories, such as hardened repositories, immutable object storage repositories, and immutable deduplicating storage appliances2. Among these options, the best configuration for ensuring SLA compliance and providing protection against ransomware is to leverage hardened repositories at both primary and secondary sites, and offload to object storage in a public cloud with immutability enabled.

Hardened repositories are Linux-based repositories that use XFS file system with immutability flag to protect backup files from changes or removals. Hardened repositories can be used as primary or secondary backup targets, and can be combined with Veeam Scale-out Backup Repository to simplify backup management and optimize storage utilization3.

Object storage repositories are cloud-based repositories that use object storage services, such as Amazon S3, Microsoft Azure Blob Storage, or Google Cloud Storage, to store backup data. Object storage repositories can be used as secondary backup targets, and can leverage the immutability feature of the cloud provider to prevent backup data from being overwritten or deleted.

By using hardened repositories at both primary and secondary sites, you can achieve high availability and redundancy for your backup data, as well as fast and reliable restores. By offloading to object storage in a public cloud with immutability enabled, you can achieve long-term retention and compliance, aswell as cost savings and scalability. This configuration also follows the 3-2-1-1 backup rule, which recommends having three copies of data, on two different types of media, with one copy off-site and one copy immutable.

You can find more information about immutable repositories and how to configure them in the following resources:

• Immutable Backup Solutions: Linux Hardened Repository
• Unstructured Data Backups in Immutable Repositories
• Hardened Repository
• [Immutability for Object Storage Repositories]
• [3-2-1-1 Backup Rule]

The requirement C will act as a constraint on the decision of whether to use a local repository or not for the remote sites. Data locality and privacy laws may vary by country or region, and may impose restrictions on where the backup data can be stored or transferred. For example, some countries may prohibit the export of personal data outside their borders, or require encryption or anonymization of sensitive data. Therefore, the Veeam solution must comply with these laws and regulations, and may need to use a local repository for each remote site, or use a cloud provider that has a local presence in each region. The other requirements are not constraints, as they can be met with either a local or a central repository, using the features and options of the Veeam solution. References: Veeam Certified Architect 2022 Exam Guide, page 11; Veeam Backup & Replication v11: Architecture and Design course, module 5.

Backup from Storage Snapshots and Direct NFS are the preferred processing modes for NFS datastores, as they offer the best performance and reliability for backup and restore operations12.

Backup from Storage Snapshots is a feature of Veeam Backup & Replication that leverages the native snapshot capabilities of the storage system to create a consistent point-in-time copy of the VM data. Veeam Backup & Replication then reads data directly from the storage snapshot, bypassing the ESXi host and reducing the impact on the production environment3. Backup from Storage Snapshots is supported for NFS datastores on NetApp, Nimble, Dell EMC, HPE, and Pure Storage systems4.

Direct NFS is a proprietary transport mode of Veeam Backup & Replication that uses a native NFS client deployed on the backup proxy to read and write data directly from and to the NFS datastore. Veeam Backup & Replication also bypasses the ESXi host and reduces the load on the production environment. Direct NFS is supported for NFS datastores on any storage system that supports NFS version 3 or 4.1.

The other options are not preferred because:

• B) Network (NBD) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network. This mode produces additional load on the ESXi host and the network, and may result in slower backup and restore performance.
• C) Virtual Appliance (HotAdd) mode is a transport mode that uses the VMware VDDK to attach the disks of the processed VM to the backup proxy VM. This mode also produces additional load on the ESXi host and the network, and may cause issues with disk alignment or SCSI controller limitations.
• D) Network mode with Encryption (NBDSSL) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network with SSL encryption. This mode provides an extra layer of security, but also adds more overhead and reduces the backup and restore performance.

You can find more information about the processing modes and how to choose the best one for your environment in the following resources:

• Transport Modes
• Selecting a Transport Mode
• Backup from Storage Snapshots
• Storage Systems Supported for Backup from Storage Snapshots
• [Direct NFS Access]
• [Network Mode]
• [Virtual Appliance Mode]
• [Network Mode with Encryption]

The assumption that can be made for the conceptual design is that Veeam Agent backups of sale staff laptops should be managed by the backup server. This assumption is based on the best practice and recommendation for using Veeam Backup & Replication. Veeam Agent backups of sale staff laptops should be managed by the backup server to enable centralized management, monitoring, and reporting of all agent-based backups. This can also simplify the backup configuration, scheduling, and retention for the laptop agents.

The best way to accomplish the recoverability testing of backup files for gold tier virtual machines to meet the customer’s requirements is to create a virtual lab in the customer’s environment, and then use SureBackup jobs to verify backups. A virtual lab is an isolated environment where you can run your backups or replicas without affecting the production environment. A SureBackup job is a process that allows you to automatically verify the recoverability of your backups by running them in a virtual lab. By using these features, you can ensure that your backups are consistent, functional, and compliant with SLAs and regulations.

The steps that should be taken to correct the storage configuration based on the customer’s hardening requirements are to add hardened repositories to each Scale-out Backup Repository and evacuate the data from the CIFS extents. A hardened repository is a type of backup repository that provides immutability and ransomware protection for backup files by using Linux XFS file system features and Linux access control mechanisms. A Scale-out Backup Repository is a logical entity that groups several backup repositories into one pool of storage. A CIFS extent is a type of backup repository that uses a shared folder on a Windows or Linux server as a backup target. By adding hardened repositories to each Scale-out Backup Repository, you can ensure that your backups are secure, compliant, and efficient. By evacuating the data from the CIFS extents, you can remove the risk of ransomware infection or deletion of your backups.

The retention requirement for gold tier virtual machines is that they must have 14 daily, eight weekly, three monthly and seven yearly backups. This requirement can be derived from the technical requirement of having eight weekly backups, three monthly backups, and seven yearly backups for regulatory purposes, as well as the business requirement of having daily backups for gold tier virtual machines.

The action that Veeam Life and Indemnity should take to improve the likelihood that a ransomware attack on the Veeam infrastructure will not be successful is to protect the Veeam components on the production Active Directory Forest with multi-factor authentication. Multi-factor authentication (MFA) is a security mechanism that requires users to provide two or more pieces of evidence to prove their identity before accessing a system or resource. MFA can prevent unauthorized access to the Veeam components even if the user credentials are compromised by ransomware or other means.

The best way to configure backups for a group of MSSQL systems running in an Always-On cluster and sensitive to virtual machine stun is to deploy Veeam agents configured for failover clustering. Veeam agents can provide application-aware processing and transaction log backup for MSSQL servers, as well as support for failover clustering and cluster shared volumes. Veeam agents can also reduce the impact of virtual machine stun by performing backups at the guest OS level, without using VMware snapshots.

The recommended storage option for the backups kept on-premises is a physical server with Veeam Hardened Repository. A Veeam Hardened Repository is a type of backup repository that provides immutability and ransomware protection for backup files by using Linux XFS file system features and Linux access control mechanisms. A physical server is preferred over a virtual server for better performance, security, and scalability. A Veeam Hardened Repository meets the customer’s requirements for compliance, security, and retention, as well as supports all backup types and features.

The additional information that is needed to define the implementation process later is how much backup data is stored on the old hardware. This information is important for designing and sizing the migration strategy and timeline for moving the backups from the old hardware to the new hardware. For example, you can use the amount of backup data to estimate how long it will take to copy or move the backups to the new storage devices. You can also use the amount of backup data to determine whether you need to use compression, deduplication, or WAN acceleration to optimize the migration traffic.

References: [Migrating Backup Files], [WAN Acceleration]

If the repositories are able to accomplish much higher throughput, a new issue that might come up is that the bandwidth between sites might not be sufficient to support the backup copy jobs that need to run daily between Fresno and Carson City. This could cause the backup copy jobs to fail, take longer than expected, or consume too much network resources. Therefore, it is important to measure the available bandwidth between the sites and compare it with the backup copy data size and window. If the bandwidth is not sufficient, some possible solutions are to use compression, deduplication, or WAN acceleration to reduce the backup copy traffic.