VMCA2022 Practice Exam Questions with Answers Veeam Certified Architect 2022 Certification

Changing the backup window from 12 hours to 14 hours means that the backup jobs will have more time to complete, and therefore less concurrency will be required. This will reduce the load on the proxies, which are the data movers that perform backup, replication, and restore tasks1. The proxies will need fewer resources, such as CPU and memory, to handle the same amount of data.

The other options are incorrect because:

• A) Proxies will not require more resources, as explained above.
• B) Mount servers will not require fewer resources, as they are not affected by the backup window. Mount servers are used to mount backup files and restore data from them2. Their resource consumption depends on the restore frequency and performance, not the backup window.
• D) Repositories will not require more storage space, as the backup window does not affect the backup size. Repositories are storage locations where the backup files are stored3. Their storage space consumption depends on the amount of data to be backed up, the backup method, the retention policy, and the compression and deduplication settings, not the backup window.

You can find more information about the backup window and the Veeam components in the following resources:

• Backup Window
• Mount Server
• Backup Repository

The component sizing that should be adjusted is the physical storage in the repositories. The repositories are the backup storage locations where Veeam Backup & Replication stores backup files, VM copies and metadata for replicated VMs1. Increasing the retention period from four to five years means that more backup files will be kept on the repositories, and thus more storage space will be required. The other options are not affected by the retention period change, as they are either related to off-site backups (option A), Veeam Backup & Replication server performance (option C), or backup proxy performance (option D). References: Backup Repositories.

The tiers of Veeam Financial Services’ backups that will require SureBackup jobs are the silver and gold tiers. SureBackup jobs are used to verify the recoverability of backup files by running virtual machines from backups in an isolated environment and performing tests against live applications1. This feature is suitable for the silver and gold tiers, which have recovery time objectives of six hours and 30 minutes, respectively, and require backups to be verified. The bronze tier, which consists of development machines and field portables, has a recovery point target of seven days, with no recovery time target set, and does not require backup verification. Therefore, SureBackup jobs are not necessary for the bronze tier. Laptop backups are performed by Veeam Agent for Microsoft Windows, which does not support SureBackup jobs2. References: SureBackup, Veeam Agent for Microsoft Windows.

The best way to accomplish the goal of ensuring backups are free of malware before data is restored is to ensure a compatible antivirus solution is available on mount servers for secure restores. Secure restore is a feature of Veeam Backup & Replication that allows you to scan backup files for malware before performing a restore operation, using a built-in or third-party antivirus solution1. Mount servers are components of Veeam Backup & Replication that mount backup files to the backup server or backup proxy2. By having a compatible antivirus solution on mount servers, you can leverage the secure restore feature to check the backup data for malware and prevent any infection from spreading to the production environment. The other options are either not feasible (option A and B, as staged restore and Veeam Data Integration API are not designed for malware detection34) or not sufficient (option C, as Veeam Data Integration API alone cannot scan backup files for malware). References: Secure Restore, Mount Servers, Staged Restore, Veeam Data Integration API.

The number of vSphere clusters and the total of virtual machines are important information related to the virtual infrastructure that are missing and must be collected during the discovery phase. These information can help you estimate the backup performance, scalability, and resource requirements for the Veeam backup infrastructure. For example, you can use the number of vSphere clusters to determine how many Veeam backup servers and proxies you need to deploy and how to distribute the backup load among them. You can also use the total of virtual machines to calculate the total amount of data to be backed up, the storage space required, and the network bandwidth needed.

References: [Veeam Backup & Replication Best Practices], [Veeam Backup Infrastructure Sizing Calculator]

The additional information that is necessary for sizing the backup solution and must be gathered during further discovery are the amount of virtual machines to be protected and the total amount of production storage provisioned space. These metrics are used to calculate the backup storage requirements, the backup proxy and transporter resources, and the backup job configuration. The other options are either not relevant for sizing the backup solution (repository storage file system, replication schedule) or already provided in the scenario (the available bandwidth per site). References: Veeam Certified Architect 2022 Exam Guide, page 10; Veeam Backup & Replication v11: Architecture and Designcourse, module 3.

The reason that justifies the decision to separate out proxies for gold tier and silver/bronze tier is that gold tier virtual machines run frequently and should not share resources with lower priority virtual machines. This is because gold tier virtual machines have a high RPO of one hour or less, which means that they need to run backup jobs more often than silver/bronze tier virtual machines. Therefore, they should have dedicated proxies that can process their data without competing with other backup jobs for proxy resources. This can improve backup performance, reliability, and scalability for gold tier virtual machines.

The backup repository design that would meet the security, throughput, and retention requirements is to use backup jobs to Hardened Linux XFS-based repositories at the same site as the source data and use Backup copy jobs to Hardened Linux XFS-based repositories at the secondary site. A Hardened Linux repository is a type of backup repository that provides immutability and ransomware protection for backup files by using XFS file system features and Linux access control mechanisms. A Backup copy job is a type of backup job that copies backups from one repository to another, either on-site or off-site, with different retention settings. By using these features, you can ensure that your backups are secure, efficient, and compliant with regulatory and business needs.

The method that can be used to validate that the design meets target SLAs and does not exceed repository growth projections is to ensure job throughput matches extensions and cross-compare with available network throughput, disk speed and initial sizing calculations. Job throughput is the measure of how much data is processed and transferred by a backup job per unit of time. Job throughput can be affected by various factors such as network bandwidth, disk performance, compression, deduplication, encryption, etc. By ensuring job throughput matches extensions, you can verify that your backup jobs are running as expected and meeting the SLAs. By cross-comparing job throughput with available network throughput, disk speed and initial sizing calculations, you can identify any bottlenecks or discrepancies that might affect your backup performance or storage consumption.

The recommended method to replicate VMware virtual machines with a less than five-minute RPO is Veeam Continuous Data Protection (CDP). CDP is a feature that allows near-continuous replication of VMware virtual machines to a secondary site or cluster with minimal data loss and downtime. CDP uses VMware vSphere APIs for I/O Filtering (VAIO) to capture every write operation from the source VMs and send them to the target VMs in near real-time. CDP can achieve RPOs as low as seconds and enable fast failover and failback in case of a disaster.

A possible cause of failures to meet the requirement to test gold tier backups is that you cannot firewall traffic between vLANs in the SureBackup job configuration. This could prevent the gold tier virtual machines from communicating with each other or with other required services in the isolated virtual lab. For example, if a gold tier virtual machine needs to access a database server or a domain controller in another vLAN, it might fail to start or function properly in the SureBackup job. Therefore, it is important to ensure that all necessary vLANs and network settings are configured correctly in the SureBackup job.

The direct risk of having Veeam Backup & Replication on the production domain is that a compromised Domain Admin could gain access to the backup server and its data. This could pose a serious security threat to the backup infrastructure and the customer data, as a malicious Domain Admin could delete, modify, or encrypt the backups, or restore them to a compromised environment. Therefore, it is recommended to isolate the backup server from the production domain and use a separate local administrator account for managing it.

The types of jobs that do not support using immutability from S3 Object Lock or hardened repositories are NAS backups and Agent for Mac backups. These types of jobs do not have the option to enable immutability in their settings, unlike VMware, Hyper-V, Linux Agent, or Windows Agent backup jobs. Therefore, they cannot leverage the immutability feature of S3 Object Lock or hardened repositories to protect their backups from ransomware or malicious deletion.

References: [S3 Object Lock Immutability], [Hardened Linux Repository], [NAS Backup], [Agent for Mac]

The steps that should be taken to correct the storage configuration based on the customer’s hardening requirements are to add hardened repositories to each Scale-out Backup Repository and evacuate the data from the CIFS extents. A hardened repository is a type of backup repository that provides immutability and ransomware protection for backup files by using Linux XFS file system features and Linux access control mechanisms. A Scale-out Backup Repository is a logical entity that groups several backup repositories into one pool of storage. A CIFS extent is a type of backup repository that uses a shared folder on a Windows or Linux server as a backup target. By adding hardened repositories to each Scale-out Backup Repository, you can ensure that your backups are secure, compliant, and efficient. By evacuating the data from the CIFS extents, you can remove the risk of ransomware infection or deletion of your backups.

If the recovery point objective (RPO) of gold tier machines changes from one hour to three hours with daily retention set to seven days, the impact on the Veeam design is that proxies will require fewer resources. This is because the backup frequency and the number of restore points for gold tier machines will decrease, which means that less data will need to be processed and transferred by the proxies. Therefore, the proxies will have lower CPU, memory, disk, and network utilization and can handle more backup tasks with the same resources.

If the repositories are able to accomplish much higher throughput, a new issue that might come up is that the bandwidth between sites might not be sufficient to support the backup copy jobs that need to run daily between Fresno and Carson City. This could cause the backup copy jobs to fail, take longer than expected, or consume too much network resources. Therefore, it is important to measure the available bandwidth between the sites and compare it with the backup copy data size and window. If the bandwidth is not sufficient, some possible solutions are to use compression, deduplication, or WAN acceleration to reduce the backup copy traffic.

To design a disaster recovery solution that meets the requirement of having the replicated virtual workloads data not more than one hour old, you need to consider some of the potential risks and challenges that may affect the service level agreement (SLA) for the offsite disaster recovery aspect of this requirement. This will help you to ensure the availability and reliability of the replication and failover processes, as well as the recovery time objective (RTO) and recovery point objective (RPO) of the organization.

According to the Veeam Backup & Replication Best Practice Guide, one of the potential risks to the SLA for the offsite disaster recovery aspect of this requirement is B. Data change rate.

This risk means that:

•The data change rate is the amount of data that is modified, added, or deleted in a given time period. It is usually measured in percentage or megabytes per hour.

•The data change rate affects the replication performance and efficiency, as it determines how much data needs to be transferred and processed between the source and target sites.

•The data change rate also affects the replication frequency and consistency, as it determines how often and how accurately the replicas are updated and synchronized with the source workloads.

•The data change rate may vary depending on the type and activity of the workloads, such as database, file server, web server, etc. Some workloads may have a high data change rate, while others may have a low data change rate.

•The data change rate may exceed the available bandwidth or storage capacity between the source and target sites, which may result in replication failures, delays, or errors. This may compromise the SLA for the offsite disaster recovery aspect of this requirement, as it may cause the replicated virtual workloads data to be more than one hour old.

This risk has some implications for designing a solution with Veeam products and features, such as:

•The customer or a third-party vendor must monitor and measure the data change rate of the workloads that need to be replicated, as well as the available bandwidth and storage capacity between the source and target sites. This will help to plan and optimize the replication infrastructure, such as the proxy servers, repository servers, WAN accelerators, and failover plans, based on the data change rate.

•The customer or a third-party vendor must configure and adjust the replication settings and policies, such as the replication method, schedule, frequency, retention, compression, deduplication, etc., based on the data change rate. This will help to improve the replication performance and efficiency, as well as to meet the SLA for the offsite disaster recovery aspect of this requirement.

Option A follows the 3-2-1 rule by having three copies of data (the original production data, the backup at the primary site, and the backup copy at the secondary site), two different media types (local disk and object storage), and one copy off-site (the backup copy at the secondary site). This option also reduces the amount of traffic sent over the network by using existing backups as seeds for backup copies, and reduces the storage costs by using cloud tier to move older backups to cheaper and unlimited cloud storage1

To make backup files immutable in a Scale-out Backup Repository, you need to use XFS extents with the reflink attribute enabled. This attribute allows Veeam Backup & Replication to create immutable backup files using the fast clone technology. If some of the XFS extents do not have this attribute enabled, they will not support immutability and the backup files stored on them will not be protected from deletion or modification1

To access encrypted datastores in VMware, you need to use a transport mode that supports encryption. The following transport modes support encryption:

•Network mode with Encryption (NBDSSL): This mode uses an encrypted network connection between the backup proxy and the ESXi host to read and write data from the encrypted datastore. This mode does not require direct access to the datastore, but it can be slower than other modes due to network traffic and encryption overhead2

•Virtual Appliance (HotAdd) mode: This mode uses a virtual backup proxy that runs on an ESXi host and attaches virtual disks of the encrypted VMs to itself using the VMware vSphere API. This mode requires that the backup proxy and the source VMs reside on the same datastore or on datastores that are accessible by the same ESXi host. This mode can offer better performance than network mode, but it can also cause SCSI reservation conflicts if multiple backup proxies access the same datastore simultaneously3

•Direct SMB: This mode uses a physical backup proxy that accesses the encrypted datastore over the SMB protocol. This mode requires that the datastore is configured as an SMB share and that the backup proxy has read and write permissions on it. This mode can offer high performance and scalability, but it also requires additional configuration steps and security considerations4

The following transport modes do not support encryption:

•Network (NBD) mode: This mode uses an unencrypted network connection between the backup proxy and the ESXi host, which cannot access encrypted datastores2

•Direct SAN: This mode uses a physical backup proxy that accesses the encrypted datastore over the SAN fabric, which cannot decrypt encrypted data5

•Direct NFS: This mode uses a physical backup proxy that accesses the encrypted datastore over the NFS protocol, which does not support encryption6

References:

1: Hardened Repository - User Guide for VMware vSphere 2: Network Mode - User Guide for VMware vSphere 3: Virtual Appliance Mode - User Guide for VMware vSphere 4: Direct SMB Access Mode - User Guide for VMware vSphere 5: Direct SAN Access Mode - User Guide forVMware vSphere 6: Direct NFS Access Mode - User Guide for VMware vSphere

To design a solution that meets the virtual infrastructure requirements for Veeam University Hospital, you need to collect some information during the discovery phase. This information will help you to understand the configuration and performance of the VMware clusters, the size and type of the data, and the backup and recovery objectives.

According to the Veeam Backup & Replication Best Practice Guide, some of the information related to the virtual infrastructure that is missing and must be collected during the discovery phase are:

•Local area network speed. This information will help you to determine the network bandwidth and throughput that are available for backup and replication traffic, as well as the impact of backup and replication activities on the network performance and latency.

•Size of the source data set. This information will help you to estimate the backup storage requirements, as well as the backup compression and deduplication ratios, based on the size and type of the data.

Therefore, the correct answer is A and D.

•Veeam CDP is a technology that helps you protect mission-critical VMware virtual machines when data loss for seconds or minutes is unacceptable12.

•Veeam CDP leverages vSphere APIs for I/O filtering (VAIO) to constantly replicate I/O operations performed on VMs without creating snapshots12.

•Veeam CDP allows you to configure the RPO per second and achieve near-zero RPO, which means almost no data loss12.

•Veeam CDP also provides minimum recovery time objective (RTO) in case of a disaster, as CDP replicas are in a ready-to-start state1.

Veeam image-based replication is not the best option, as it relies on snapshots and has a higher RPO than CDP3. Custom PowerShell scripting is not a reliable or scalable solution, as it requires manual coding and maintenance. Veeam Backup Copy with immediate mode is not suitable for replication, as it is designed for copying backup files, not VM replicas4.

References: 1: Continuous Data Protection (CDP) - User Guide for VMware vSphere 2: Veeam v11: Continuous Data Protection (CDP) configuration 3: Replication - User Guide for VMware vSphere 4: Backup Copy Modes - User Guide for VMware vSphere

To design a solution that meets the replication requirement for Veeam University Hospital, you need to consider some of the mitigating techniques that might be required for the virtual machines that have several separate large VMDKs with a high change rate per virtual machine on the same datastore. This will help you to overcome some of the challenges and limitations that may affect the replication performance and efficiency, as well as the recovery point objective (RPO) of the organization.

According to the Veeam Backup & Replication Best Practice Guide, some of the mitigating techniques that might be required are:

•Implement WAN accelerator. This technique can help you to reduce the amount of data that needs to be transferred and processed between the source and target sites, by using caching, deduplication, compression, and encryption. You need to deploy a pair of WAN accelerators, one at the source site and one at the target site, and configure them in the replication job settings. This technique can improve the replication speed and efficiency, as well as save network bandwidth and storage space.

•Recommend migrating some of the VMDKs to alternative datastores. This technique can help you to avoid performance degradation and resource contention on the source datastore, by distributing the load and I/O across multiple datastores. You need to use VMware tools or commands, such as Storage vMotion or svmotion, to migrate some of the VMDKs to other datastores that have enough capacity and performance. This technique can improve the replication stability and reliability, as well as reduce the impact on the production environment.

Therefore, based on these techniques, the answer that describes which mitigating techniques might be required is A and C.

Based on the requirements, one of the factors that should be considered in the physical design when implementing the virtual machine replication between sites is to ensure that the proper firewall ports are open between the proxies at each site. This is because Veeam Backup & Replication uses network ports to communicate with backup infrastructure components and transfer data during replication. You need to make sure that the required ports are not blocked by firewalls or other network devices. For a list of ports used by Veeam Backup & Replication, see this article2

Thank you for your question. I’m glad to help you with your VMCA 2022 project.????

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to consider the impact and benefit of adding extra proxy servers to your backup infrastructure. This will help you to optimize the performance and efficiency of your backup and restore operations, as well as to prepare for future growth and expansion.

According to the web search results, a proxy server is a component that retrieves data from the source host, processes it and transfers to the backup repository. It also performs data compression, deduplication, encryption, etc. You can deploy backup proxies both in the primary site and in remote sites1.

The immediate result of adding the extra proxy server is A. The time for backup to complete could be reduced.

This result means that:

•The time for backup to complete is a metric that measures how long it takes to perform a backup job from start to finish. It depends on various factors, such as the size and type of data, the backup method and frequency, the network bandwidth and latency, etc.

•Adding an extra proxy server can reduce the time for backup to complete, by distributing the backup workload between available proxy servers. This can improve the backup performance and efficiency, as well as reduce the impact on the production environment.

•Reducing the time for backup to complete can also help you to meet your backup window and recovery point objective (RPO) requirements, as well as to free up more resources for other tasks or jobs.

•Backup copy jobs with GFS enabled. This type of job does not support using immutability from S3 Object Lock because it uses synthetic full backups, which require modifying existing backup files. Synthetic full backups are not compatible with immutability settings, as they violate the principle of not changing the backup files.

To design a solution that meets the backup and replication requirements for Veeam University Hospital, you need to consider some of the components that are needed for the on-premises design. This will help you to ensure the performance and reliability of the backup and replication operations, as well as the scalability and manageability of the backup infrastructure.

According to the Veeam Backup & Replication Best Practice Guide1, some of the components that are needed for the on-premises design are:

•Backup server. This is the core component of Veeam Backup & Replication that controls and coordinates backups, replication, recovery verification, and restore tasks. It also manages backup infrastructure components, such as proxy servers, repository servers, WAN accelerators, etc. You need to have a backup server at each site, as recommended by the best practice guide2.

•Backup proxy. This is a component that retrieves data from the source host, processes it and transfers to the backup repository. It also performs data compression, deduplication, encryption, etc. You need to have at least one backup proxy at each site, as recommended by the best practice guide3.

•Backup repository. This is a server where Veeam Backup & Replication keeps backup files, backup copies and metadata of replicated VMs. It can be a Windows or Linux server, a NAS device, a deduplication appliance, etc. You need to have at least one backup repository at each site, as recommended by the best practice guide4.

•Mount server. This is a component that mounts backup files from the backup repository to the backup proxy during restore operations. It also performs data decompression, deduplication, decryption, etc. You need to have a mount server at each site where you plan to perform restores, as recommended by the best practice guide5.

•Gateway server. This is a component that acts as a data mover between the backup proxy and the backup repository when they are located in different sites or networks. It also performs data encryption and decryption for secure data transfer. You need to have a gateway server at each site where you have a backup repository that is accessed by a remote backup proxy, as recommended by the best practice guide.

Therefore, based on these components, the answer that describes which components are needed for the on-premises design is D. Backup server, backup proxy, backup repository, mount server, gateway server.