Pass the Veeam Veeam Certified Architect VMCA2022 Questions and answers with CertsForce

The steps that should be taken to correct the storage configuration based on the customer’s hardening requirements are to add hardened repositories to each Scale-out Backup Repository and evacuate the data from the CIFS extents. A hardened repository is a type of backup repository that provides immutability and ransomware protection for backup files by using Linux XFS file system features and Linux access control mechanisms. A Scale-out Backup Repository is a logical entity that groups several backup repositories into one pool of storage. A CIFS extent is a type of backup repository that uses a shared folder on a Windows or Linux server as a backup target. By adding hardened repositories to each Scale-out Backup Repository, you can ensure that your backups are secure, compliant, and efficient. By evacuating the data from the CIFS extents, you can remove the risk of ransomware infection or deletion of your backups.

Reducing the recovery point objective (RPO) for silver tier workloads means that the backup frequency will increase, resulting in more backup data being generated and transferred. This will affect the sizing requirements of the Veeam components that are responsible for storing and processing the backup data, namely the Veeam repository and proxy roles1.

The Veeam repository is a storage location where the backup files are stored. The repository size depends on the amount of data to be backed up, the backup method, the retention policy, and the compression and deduplication settings2. Reducing the RPO will increase the amount of data to be backed up, and may require more frequent synthetic full backups or active full backups to maintain the retention policy. This will increase the repository size and the disk space consumption.

The Veeam proxy is a data mover that performs backup, replication, and restore tasks. The proxy size depends on the number of concurrent tasks, the transport mode, the backup method, and the compression and deduplication settings3. Reducing the RPO will increase the number of concurrent tasks and the amount of data to be processed by the proxy. This will increase the proxy size and the CPU and memory consumption.

You can find more information about the sizing requirements and best practices for the Veeam repository and proxy roles in the following resources:

Veeam Backup & Replication Best Practices

Veeam Backup Repository Sizing Calculator

Veeam Proxy Sizing Calculator

The Veeam component that will be required at each site for disaster recovery with a one minute recovery point objective is the Veeam CDP proxy. Veeam CDP proxy is a data mover that transfers data between the source and target hosts, using VMware vSphere APIs for I/O Filtering (VAIO) to capture the changes in real time1. Veeam CDP proxy can achieve near-zero recovery point objectives for business critical virtual machines, as well as provide short-term restore points and data encryption2. The other components are not required for this scenario, as they are used for different purposes, such as guest processing, backup storage, or backup jobs3. References: VMware CDP Proxies, Continuous Data Protection, Backup Proxies.

The repositories should be configured as Scale-out Backup Repositories consisting of hardened repositories to easily allow for additional capacity to be added and to meet the immutability requirement. Scale-out Backup Repository is a logical entity that groups several backup repositories into a single pool of storage, and allows to add or remove backup repositories as needed1. Hardened repository is a Linux-based backup repository with immutability enabled, which prevents backup files from being modified or deleted until the specified retention period expires2. The other options are either not immutable (option A and C, as NTFS and XFS do not support immutability) or not scalable (option B, as ReFS does not support adding or removing extents in a Scale-out Backup Repository3). References: Scale-out Backup Repository, Hardened Repository, ReFS Limitations.

Network traffic rules are settings that allow you to control the network traffic transferred between backup infrastructure components, such as backup proxies, repositories, and WAN accelerators. You can use network traffic rules to throttle or encrypt the network traffic, or to specify preferred networks for data transfer1.

By configuring network traffic rules, you can reduce the bandwidth consumption for the offloading of data to public cloud storage, and avoid affecting the performance of business applications on the branch sites. You can set limits for the network traffic speed, or schedule the offloading tasks to run during off-peak hours2. You can also select the optimal network routes for the offloading tasks, and avoid congested or slow networks3.

You can find more information about network traffic rules and how to configure them in the following resources:

Configuring Network Traffic Rules

Enabling Traffic Throttling

Specifying Preferred Networks

Changing the backup window from 12 hours to 14 hours means that the backup jobs will have more time to complete, and therefore less concurrency will be required. This will reduce the load on the proxies, which are the data movers that perform backup, replication, and restore tasks1. The proxies will need fewer resources, such as CPU and memory, to handle the same amount of data.

The other options are incorrect because:

A) Proxies will not require more resources, as explained above.

B) Mount servers will not require fewer resources, as they are not affected by the backup window. Mount servers are used to mount backup files and restore data from them2. Their resource consumption depends on the restore frequency and performance, not the backup window.

D) Repositories will not require more storage space, as the backup window does not affect the backup size. Repositories are storage locations where the backup files are stored3. Their storage space consumption depends on the amount of data to be backed up, the backup method, the retention policy, and the compression and deduplication settings, not the backup window.

You can find more information about the backup window and the Veeam components in the following resources:

Backup Window

Mount Server

Backup Repository

Backup from Storage Snapshots and Direct NFS are the preferred processing modes for NFS datastores, as they offer the best performance and reliability for backup and restore operations12.

Backup from Storage Snapshots is a feature of Veeam Backup & Replication that leverages the native snapshot capabilities of the storage system to create a consistent point-in-time copy of the VM data. Veeam Backup & Replication then reads data directly from the storage snapshot, bypassing the ESXi host and reducing the impact on the production environment3. Backup from Storage Snapshots is supported for NFS datastores on NetApp, Nimble, Dell EMC, HPE, and Pure Storage systems4.

Direct NFS is a proprietary transport mode of Veeam Backup & Replication that uses a native NFS client deployed on the backup proxy to read and write data directly from and to the NFS datastore. Veeam Backup & Replication also bypasses the ESXi host and reduces the load on the production environment. Direct NFS is supported for NFS datastores on any storage system that supports NFS version 3 or 4.1.

The other options are not preferred because:

B) Network (NBD) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network. This mode produces additional load on the ESXi host and the network, and may result in slower backup and restore performance.

C) Virtual Appliance (HotAdd) mode is a transport mode that uses the VMware VDDK to attach the disks of the processed VM to the backup proxy VM. This mode also produces additional load on the ESXi host and the network, and may cause issues with disk alignment or SCSI controller limitations.

D) Network mode with Encryption (NBDSSL) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network with SSL encryption. This mode provides an extra layer of security, but also adds more overhead and reduces the backup and restore performance.

You can find more information about the processing modes and how to choose the best one for your environment in the following resources:

Transport Modes

Selecting a Transport Mode

Backup from Storage Snapshots

Storage Systems Supported for Backup from Storage Snapshots

[Direct NFS Access]

[Network Mode]

[Virtual Appliance Mode]

[Network Mode with Encryption]

The Veeam feature that can be used to help achieve compliance with privacy regulations is location tags on repositories. Location tags are labels that can be assigned to backup repositories to indicate their physical or logical location, such as country, region, or data center1. Location tags can help ensure that backup data is stored and processed in compliance with data residency and privacy laws, such as GDPR or CCPA, by allowing backup administrators to create backup policies based on the location of the source and target data2. The other options are not related to privacy compliance, as they are either used for network optimization (preferred networks), server identification (location tags on Veeam Backup & Replication servers), or backup scope (location tags on subnets). References: Location Tags, Using Location Tags.

The tiers of Veeam Financial Services’ backups that will require SureBackup jobs are the silver and gold tiers. SureBackup jobs are used to verify the recoverability of backup files by running virtual machines from backups in an isolated environment and performing tests against live applications1. This feature is suitable for the silver and gold tiers, which have recovery time objectives of six hours and 30 minutes, respectively, and require backups to be verified. The bronze tier, which consists of development machines and field portables, has a recovery point target of seven days, with no recovery time target set, and does not require backup verification. Therefore, SureBackup jobs are not necessary for the bronze tier. Laptop backups are performed by Veeam Agent for Microsoft Windows, which does not support SureBackup jobs2. References: SureBackup, Veeam Agent for Microsoft Windows.

The best option to still satisfy the requirement for offsite, immutable or air gapped backups if the cloud provider selected for archive storage does not support immutability is to set up Scale-out Backup Repository capacity tier to a different cloud provider than the archive tier. Scale-out Backup Repository is a logical entity that groups several backup repositories into a single pool of storage, and allows to move backup files between performance and capacity tiers1. The capacity tier can be configured to use Amazon S3 or Microsoft Azure Blob Storage, which support Object Lock feature for immutability2. By using a different cloud provider for the capacity tier than the archive tier, the backup data can be stored in two separate locations, with one copy being immutable or air gapped. The other options are either not feasible (option A, as the scenario does not mention another site), not secure (option C, as the backup data can still be accessed or modified when the repository is online), or not offsite (option D, as the scenario requires a copy of backup data in a public cloud). References: Scale-out Backup Repository, Object Storage Immutability.