VMCA2022 Veeam Certified Architect 2022 Questions and Answers

The tiers of Veeam Financial Services’ backups that will require SureBackup jobs are the silver and gold tiers. SureBackup jobs are used to verify the recoverability of backup files by running virtual machines from backups in an isolated environment and performing tests against live applications1. This feature is suitable for the silver and gold tiers, which have recovery time objectives of six hours and 30 minutes, respectively, and require backups to be verified. The bronze tier, which consists of development machines and field portables, has a recovery point target of seven days, with no recovery time target set, and does not require backup verification. Therefore, SureBackup jobs are not necessary for the bronze tier. Laptop backups are performed by Veeam Agent for Microsoft Windows, which does not support SureBackup jobs2. References: SureBackup, Veeam Agent for Microsoft Windows.

The additional information that is necessary for sizing the backup solution and must be gathered during further discovery are the amount of virtual machines to be protected and the total amount of production storage provisioned space. These metrics are used to calculate the backup storage requirements, the backup proxy and transporter resources, and the backup job configuration. The other options are either not relevant for sizing the backup solution (repository storage file system, replication schedule) or already provided in the scenario (the available bandwidth per site). References: Veeam Certified Architect 2022 Exam Guide, page 10; Veeam Backup & Replication v11: Architecture and Designcourse, module 3.

Database administrators and operations team are the most relevant stakeholders to talk to in order to collect business and technical requirements related to virtual infrastructure. Database administrators can provide information about the performance, availability, and recovery needs of the SQL and Oracle servers, as well as the custom financial application on AIX servers. Operations team can provide information about the network bandwidth, firewall rules, storage capacity, and backup windows for the virtual machines and NAS devices. The other stakeholders are less relevant, as they are either not directly involved with the virtual infrastructure (web design team, sales staff) or have minimal requirements (laptop users). References: Veeam Certified Architect 2022 Exam Guide, page 8; Veeam Backup & Replication v11: Architecture and Design course, module 2.

Backup from Storage Snapshots and Direct NFS are the preferred processing modes for NFS datastores, as they offer the best performance and reliability for backup and restore operations12.

Backup from Storage Snapshots is a feature of Veeam Backup & Replication that leverages the native snapshot capabilities of the storage system to create a consistent point-in-time copy of the VM data. Veeam Backup & Replication then reads data directly from the storage snapshot, bypassing the ESXi host and reducing the impact on the production environment3. Backup from Storage Snapshots is supported for NFS datastores on NetApp, Nimble, Dell EMC, HPE, and Pure Storage systems4.

Direct NFS is a proprietary transport mode of Veeam Backup & Replication that uses a native NFS client deployed on the backup proxy to read and write data directly from and to the NFS datastore. Veeam Backup & Replication also bypasses the ESXi host and reduces the load on the production environment. Direct NFS is supported for NFS datastores on any storage system that supports NFS version 3 or 4.1.

The other options are not preferred because:

• B) Network (NBD) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network. This mode produces additional load on the ESXi host and the network, and may result in slower backup and restore performance.
• C) Virtual Appliance (HotAdd) mode is a transport mode that uses the VMware VDDK to attach the disks of the processed VM to the backup proxy VM. This mode also produces additional load on the ESXi host and the network, and may cause issues with disk alignment or SCSI controller limitations.
• D) Network mode with Encryption (NBDSSL) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network with SSL encryption. This mode provides an extra layer of security, but also adds more overhead and reduces the backup and restore performance.

You can find more information about the processing modes and how to choose the best one for your environment in the following resources:

• Transport Modes
• Selecting a Transport Mode
• Backup from Storage Snapshots
• Storage Systems Supported for Backup from Storage Snapshots
• [Direct NFS Access]
• [Network Mode]
• [Virtual Appliance Mode]
• [Network Mode with Encryption]

The configuration that is unsupported by Veeam Plug-in for Oracle RMAN based on the technical requirements is physical windows server with Oracle. Veeam Plug-in for Oracle RMAN only supports Oracle databases running on Linux, Solaris, or AIX operating systems1. The other configurations are supported by either Veeam Plug-in for Oracle RMAN or Veeam Backup & Replication. References: Veeam Plug-in for Oracle RMAN, Oracle | Veeam Backup & Replication Best Practice Guide.

The requirement C will act as a constraint on the decision of whether to use a local repository or not for the remote sites. Data locality and privacy laws may vary by country or region, and may impose restrictions on where the backup data can be stored or transferred. For example, some countries may prohibit the export of personal data outside their borders, or require encryption or anonymization of sensitive data. Therefore, the Veeam solution must comply with these laws and regulations, and may need to use a local repository for each remote site, or use a cloud provider that has a local presence in each region. The other requirements are not constraints, as they can be met with either a local or a central repository, using the features and options of the Veeam solution. References: Veeam Certified Architect 2022 Exam Guide, page 11; Veeam Backup & Replication v11: Architecture and Design course, module 5.

Immutable repositories are backup storage locations that prevent unauthorized modifications or deletions of backup data, ensuring its integrity and recoverability. Immutable repositories are essential for protecting backups against ransomware attacks, accidental deletions, or malicious insiders1.

Veeam Backup & Replication supports several types of immutable repositories, such as hardened repositories, immutable object storage repositories, and immutable deduplicating storage appliances2. Among these options, the best configuration for ensuring SLA compliance and providing protection against ransomware is to leverage hardened repositories at both primary and secondary sites, and offload to object storage in a public cloud with immutability enabled.

Hardened repositories are Linux-based repositories that use XFS file system with immutability flag to protect backup files from changes or removals. Hardened repositories can be used as primary or secondary backup targets, and can be combined with Veeam Scale-out Backup Repository to simplify backup management and optimize storage utilization3.

Object storage repositories are cloud-based repositories that use object storage services, such as Amazon S3, Microsoft Azure Blob Storage, or Google Cloud Storage, to store backup data. Object storage repositories can be used as secondary backup targets, and can leverage the immutability feature of the cloud provider to prevent backup data from being overwritten or deleted.

By using hardened repositories at both primary and secondary sites, you can achieve high availability and redundancy for your backup data, as well as fast and reliable restores. By offloading to object storage in a public cloud with immutability enabled, you can achieve long-term retention and compliance, aswell as cost savings and scalability. This configuration also follows the 3-2-1-1 backup rule, which recommends having three copies of data, on two different types of media, with one copy off-site and one copy immutable.

You can find more information about immutable repositories and how to configure them in the following resources:

• Immutable Backup Solutions: Linux Hardened Repository
• Unstructured Data Backups in Immutable Repositories
• Hardened Repository
• [Immutability for Object Storage Repositories]
• [3-2-1-1 Backup Rule]

The number of vSphere clusters and the total of virtual machines are important information related to the virtual infrastructure that are missing and must be collected during the discovery phase. These information can help you estimate the backup performance, scalability, and resource requirements for the Veeam backup infrastructure. For example, you can use the number of vSphere clusters to determine how many Veeam backup servers and proxies you need to deploy and how to distribute the backup load among them. You can also use the total of virtual machines to calculate the total amount of data to be backed up, the storage space required, and the network bandwidth needed.

References: [Veeam Backup & Replication Best Practices], [Veeam Backup Infrastructure Sizing Calculator]

The recommended method to replicate VMware virtual machines with a less than five-minute RPO is Veeam Continuous Data Protection (CDP). CDP is a feature that allows near-continuous replication of VMware virtual machines to a secondary site or cluster with minimal data loss and downtime. CDP uses VMware vSphere APIs for I/O Filtering (VAIO) to capture every write operation from the source VMs and send them to the target VMs in near real-time. CDP can achieve RPOs as low as seconds and enable fast failover and failback in case of a disaster.

The component that can help meet the requirement of alternative decryption capabilities on encrypted backups in the event of lost passwords is Veeam Backup Enterprise Manager. Veeam Backup Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides a password loss protection feature that enables authorized users to restore encrypted backups without entering passwords if they forget or lose them. This feature requires enabling password loss protection in Veeam Backup Enterprise Manager settings and assigning a security officer role to a user who can approve password recovery requests.

References: [Veeam Backup Enterprise Manager], [Password Loss Protection]

The repository type that will be most impacted by using Veeam’s native encryption is dedupe repositories. Dedupe repositories are backup repositories that use deduplication appliances or software to reduce backup size and optimize storage utilization. However, if you use Veeam’s native encryption for backup jobs that target dedupe repositories, you will lose most of the deduplication benefits, as encrypted data blocks cannot be deduplicated effectively. Therefore, it is recommended to use either the encryption feature of the deduplication device or software, or avoid encryption altogether for dedupe repositories.

The component that will help the customer meet their stated objectives of role-based access control (RBAC) and alternative decryption capabilities is Veeam Backup Enterprise Manager. Veeam Backup Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides RBAC policies that enable granular control over user permissions and access to backup data. For example, you can assign different roles to different users or groups based on their responsibilities and needs, such as backup administrator, restore operator, securityofficer, etc. Veeam Backup Enterprise Manager also provides password loss protection feature that enables authorized users to restore encrypted backups without entering passwords if they forget or lose them.

The best way to accomplish the recoverability testing of backup files for gold tier virtual machines to meet the customer’s requirements is to create a virtual lab in the customer’s environment, and then use SureBackup jobs to verify backups. A virtual lab is an isolated environment where you can run your backups or replicas without affecting the production environment. A SureBackup job is a process that allows you to automatically verify the recoverability of your backups by running them in a virtual lab. By using these features, you can ensure that your backups are consistent, functional, and compliant with SLAs and regulations.

The recovery point objective (RPO) requirement of periodic backups every hour for gold tier virtual machines directly conflicts with the technical requirement of all backups must complete within the hours of 5 p.m. to 8 a.m. local time. This is because these two requirements are mutually exclusive, as hourly backups would need to run during the daytime as well as the nighttime, while the backup window only allows backups to run during the nighttime. Therefore, you need to get clarification from the customer on which requirement has priority and how to adjust the other one accordingly.

The factor that should be considered in the physical design when implementing backup copy jobs between sites is to use physical servers for the Veeam backup proxies at each site. A Veeam backup proxy is a data mover component that performs data processing and transfer tasks for backup and backup copy jobs. A physical server is preferred over a virtual server for better performance, reliability, and isolation. A physical server can also leverage hardware encryption offload to reduce CPU load and network traffic encryption to secure data in transit.

The methods that should be used to scope virtual machine backups based on customer requirements are to create backups based on tags and to create backup jobs with same retention requirements. Creating backups based on tags allows dynamic scoping of backups based on VMware tags assignedto virtual machines. This can simplify backup management, as new or modified virtual machines will be automatically included or excluded from backup jobs based on their tags. Creating backup jobs with same retention requirements allows consistent application of backup policies based on the backup tiers defined by the customer. This can ensure compliance with regulatory and business needs, as different tiers of virtual machines will have different retention periods and restore points.

The best way to configure backups for a group of MSSQL systems running in an Always-On cluster and sensitive to virtual machine stun is to deploy Veeam agents configured for failover clustering. Veeam agents can provide application-aware processing and transaction log backup for MSSQL servers, as well as support for failover clustering and cluster shared volumes. Veeam agents can also reduce the impact of virtual machine stun by performing backups at the guest OS level, without using VMware snapshots.

To design a solution that meets the requirements for off-site immutable backups for Veeam University Hospital, you need to consider some of the options and features that Veeam products and features offer. This will help you to ensure the security and integrity of your backup data, as well as the compatibility and supportability of the cloud provider that does not currently support immutability.

According to the Veeam Backup & Replication Best Practice Guide, immutability is a feature that prevents backup files from being deleted or modified by anyone until the specified retention period expires. Immutability can be achieved by using S3 Object Lock or Hardened Repository, which are two different solutions that Veeam Backup & Replication supports.

Based on this definition, the best option to still satisfy the requirements for off-site immutable backups is A. Backup copy to a hardened repository.

This option means that:

•The backup copy is a type of job that allows you to create and maintain copies of your backup data on a secondary backup repository. You can use backup copy jobs to send your backup data off-site, as well as to apply different retention settings and policies.

•The hardened repository is a solution that allows you to add a hardened repository based on a Linux server to your backup infrastructure. You can use hardened repository with Veeam Backup & Replication to make your backups immutable on-premises or off-site.

•The backup copy to a hardened repository can be configured and managed by Veeam Backup & Replication, regardless of the cloud provider that does not currently support immutability. You only need to deploy and connect a Linux server with a hardened repository in the cloud environment, and then use it as a target for your backup copy jobs.

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to collect some critical information during the discovery phase. This information will help you to understand the current state of the environment, the goals and expectations of the stakeholders, and the constraints and challenges of the project.

According to the case study, some of the critical information that was missing from discovery are:

•Size of current data sets. This information is critical because it helps you to estimate the backup storage requirements, as well as the backup performance and efficiency, based on the size and type of data. You need to know how much data is stored on each workload, such as virtual machines, physical servers, NAS systems, etc., as well as how much data is changed or added on a daily or weekly basis.

•Backup retention policy. This information is critical because it helps you to define the backup retention settings and policies, such as the number and frequency of backup copies, the backup storage tiers, the backup deletion rules, etc. You need to know how long the backup data should be kept for compliance or historical purposes, as well as how much backup storage capacity is available or needed.

Based on the customer Windows and Linux file server backup requirements, the best component to help them meet their stated objectives is Backup Enterprise Manager with indexing enabled on virtual machine and Agent backups with RBAC policies. This is because:

•Backup Enterprise Manager allows the customer to manage and monitor backup jobs across multiple backup servers from a single web-based interface1.

•Indexing enables the customer to perform file-level recovery from the backups of Windows and Linux servers, as well as search for files across all backups2.

•RBAC policies allow the customer to delegate permissions to different users and groups for performing file-level recovery, based on their roles and restore scopes3.

References: 1: Veeam Backup Enterprise Manager Guide 2: Veeam Backup & Replication User Guide 3: Veeam Backup Enterprise Manager Guide > Configuring Accounts and Roles

•Backup copy jobs with GFS enabled. This type of job does not support using immutability from S3 Object Lock because it uses synthetic full backups, which require modifying existing backup files. Synthetic full backups are not compatible with immutability settings, as they violate the principle of not changing the backup files.

To design a solution that meets the NAS environment requirements for Veeam University Hospital, you need to collect some information during the discovery phase. This information will help you to understand the characteristics and performance of the NAS systems, the size and type of the data, and the backup and recovery objectives.

According to the Veeam Backup & Replication Best Practice Guide, some of the information that you should collect from the customer about the data stored on the NAS per site are:

•Total number of files (in millions) to be backed up. This information will help you to estimate the backup storage requirements, as well as the backup performance and scalability, based on the number and distribution of files.

•Largest file size. This information will help you to determine the optimal backup block size and alignment, as well as the backup compression and deduplication ratios, based on the size and type of files.

•The RMAN plugin is a component that integrates Veeam Backup & Replication with Oracle RMAN, which is a native tool for Oracle backup and recovery12.

•The RMAN plugin allows you to use Oracle RMAN commands to back up and restore Oracle databases to Veeam backup repositories, as well as perform log shipping and point-in-time recovery12.

•The RMAN plugin supports Oracle databases running on any supported operating system or hypervisor, as well as physical servers or cloud environments12.

•The RMAN plugin leverages the features and benefits of Veeam Backup & Replication, such as compression, deduplication, encryption, scalability, and reliability12.

WAN accelerators are dedicated components that Veeam Backup & Replication uses for WAN acceleration. WAN accelerators are responsible for global data caching and data deduplication, which reduce the amount of data that needs to be transferred over the network. By adding WAN accelerators to each site, you can improve the performance of backup copy jobs between sites, and reduce the bandwidth consumption and network traffic3

References:

1: Gateway Server - User Guide for VMware vSphere 2: Gateway Server - User Guide for VMware vSphere 3: WAN Accelerators - User Guide for VMware vSphere

The gateway is a component that acts as a data mover between the backup proxy and the backup repository. If the gateway does not have enough CPU, RAM and task slots assigned, it may not be able to handle the incoming data from the backup proxy efficiently, and cause a bottleneck at the target. By increasing the resources and task slots for the gateway, you can improve its performance and throughput, and reduce the load on the target2

According to the Veeam Backup & Replication Best Practice Guide1, the proxy and repository servers are the components that should be sized correctly to ensure that synthetic operations and backup copy jobs can be completed in the desired window. This is because:

•The proxy server is responsible for retrieving data from the source and sending it to the target. The proxy server performance depends on the CPU, memory, network, and storage resources available. The proxy server should have enough CPU cores and memory to handle concurrent tasks, as well as sufficient network bandwidth and storage throughput to transfer data efficiently.

•The repository server is responsible for storing backup files on the target storage. The repository server performance depends on the CPU, memory, network, and storage resources available. The repository server should have enough CPU cores and memory to handle concurrent tasks, as well as sufficient network bandwidth and storage throughput to write data efficiently. The repository server should also support the backup format and retention policy chosen for the backup copy job.

References: 1: Backup copy jobs - Veeam Backup & Replication Best Practice Guide

To design a solution that meets the immutability requirement for Veeam University Hospital, you need to consider how this constraint affects the other requirements and expectations of the customer. This will help you to avoid any conflicts or inconsistencies that may arise from applying immutability settings to the backup data.

According to the Veeam Backup & Replication Best Practice Guide, immutability is a feature that prevents backup files from being deleted or modified by anyone until the specified retention periodexpires. Immutability can be achieved by using S3 Object Lock or Hardened Repository, which are two different solutions that Veeam Backup & Replication supports.

Based on this definition, the requirement that is impacted by the immutability constraint is D. Backup must take advantage of public cloud storage for long-term retention.

This requirement is impacted by the immutability constraint because:

•Public cloud storage is a type of storage that is provided by a third-party service provider over the internet, such as Amazon S3, Microsoft Azure, Google Cloud, etc.

•Public cloud storage can be used for long-term retention, which is a policy that defines how long backup data should be kept for compliance or historical purposes, such as months, years, or decades.

•Public cloud storage can also support immutability, which is a feature that prevents backup data from being deleted or modified by anyone until the specified retention period expires, such as days, weeks, or months.

•However, not all public cloud storage providers or services support immutability, or support it in the same way. For example, Amazon S3 supports S3 Object Lock, which allows you to apply a legal hold or a retention period to individual objects or object versions. Microsoft Azure supports Immutable Blob Storage, which allows you to create time-based policies or legal holds for blob containers. Google Cloud supports Bucket Lock, which allows you to lock a bucket and prevent objects from being overwritten or deleted.

•Therefore, the choice of the public cloud storage provider or service may affect the immutability setting and requirement for the backup data. You need to verify and compare the compatibility and supportability of the public cloud storage providers or services with Veeam Backup & Replication and with the customer expectation.

Based on the requirements, one of the factors that should be considered in the physical design when implementing the virtual machine replication between sites is to ensure that the proper firewall ports are open between the proxies at each site. This is because Veeam Backup & Replication uses network ports to communicate with backup infrastructure components and transfer data during replication. You need to make sure that the required ports are not blocked by firewalls or other network devices. For a list of ports used by Veeam Backup & Replication, see this article2