VMCA2022 Veeam Certified Architect 2022 Questions and Answers

Backup from Storage Snapshots and Direct NFS are the preferred processing modes for NFS datastores, as they offer the best performance and reliability for backup and restore operations12.

Backup from Storage Snapshots is a feature of Veeam Backup & Replication that leverages the native snapshot capabilities of the storage system to create a consistent point-in-time copy of the VM data. Veeam Backup & Replication then reads data directly from the storage snapshot, bypassing the ESXi host and reducing the impact on the production environment3. Backup from Storage Snapshots is supported for NFS datastores on NetApp, Nimble, Dell EMC, HPE, and Pure Storage systems4.

Direct NFS is a proprietary transport mode of Veeam Backup & Replication that uses a native NFS client deployed on the backup proxy to read and write data directly from and to the NFS datastore. Veeam Backup & Replication also bypasses the ESXi host and reduces the load on the production environment. Direct NFS is supported for NFS datastores on any storage system that supports NFS version 3 or 4.1.

The other options are not preferred because:

• B) Network (NBD) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network. This mode produces additional load on the ESXi host and the network, and may result in slower backup and restore performance.
• C) Virtual Appliance (HotAdd) mode is a transport mode that uses the VMware VDDK to attach the disks of the processed VM to the backup proxy VM. This mode also produces additional load on the ESXi host and the network, and may cause issues with disk alignment or SCSI controller limitations.
• D) Network mode with Encryption (NBDSSL) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network with SSL encryption. This mode provides an extra layer of security, but also adds more overhead and reduces the backup and restore performance.

You can find more information about the processing modes and how to choose the best one for your environment in the following resources:

• Transport Modes
• Selecting a Transport Mode
• Backup from Storage Snapshots
• Storage Systems Supported for Backup from Storage Snapshots
• [Direct NFS Access]
• [Network Mode]
• [Virtual Appliance Mode]
• [Network Mode with Encryption]

The Veeam backup method that should be used for the virtualized stock trading application is to separate the virtual machine into its own job and enable application aware processing. This method allows Veeam Backup & Replication to create transactionally consistent backups of the application, by quiescing the application and creating a snapshot of its data1. This ensures that the application can be restored to a working state, without data loss or corruption. The other options are either not suitable for the application (option A, as Veeam agent is designed for physical machines or cloud instances2), not sufficient for the application (option C, as pre-freeze and post-thaw scripts do not guarantee transactional consistency3), or not related to the backup method (option D, as replication is a different process from backup). References: Application-Aware Processing, Veeam Agent Management, Pre-Freeze and Post-Thaw Scripts, [Replication].

The additional information that is necessary for sizing the backup solution and must be gathered during further discovery are the amount of virtual machines to be protected and the total amount of production storage provisioned space. These metrics are used to calculate the backup storage requirements, the backup proxy and transporter resources, and the backup job configuration. The other options are either not relevant for sizing the backup solution (repository storage file system, replication schedule) or already provided in the scenario (the available bandwidth per site). References: Veeam Certified Architect 2022 Exam Guide, page 10; Veeam Backup & Replication v11: Architecture and Designcourse, module 3.

The retention requirement for this project is 12 weekly backups, six monthly backups and seven yearly backups. This is stated in the business requirements section of the scenario, where it says “To meet regulatory requirements, backups must be retained for four years.” This implies that the backup data must be archived for long-term retention, and the Veeam solution supports the 3-2-1 rule, which means having three copies of data, on two different types of media, with one copy off-site1. The other options are not retention requirements, but rather technical requirements or design choices, such as having on-premises backups on hardened repositories, having at least one copy of data on-premises, or having 14 daily backups on-site. References: Veeam Certified Architect 2022 Exam Guide, page 9; Veeam Backup & Replication v11: Architecture and Design course, module 4.

The things that can be done to validate that the design meets target SLAs and reduces the headcount required to manage the solution are:

• Use tagging and scripts to auto-generate backup jobs, set the start time and windows, letting the backup server manage resource allocation. This option allows to automate the backup job creation and configuration, based on the tags assigned to the source objects, such as VMs, hosts, or clusters1. This reduces the manual effort and human error involved in managing the backup jobs, and ensures that the backup server allocates the optimal resources for each job, based on the load balancing and performance settings2.
• Explain how to detect configuration changes, reporting and using backup job templates to maintain consistency. Document self-service restore the streamline service desk engagement. This option allows to monitor the backup infrastructure and detect any changes that may affect the backup performance or reliability, such as adding or removing VMs, hosts, or clusters3. It also allows to use backup job templates to create consistent and standardized backup policies, and apply them to multiple backup jobs4. Additionally, it allows to document the self-service restore process, which enables end-users to perform file-level restores from their own backups, without involving the backup administrator or the service desk5.
• Review the design so that the slowest part of the infrastructure is fast enough to meet backup window requirements. This option allows to identify and optimize the bottleneck in the backup infrastructure, which is the component that limits the backup speed and throughput. By reviewing the design and ensuring that the slowest part of the infrastructure can meet the backup window requirements, the backup SLAs can be achieved and the backup performance can be improved.

The other options are either not relevant for validating the design (option A and E, as exporting the configuration, scheduling a review, and reviewing the design for bottlenecks are part of the design process, not the validation process) or not effective for meeting the SLAs and reducing the headcount (option C, as using inventory information, backup chaining, and fine tuning are manual and complex tasks that may not guarantee the backup window compliance or resource efficiency). References: Tagging, Load Balancing and Performance, Configuration Change Tracking, Backup Job Templates, Self-Service File Restore, [Bottleneck Statistics]

The repositories should be configured as Scale-out Backup Repositories consisting of hardened repositories to easily allow for additional capacity to be added and to meet the immutability requirement. Scale-out Backup Repository is a logical entity that groups several backup repositories into a single pool of storage, and allows to add or remove backup repositories as needed1. Hardened repository is a Linux-based backup repository with immutability enabled, which prevents backup files from being modified or deleted until the specified retention period expires2. The other options are either not immutable (option A and C, as NTFS and XFS do not support immutability) or not scalable (option B, as ReFS does not support adding or removing extents in a Scale-out Backup Repository3). References: Scale-out Backup Repository, Hardened Repository, ReFS Limitations.

Data scrubbing is the process of removing sensitive or confidential data from backups before restoring them, to comply with regulatory or legal requirements1. Veeam Backup & Replication supports data scrubbing for VMware VMs by using a custom script that runs inside the virtual lab2.

To perform data scrubbing, you need to create a virtual lab, an application group, and a SureBackup job. The virtual lab is a fenced-off environment where you can test and verify your backups without affecting the production network3. The application group is a collection of VMs that you want to restore and scrub. The SureBackup job is a task that automates the verification and restoration of VMs in the virtual lab.

The custom script is a PowerShell script that you need to write and configure to run on the VMs in the application group. The script should perform the necessary actions to delete or modify the data that you want to scrub, such as files, folders, registry keys, database records, etc2. You can use the Veeam PowerShell snap-in to access the Veeam functionality and objects from the script.

You can find more information about data scrubbing and how to configure it in the Veeam Backup & Replication User Guide for VMware vSphere2.

The component sizing that should be adjusted is the physical storage in the repositories. The repositories are the backup storage locations where Veeam Backup & Replication stores backup files, VM copies and metadata for replicated VMs1. Increasing the retention period from four to five years means that more backup files will be kept on the repositories, and thus more storage space will be required. The other options are not affected by the retention period change, as they are either related to off-site backups (option A), Veeam Backup & Replication server performance (option C), or backup proxy performance (option D). References: Backup Repositories.

The retention requirement for gold tier virtual machines is that they must have 14 daily, eight weekly, three monthly and seven yearly backups. This requirement can be derived from the technical requirement of having eight weekly backups, three monthly backups, and seven yearly backups for regulatory purposes, as well as the business requirement of having daily backups for gold tier virtual machines.

The assumption that can be made for the conceptual design is that Veeam Agent backups of sale staff laptops should be managed by the backup server. This assumption is based on the best practice and recommendation for using Veeam Backup & Replication. Veeam Agent backups of sale staff laptops should be managed by the backup server to enable centralized management, monitoring, and reporting of all agent-based backups. This can also simplify the backup configuration, scheduling, and retention for the laptop agents.

The gold tier backup jobs have the most stringent recovery point objective (RPO) of one hour for image backup and 15 minutes for transaction log backup. This means that they need to run more frequently than the other backup jobs and create more restore points per day. Therefore, to properly plan the backup copy job settings, you will need more information on the gold tier backup jobs, such as the number of VMs, the size of backups, the change rate, the retention policy, and the bandwidth available for copying backups to the offsite location.

References: [Backup Copy], [Backup Methods], [Continuous Data Protection]

The areas that would benefit from additional analysis on areas mentioned in the case study are MSSQL, NAS, and PostgreSQL. These areas have specific backup and restore requirements that need to be considered and addressed in the design and sizing of the Veeam backup infrastructure. For example, MSSQL requires transaction log backup and application-aware processing to ensure consistent backups and point-in-time recovery. NAS requires file-level backup and storage integration to optimize backup performance and storage efficiency. PostgreSQL requires pre-freeze and post-thaw scripts to quiesce the database before backup and resume it after backup.

References: [MSSQL Server Backup], [NAS Backup], [PostgreSQL Backup]

The types of jobs that do not support using immutability from S3 Object Lock or hardened repositories are NAS backups and Agent for Mac backups. These types of jobs do not have the option to enable immutability in their settings, unlike VMware, Hyper-V, Linux Agent, or Windows Agent backup jobs. Therefore, they cannot leverage the immutability feature of S3 Object Lock or hardened repositories to protect their backups from ransomware or malicious deletion.

References: [S3 Object Lock Immutability], [Hardened Linux Repository], [NAS Backup], [Agent for Mac]

The reason that justifies the decision to separate out proxies for gold tier and silver/bronze tier is that gold tier virtual machines run frequently and should not share resources with lower priority virtual machines. This is because gold tier virtual machines have a high RPO of one hour or less, which means that they need to run backup jobs more often than silver/bronze tier virtual machines. Therefore, they should have dedicated proxies that can process their data without competing with other backup jobs for proxy resources. This can improve backup performance, reliability, and scalability for gold tier virtual machines.

The recommended storage option for the backups kept on-premises is a physical server with Veeam Hardened Repository. A Veeam Hardened Repository is a type of backup repository that provides immutability and ransomware protection for backup files by using Linux XFS file system features and Linux access control mechanisms. A physical server is preferred over a virtual server for better performance, security, and scalability. A Veeam Hardened Repository meets the customer’s requirements for compliance, security, and retention, as well as supports all backup types and features.

The component that can help meet the requirement of alternative decryption capabilities on encrypted backups in the event of lost passwords is Veeam Backup Enterprise Manager. Veeam Backup Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides a password loss protection feature that enables authorized users to restore encrypted backups without entering passwords if they forget or lose them. This feature requires enabling password loss protection in Veeam Backup Enterprise Manager settings and assigning a security officer role to a user who can approve password recovery requests.

References: [Veeam Backup Enterprise Manager], [Password Loss Protection]

The preferred method to achieve the requirement of excluding the H: drive on MSSQL server virtual machines is to set up VMDK exclusion for the disk on which the H: resides in the Virtual Machines > Exclusions page for each virtual machine. This method allows you to exclude specific virtual disks from being processed by backup jobs based on their SCSI IDs or disk labels. This can save backup time and storage space by skipping unnecessary data. This method also works reliably regardless of whether the MSSQL servers are built on demand or from virtual machine templates.

The component that will help the customer meet their stated objectives of role-based access control (RBAC) and alternative decryption capabilities is Veeam Backup Enterprise Manager. Veeam Backup Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides RBAC policies that enable granular control over user permissions and access to backup data. For example, you can assign different roles to different users or groups based on their responsibilities and needs, such as backup administrator, restore operator, securityofficer, etc. Veeam Backup Enterprise Manager also provides password loss protection feature that enables authorized users to restore encrypted backups without entering passwords if they forget or lose them.

The method that can be used to validate that the design meets target SLAs and does not exceed repository growth projections is to ensure job throughput matches extensions and cross-compare with available network throughput, disk speed and initial sizing calculations. Job throughput is the measure of how much data is processed and transferred by a backup job per unit of time. Job throughput can be affected by various factors such as network bandwidth, disk performance, compression, deduplication, encryption, etc. By ensuring job throughput matches extensions, you can verify that your backup jobs are running as expected and meeting the SLAs. By cross-comparing job throughput with available network throughput, disk speed and initial sizing calculations, you can identify any bottlenecks or discrepancies that might affect your backup performance or storage consumption.

Thank you for your question. I’m glad to help you with your VMCA 2022 project.?

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to consider the impact and benefit of adding extra proxy servers to your backup infrastructure. This will help you to optimize the performance and efficiency of your backup and restore operations, as well as to prepare for future growth and expansion.

According to the web search results, a proxy server is a component that retrieves data from the source host, processes it and transfers to the backup repository. It also performs data compression, deduplication, encryption, etc. You can deploy backup proxies both in the primary site and in remote sites1.

The immediate result of adding the extra proxy server is A. The time for backup to complete could be reduced.

This result means that:

•The time for backup to complete is a metric that measures how long it takes to perform a backup job from start to finish. It depends on various factors, such as the size and type of data, the backup method and frequency, the network bandwidth and latency, etc.

•Adding an extra proxy server can reduce the time for backup to complete, by distributing the backup workload between available proxy servers. This can improve the backup performance and efficiency, as well as reduce the impact on the production environment.

•Reducing the time for backup to complete can also help you to meet your backup window and recovery point objective (RPO) requirements, as well as to free up more resources for other tasks or jobs.

•The RMAN plugin is a component that integrates Veeam Backup & Replication with Oracle RMAN, which is a native tool for Oracle backup and recovery12.

•The RMAN plugin allows you to use Oracle RMAN commands to back up and restore Oracle databases to Veeam backup repositories, as well as perform log shipping and point-in-time recovery12.

•The RMAN plugin supports Oracle databases running on any supported operating system or hypervisor, as well as physical servers or cloud environments12.

•The RMAN plugin leverages the features and benefits of Veeam Backup & Replication, such as compression, deduplication, encryption, scalability, and reliability12.

If using Veeam’s native encryption, the repository type that will be impacted the most is the deduplicating storage appliance. This is because Veeam Backup & Replication uses different encryption keys for every job session, which makes the encrypted data blocks appear as different even if they contain duplicate data. This reduces the deduplication ratio and increases the storage consumption on the deduplicating appliance. If you want to achieve a higher deduplication ratio, youcan disable data encryption or use the encryption feature on the deduplicating appliance itself1

Thank you for your question. I’m glad to help you with your VMCA 2022 project.?

To design a solution that meets the database requirements for Veeam University Hospital, you need to consider some of the options and features that can support and integrate with Oracle databases. This will help you to ensure the consistency and reliability of the Oracle backups and restores, as well as the compatibility and supportability of the native Oracle tools with Veeam products and features.

According to the Veeam Backup & Replication Best Practice Guide, the option that most closely matches the requirements of having native Oracle utilities available for backups and restores is D. Install the Veeam RMAN Plug-in to allow native RMAN backups and restores to leverage Veeam repository directly from the Oracle servers.

This option means that:

•The Veeam RMAN Plug-in is a solution that integrates with Oracle Recovery Manager (RMAN) and allows you to back up and restore Oracle databases using Veeam repositories as targets.

•The Veeam RMAN Plug-in supports both virtual and physical Oracle servers, as well as different versions and editions of Oracle databases.

•The Veeam RMAN Plug-in enables you to use native Oracle tools and commands, such as RMAN, SQL*Plus, Data Pump, etc., to perform backups and restores of Oracle databases, without requiring any additional scripts or configurations.

•The Veeam RMAN Plug-in leverages the benefits and features of Veeam Backup & Replication, such as backup compression, deduplication, encryption, immutability, etc., to improve the backup performance and efficiency, as well as the backup security and integrity.

This option is the best match for the requirements, as it allows you to use native Oracle utilities for backups and restores, while also taking advantage of Veeam products and features.

To design a solution that meets the NAS environment requirements for Veeam University Hospital, you need to collect some information during the discovery phase. This information will help you to understand the characteristics and performance of the NAS systems, the size and type of the data, and the backup and recovery objectives.

According to the Veeam Backup & Replication Best Practice Guide, some of the information that you should collect from the customer about the data stored on the NAS per site are:

•Total number of files (in millions) to be backed up. This information will help you to estimate the backup storage requirements, as well as the backup performance and scalability, based on the number and distribution of files.

•Largest file size. This information will help you to determine the optimal backup block size and alignment, as well as the backup compression and deduplication ratios, based on the size and type of files.

•Backup copy jobs with GFS enabled. This type of job does not support using immutability from S3 Object Lock because it uses synthetic full backups, which require modifying existing backup files. Synthetic full backups are not compatible with immutability settings, as they violate the principle of not changing the backup files.

Based on the customer Windows and Linux file server backup requirements, the best component to help them meet their stated objectives is Backup Enterprise Manager with indexing enabled on virtual machine and Agent backups with RBAC policies. This is because:

•Backup Enterprise Manager allows the customer to manage and monitor backup jobs across multiple backup servers from a single web-based interface1.

•Indexing enables the customer to perform file-level recovery from the backups of Windows and Linux servers, as well as search for files across all backups2.

•RBAC policies allow the customer to delegate permissions to different users and groups for performing file-level recovery, based on their roles and restore scopes3.

References: 1: Veeam Backup Enterprise Manager Guide 2: Veeam Backup & Replication User Guide 3: Veeam Backup Enterprise Manager Guide > Configuring Accounts and Roles

The Gateway Server is a component that acts as a data mover between the backup proxy and the NFS storage. By placing the backup proxy and the Gateway Server together at the source site, you can reduce the network traffic and latency between them, and improve the data transfer speed. The Gateway Server will read data from the NFS storage and send it to the backup proxy over a local connection, and the backup proxy will process and compress the data before sending it to the target site1

To access encrypted datastores in VMware, you need to use a transport mode that supports encryption. The following transport modes support encryption:

•Network mode with Encryption (NBDSSL): This mode uses an encrypted network connection between the backup proxy and the ESXi host to read and write data from the encrypted datastore. This mode does not require direct access to the datastore, but it can be slower than other modes due to network traffic and encryption overhead2

•Virtual Appliance (HotAdd) mode: This mode uses a virtual backup proxy that runs on an ESXi host and attaches virtual disks of the encrypted VMs to itself using the VMware vSphere API. This mode requires that the backup proxy and the source VMs reside on the same datastore or on datastores that are accessible by the same ESXi host. This mode can offer better performance than network mode, but it can also cause SCSI reservation conflicts if multiple backup proxies access the same datastore simultaneously3

•Direct SMB: This mode uses a physical backup proxy that accesses the encrypted datastore over the SMB protocol. This mode requires that the datastore is configured as an SMB share and that the backup proxy has read and write permissions on it. This mode can offer high performance and scalability, but it also requires additional configuration steps and security considerations4

The following transport modes do not support encryption:

•Network (NBD) mode: This mode uses an unencrypted network connection between the backup proxy and the ESXi host, which cannot access encrypted datastores2

•Direct SAN: This mode uses a physical backup proxy that accesses the encrypted datastore over the SAN fabric, which cannot decrypt encrypted data5

•Direct NFS: This mode uses a physical backup proxy that accesses the encrypted datastore over the NFS protocol, which does not support encryption6

References:

1: Hardened Repository - User Guide for VMware vSphere 2: Network Mode - User Guide for VMware vSphere 3: Virtual Appliance Mode - User Guide for VMware vSphere 4: Direct SMB Access Mode - User Guide for VMware vSphere 5: Direct SAN Access Mode - User Guide forVMware vSphere 6: Direct NFS Access Mode - User Guide for VMware vSphere

Option A follows the 3-2-1 rule by having three copies of data (the original production data, the backup at the primary site, and the backup copy at the secondary site), two different media types (local disk and object storage), and one copy off-site (the backup copy at the secondary site). This option also reduces the amount of traffic sent over the network by using existing backups as seeds for backup copies, and reduces the storage costs by using cloud tier to move older backups to cheaper and unlimited cloud storage1