VMCA2022 Veeam Certified Architect 2022 Questions and Answers

The areas that would benefit from additional analysis on areas mentioned in the case study are MSSQL, NAS, and PostgreSQL. These areas have specific backup and restore requirements that need to be considered and addressed in the design and sizing of the Veeam backup infrastructure. For example, MSSQL requires transaction log backup and application-aware processing to ensure consistent backups and point-in-time recovery. NAS requires file-level backup and storage integration to optimize backup performance and storage efficiency. PostgreSQL requires pre-freeze and post-thaw scripts to quiesce the database before backup and resume it after backup.

References: [MSSQL Server Backup], [NAS Backup], [PostgreSQL Backup]

The factor that should be considered in the physical design when implementing backup copy jobs between sites is to use physical servers for the Veeam backup proxies at each site. A Veeam backup proxy is a data mover component that performs data processing and transfer tasks for backup and backup copy jobs. A physical server is preferred over a virtual server for better performance, reliability, and isolation. A physical server can also leverage hardware encryption offload to reduce CPU load and network traffic encryption to secure data in transit.

The assumption that can be made for the conceptual design is that Veeam Agent backups of sale staff laptops should be managed by the backup server. This assumption is based on the best practice and recommendation for using Veeam Backup & Replication. Veeam Agent backups of sale staff laptops should be managed by the backup server to enable centralized management, monitoring, and reporting of all agent-based backups. This can also simplify the backup configuration, scheduling, and retention for the laptop agents.

The methods that should be used to scope virtual machine backups based on customer requirements are to create backups based on tags and to create backup jobs with same retention requirements. Creating backups based on tags allows dynamic scoping of backups based on VMware tags assignedto virtual machines. This can simplify backup management, as new or modified virtual machines will be automatically included or excluded from backup jobs based on their tags. Creating backup jobs with same retention requirements allows consistent application of backup policies based on the backup tiers defined by the customer. This can ensure compliance with regulatory and business needs, as different tiers of virtual machines will have different retention periods and restore points.

The number of vSphere clusters and the total of virtual machines are important information related to the virtual infrastructure that are missing and must be collected during the discovery phase. These information can help you estimate the backup performance, scalability, and resource requirements for the Veeam backup infrastructure. For example, you can use the number of vSphere clusters to determine how many Veeam backup servers and proxies you need to deploy and how to distribute the backup load among them. You can also use the total of virtual machines to calculate the total amount of data to be backed up, the storage space required, and the network bandwidth needed.

References: [Veeam Backup & Replication Best Practices], [Veeam Backup Infrastructure Sizing Calculator]

The recommended storage option for the backups kept on-premises is a physical server with Veeam Hardened Repository. A Veeam Hardened Repository is a type of backup repository that provides immutability and ransomware protection for backup files by using Linux XFS file system features and Linux access control mechanisms. A physical server is preferred over a virtual server for better performance, security, and scalability. A Veeam Hardened Repository meets the customer’s requirements for compliance, security, and retention, as well as supports all backup types and features.

The component that should be deployed based on the customer’s security requirements around restore capabilities is Enterprise Manager with granular RBAC policies defined. Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides granular RBAC policies that enable control over user permissions and access to restore data. For example, you can assign different roles to different users or groups based on their responsibilities and needs, such as backup administrator, restore operator, security officer, etc. You can also define custom scopes and rules for each role to limit their access to specific objects, jobs, or actions.

If the repositories are able to accomplish much higher throughput, a new issue that might come up is that the bandwidth between sites might not be sufficient to support the backup copy jobs that need to run daily between Fresno and Carson City. This could cause the backup copy jobs to fail, take longer than expected, or consume too much network resources. Therefore, it is important to measure the available bandwidth between the sites and compare it with the backup copy data size and window. If the bandwidth is not sufficient, some possible solutions are to use compression, deduplication, or WAN acceleration to reduce the backup copy traffic.

To design a disaster recovery solution that meets the requirement of having the replicated virtual workloads data not more than one hour old, you need to consider some of the potential risks and challenges that may affect the service level agreement (SLA) for the offsite disaster recovery aspect of this requirement. This will help you to ensure the availability and reliability of the replication and failover processes, as well as the recovery time objective (RTO) and recovery point objective (RPO) of the organization.

According to the Veeam Backup & Replication Best Practice Guide, one of the potential risks to the SLA for the offsite disaster recovery aspect of this requirement is B. Data change rate.

This risk means that:

•The data change rate is the amount of data that is modified, added, or deleted in a given time period. It is usually measured in percentage or megabytes per hour.

•The data change rate affects the replication performance and efficiency, as it determines how much data needs to be transferred and processed between the source and target sites.

•The data change rate also affects the replication frequency and consistency, as it determines how often and how accurately the replicas are updated and synchronized with the source workloads.

•The data change rate may vary depending on the type and activity of the workloads, such as database, file server, web server, etc. Some workloads may have a high data change rate, while others may have a low data change rate.

•The data change rate may exceed the available bandwidth or storage capacity between the source and target sites, which may result in replication failures, delays, or errors. This may compromise the SLA for the offsite disaster recovery aspect of this requirement, as it may cause the replicated virtual workloads data to be more than one hour old.

This risk has some implications for designing a solution with Veeam products and features, such as:

•The customer or a third-party vendor must monitor and measure the data change rate of the workloads that need to be replicated, as well as the available bandwidth and storage capacity between the source and target sites. This will help to plan and optimize the replication infrastructure, such as the proxy servers, repository servers, WAN accelerators, and failover plans, based on the data change rate.

•The customer or a third-party vendor must configure and adjust the replication settings and policies, such as the replication method, schedule, frequency, retention, compression, deduplication, etc., based on the data change rate. This will help to improve the replication performance and efficiency, as well as to meet the SLA for the offsite disaster recovery aspect of this requirement.

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to conduct a thorough analysis on the areas mentioned in the case study. This will help you to understand the current state of the environment, the goals and expectations of the stakeholders, and the constraints and challenges of the project.

According to the case study, some of the areas that would benefit from additional analysis are:

•NAS. This area would benefit from additional analysis because NAS systems are used to store confidential patient data as unstructured data, which need to be backed up consistently and securely. You need to collect more information about the characteristics and performance of the NAS systems, such as the size and type of data, the number and distribution of files, the largest file size, the version of SMB protocol, the deduplication and compression ratios, etc. This will help you to design a solution that can meet the backup and recovery objectives, as well as the regulatory and security requirements, for the NAS data.

•PostgreSQL. This area would benefit from additional analysis because PostgreSQL databases are used by some of the departments, with a mix of virtual and physical deployments. You need to collect more information about the configuration and performance of the PostgreSQL databases, such as the version and edition, the operating system and platform, the backup and restore methods and tools, the consistency and integrity requirements, etc. This will help you to design a solution that can support and integrate with PostgreSQL databases, as well as provide consistent and reliable backups and restores.

•OneDrive. This area would benefit from additional analysis because OneDrive is used by all doctor and lab staff to store their user data on their laptops, which also need to be backed up. You need to collect more information about the usage and performance of OneDrive, such as the number and size of files, the synchronization frequency and settings, the authentication and authorization methods, etc. This will help you to design a solution that can protect and recover OneDrive data, as well as exclude any operating system or personal files from backup.

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to consider some of the risks and challenges that may affect the success and quality of the project. This will help you to identify and mitigate any potential issues or errors that may arise during the implementation or operation of the solution.

According to the Veeam Backup & Replication Best Practice Guide, a risk is a factor that may negatively impact the performance, reliability, security, or functionality of the backup and replication solution. A risk may be caused by internal or external factors, such as technical limitations, environmental constraints, human errors, etc.

Based on this definition, one of the possible risks for this project is C. Data must be replicated with one-hour recovery point objective.

This risk means that:

•The recovery point objective (RPO) is a business requirement that defines the maximum acceptable amount of data loss in case of a disaster or failure. It is measured in time units, such as minutes, hours, or days.

•The data replication is a technical solution that allows you to create replicas of your running workloads on another host or site. It is used for disaster recovery purposes, as it enables you to quickly fail over and fail back in case of a disaster.

•The one-hour RPO is a challenging and demanding requirement that may be difficult toachieve or maintain, depending on various factors, such as the data change rate, the available bandwidth, the replication frequency, etc.

•The one-hour RPO may also conflict or contradict with other requirements or expectations, such as the backup window, the backup retention, the backup storage capacity, etc.

This risk has some implications for designing a solution with Veeam products and features, such as:

•The customer or a third-party vendor must monitor and measure the data change rate of the workloads that need to be replicated, as well as the available bandwidth between sites. This will help to plan and optimize the replication infrastructure, such as the proxy servers, repository servers, WAN accelerators, and failover plans, based on the data change rate.

•The customer or a third-party vendor must configure and adjust the replication settings and policies, such as the replication method, schedule, frequency, retention, compression, deduplication, etc., based on the one-hour RPO. This will help to improve the replication performance and efficiency, as well as to meet the RPO requirement.

•The customer or a third-party vendor must test and verify the replication results and processes, as well as perform regular failover and failback drills. This will help to ensure the reliability and consistency of the replicas, as well as to validate and improve the RPO achievement.

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to gather some information during the discovery phase. This information will help you to understand the current state of the environment, the goals and expectations of the stakeholders, and the constraints and challenges of the project.

According to the Veeam Backup & Replication Best Practice Guide1, some of the information that is necessary for designing a solution and must be gathered during discovery are:

•Operating systems used to run the workloads. This information will help you to determine the compatibility and supportability of the workloads with Veeam products and features, as well as the licensing and configuration requirements.

•Allowed backup windows. This information will help you to plan and schedule the backup jobs according to the availability and performance of the workloads, as well as the service level agreements (SLAs) and recovery point objectives (RPOs) of the organization.

•Amount of used disk space. This information will help you to estimate the backup storage requirements, as well as the backup compression and deduplication ratios, based on the type and size of the data.

To design a solution that meets the SureBackup job design requirements for Veeam University Hospital, you need to consider some of the environmental parameters that may affect the possible SureBackup job design. This will help you to ensure the functionality and reliability of the SureBackup feature, which allows you to verify the recoverability of your backups in an isolated environment.

According to the Veeam Backup & Replication Best Practice Guide, some of the environmental parameters that may affect the possible SureBackup job design are:

•Virtual machines are stored on VMware encrypted datastores. This parameter may affect the possible SureBackup job design because VMware encrypted datastores require special handling and configuration for backup and restore operations. You need to enable encryption support in the backup infrastructure settings, as well as provide the necessary credentials and permissions for accessing the encrypted datastores. You also need to ensure that the virtual lab where the SureBackup jobs run supports encrypted datastores, which may require additional resources and licenses.

•Each site has 20 vLANs in use, with 16 being used for VMware workloads. This parameter may affect the possible SureBackup job design because vLANs require network mapping and routing for backup and restore operations. You need to configure the network settings and rules for the virtual lab where the SureBackup jobs run, as well as for the application group and backup job that are included in the SureBackup job. You also need to ensure that the network isolation and connectivity are maintained and tested for the virtual machines that are verified by the SureBackup job.

WAN accelerators are dedicated components that Veeam Backup & Replication uses for WAN acceleration. WAN accelerators are responsible for global data caching and data deduplication, which reduce the amount of data that needs to be transferred over the network. By adding WAN accelerators to each site, you can improve the performance of backup copy jobs between sites, and reduce the bandwidth consumption and network traffic3

References:

1: Gateway Server - User Guide for VMware vSphere 2: Gateway Server - User Guide for VMware vSphere 3: WAN Accelerators - User Guide for VMware vSphere

To design a solution that meets the virtual infrastructure requirements for Veeam University Hospital, you need to collect some information during the discovery phase. This information will help you to understand the configuration and performance of the VMware clusters, the size and type of the data, and the backup and recovery objectives.

According to the Veeam Backup & Replication Best Practice Guide, some of the information related to the virtual infrastructure that is missing and must be collected during the discovery phase are:

•Local area network speed. This information will help you to determine the network bandwidth and throughput that are available for backup and replication traffic, as well as the impact of backup and replication activities on the network performance and latency.

•Size of the source data set. This information will help you to estimate the backup storage requirements, as well as the backup compression and deduplication ratios, based on the size and type of the data.

Therefore, the correct answer is A and D.

To design a solution that meets the backup retention requirements for Veeam University Hospital, you need to consider the minimum requirement for on-premises backup retention for this project. This will help you to ensure the availability and reliability of your backup data, as well as the compliance and security of your backup storage.

According to the case study, the minimum requirement for on-premises backup retention for this project is B. On-premises retention must be 14 daily, and two weekly backups.

This requirement means that:

•The on-premises backup retention is the policy that defines how long the backup data should be kept on the local backup storage, such as NFS storage, deduplication appliance, etc.

•The on-premises backup retention must be 14 daily and two weekly backups, which means that you need to keep at least 14 copies of the daily backups and two copies of the weekly backups on the local backup storage.

•The on-premises backup retention must be applied to all types of workloads that are backed up by Veeam Backup & Replication, such as virtual machines, physical servers, NAS systems, etc.

This requirement is based on the business and compliance needs of Veeam University Hospital, which are:

•To have a fast and reliable restore option for the most recent backups in case of a disaster or failure.

•To comply with the HIPAA regulations that require health care organizations to retain backup data for at least six years1.

To design a solution that meets the backup and replication requirements for Veeam University Hospital, you need to consider some of the components that are needed for the on-premises design. This will help you to ensure the performance and reliability of the backup and replication operations, as well as the scalability and manageability of the backup infrastructure.

According to the Veeam Backup & Replication Best Practice Guide1, some of the components that are needed for the on-premises design are:

•Backup server. This is the core component of Veeam Backup & Replication that controls and coordinates backups, replication, recovery verification, and restore tasks. It also manages backup infrastructure components, such as proxy servers, repository servers, WAN accelerators, etc. You need to have a backup server at each site, as recommended by the best practice guide2.

•Backup proxy. This is a component that retrieves data from the source host, processes it and transfers to the backup repository. It also performs data compression, deduplication, encryption, etc. You need to have at least one backup proxy at each site, as recommended by the best practice guide3.

•Backup repository. This is a server where Veeam Backup & Replication keeps backup files, backup copies and metadata of replicated VMs. It can be a Windows or Linux server, a NAS device, a deduplication appliance, etc. You need to have at least one backup repository at each site, as recommended by the best practice guide4.

•Mount server. This is a component that mounts backup files from the backup repository to the backup proxy during restore operations. It also performs data decompression, deduplication, decryption, etc. You need to have a mount server at each site where you plan to perform restores, as recommended by the best practice guide5.

•Gateway server. This is a component that acts as a data mover between the backup proxy and the backup repository when they are located in different sites or networks. It also performs data encryption and decryption for secure data transfer. You need to have a gateway server at each site where you have a backup repository that is accessed by a remote backup proxy, as recommended by the best practice guide.

Therefore, based on these components, the answer that describes which components are needed for the on-premises design is D. Backup server, backup proxy, backup repository, mount server, gateway server.

To design a solution that meets the replication requirement for Veeam University Hospital, you need to consider some of the mitigating techniques that might be required for the virtual machines that have several separate large VMDKs with a high change rate per virtual machine on the same datastore. This will help you to overcome some of the challenges and limitations that may affect the replication performance and efficiency, as well as the recovery point objective (RPO) of the organization.

According to the Veeam Backup & Replication Best Practice Guide, some of the mitigating techniques that might be required are:

•Implement WAN accelerator. This technique can help you to reduce the amount of data that needs to be transferred and processed between the source and target sites, by using caching, deduplication, compression, and encryption. You need to deploy a pair of WAN accelerators, one at the source site and one at the target site, and configure them in the replication job settings. This technique can improve the replication speed and efficiency, as well as save network bandwidth and storage space.

•Recommend migrating some of the VMDKs to alternative datastores. This technique can help you to avoid performance degradation and resource contention on the source datastore, by distributing the load and I/O across multiple datastores. You need to use VMware tools or commands, such as Storage vMotion or svmotion, to migrate some of the VMDKs to other datastores that have enough capacity and performance. This technique can improve the replication stability and reliability, as well as reduce the impact on the production environment.

Therefore, based on these techniques, the answer that describes which mitigating techniques might be required is A and C.

The Veeam feature that can be used to help achieve compliance with privacy regulations is location tags on repositories. Location tags are labels that can be assigned to backup repositories to indicate their physical or logical location, such as country, region, or data center1. Location tags can help ensure that backup data is stored and processed in compliance with data residency and privacy laws, such as GDPR or CCPA, by allowing backup administrators to create backup policies based on the location of the source and target data2. The other options are not related to privacy compliance, as they are either used for network optimization (preferred networks), server identification (location tags on Veeam Backup & Replication servers), or backup scope (location tags on subnets). References: Location Tags, Using Location Tags.

The additional condition of the offsite backup that is presumed by the immutability requirement is that a copy of backup data must reside in a public cloud local to each region. Immutability means that the backup data cannot be modified, deleted, or overwritten by anyone, including the backup administrator, the cloud provider, or malicious actors1. Veeam Backup & Replication v11 supports immutability for backups stored in Amazon S3 and Microsoft Azure Blob Storage, using the Object Lock feature2. Therefore, the offsite backup must use one of these cloud providers, and must be located in the same region as the source data, to comply with the data locality and privacy laws. The other options are not related to the immutability requirement, as they are either already stated in the business requirements (option A), technical requirements (option B), or not relevant for the Veeam solution (option C). References: Immutability, Object StorageImmutability.

The best way to accomplish the goal of ensuring backups are free of malware before data is restored is to ensure a compatible antivirus solution is available on mount servers for secure restores. Secure restore is a feature of Veeam Backup & Replication that allows you to scan backup files for malware before performing a restore operation, using a built-in or third-party antivirus solution1. Mount servers are components of Veeam Backup & Replication that mount backup files to the backup server or backup proxy2. By having a compatible antivirus solution on mount servers, you can leverage the secure restore feature to check the backup data for malware and prevent any infection from spreading to the production environment. The other options are either not feasible (option A and B, as staged restore and Veeam Data Integration API are not designed for malware detection34) or not sufficient (option C, as Veeam Data Integration API alone cannot scan backup files for malware). References: Secure Restore, Mount Servers, Staged Restore, Veeam Data Integration API.

The Veeam component that will be required at each site for disaster recovery with a one minute recovery point objective is the Veeam CDP proxy. Veeam CDP proxy is a data mover that transfers data between the source and target hosts, using VMware vSphere APIs for I/O Filtering (VAIO) to capture the changes in real time1. Veeam CDP proxy can achieve near-zero recovery point objectives for business critical virtual machines, as well as provide short-term restore points and data encryption2. The other components are not required for this scenario, as they are used for different purposes, such as guest processing, backup storage, or backup jobs3. References: VMware CDP Proxies, Continuous Data Protection, Backup Proxies.

The information related to the virtual infrastructure that is missing and must be collected during the discovery are the total number of virtual machines and the size of the source data set. These are essential metrics for sizing the backup components, such as proxies, repositories, and transporters, as well as estimating the backup storage requirements and bandwidth consumption. The other options are either already provided in the scenario (recovery time objective, backup window) or not relevant for the Veeam solution (speed of Fibre Channel fabric). References: Veeam Certified Architect 2022 Exam Guide, page 10; Veeam Backup & Replication v11: Architecture and Design course, module 3.

Database administrators and operations team are the most relevant stakeholders to talk to in order to collect business and technical requirements related to virtual infrastructure. Database administrators can provide information about the performance, availability, and recovery needs of the SQL and Oracle servers, as well as the custom financial application on AIX servers. Operations team can provide information about the network bandwidth, firewall rules, storage capacity, and backup windows for the virtual machines and NAS devices. The other stakeholders are less relevant, as they are either not directly involved with the virtual infrastructure (web design team, sales staff) or have minimal requirements (laptop users). References: Veeam Certified Architect 2022 Exam Guide, page 8; Veeam Backup & Replication v11: Architecture and Design course, module 2.

The tiers of Veeam Financial Services’ backups that will require SureBackup jobs are the silver and gold tiers. SureBackup jobs are used to verify the recoverability of backup files by running virtual machines from backups in an isolated environment and performing tests against live applications1. This feature is suitable for the silver and gold tiers, which have recovery time objectives of six hours and 30 minutes, respectively, and require backups to be verified. The bronze tier, which consists of development machines and field portables, has a recovery point target of seven days, with no recovery time target set, and does not require backup verification. Therefore, SureBackup jobs are not necessary for the bronze tier. Laptop backups are performed by Veeam Agent for Microsoft Windows, which does not support SureBackup jobs2. References: SureBackup, Veeam Agent for Microsoft Windows.

Data scrubbing is the process of removing sensitive or confidential data from backups before restoring them, to comply with regulatory or legal requirements1. Veeam Backup & Replication supports data scrubbing for VMware VMs by using a custom script that runs inside the virtual lab2.

To perform data scrubbing, you need to create a virtual lab, an application group, and a SureBackup job. The virtual lab is a fenced-off environment where you can test and verify your backups without affecting the production network3. The application group is a collection of VMs that you want to restore and scrub. The SureBackup job is a task that automates the verification and restoration of VMs in the virtual lab.

The custom script is a PowerShell script that you need to write and configure to run on the VMs in the application group. The script should perform the necessary actions to delete or modify the data that you want to scrub, such as files, folders, registry keys, database records, etc2. You can use the Veeam PowerShell snap-in to access the Veeam functionality and objects from the script.

You can find more information about data scrubbing and how to configure it in the Veeam Backup & Replication User Guide for VMware vSphere2.

The requirement C will act as a constraint on the decision of whether to use a local repository or not for the remote sites. Data locality and privacy laws may vary by country or region, and may impose restrictions on where the backup data can be stored or transferred. For example, some countries may prohibit the export of personal data outside their borders, or require encryption or anonymization of sensitive data. Therefore, the Veeam solution must comply with these laws and regulations, and may need to use a local repository for each remote site, or use a cloud provider that has a local presence in each region. The other requirements are not constraints, as they can be met with either a local or a central repository, using the features and options of the Veeam solution. References: Veeam Certified Architect 2022 Exam Guide, page 11; Veeam Backup & Replication v11: Architecture and Design course, module 5.

Immutable repositories are backup storage locations that prevent unauthorized modifications or deletions of backup data, ensuring its integrity and recoverability. Immutable repositories are essential for protecting backups against ransomware attacks, accidental deletions, or malicious insiders1.

Veeam Backup & Replication supports several types of immutable repositories, such as hardened repositories, immutable object storage repositories, and immutable deduplicating storage appliances2. Among these options, the best configuration for ensuring SLA compliance and providing protection against ransomware is to leverage hardened repositories at both primary and secondary sites, and offload to object storage in a public cloud with immutability enabled.

Hardened repositories are Linux-based repositories that use XFS file system with immutability flag to protect backup files from changes or removals. Hardened repositories can be used as primary or secondary backup targets, and can be combined with Veeam Scale-out Backup Repository to simplify backup management and optimize storage utilization3.

Object storage repositories are cloud-based repositories that use object storage services, such as Amazon S3, Microsoft Azure Blob Storage, or Google Cloud Storage, to store backup data. Object storage repositories can be used as secondary backup targets, and can leverage the immutability feature of the cloud provider to prevent backup data from being overwritten or deleted.

By using hardened repositories at both primary and secondary sites, you can achieve high availability and redundancy for your backup data, as well as fast and reliable restores. By offloading to object storage in a public cloud with immutability enabled, you can achieve long-term retention and compliance, aswell as cost savings and scalability. This configuration also follows the 3-2-1-1 backup rule, which recommends having three copies of data, on two different types of media, with one copy off-site and one copy immutable.

You can find more information about immutable repositories and how to configure them in the following resources:

• Immutable Backup Solutions: Linux Hardened Repository
• Unstructured Data Backups in Immutable Repositories
• Hardened Repository
• [Immutability for Object Storage Repositories]
• [3-2-1-1 Backup Rule]