VMCE Security and Immutability Questions and Answers

Question 1

An administrator sets up a Linux Hardened Repository with a 10-day immutability period. A backup job targeting this repository has a retention policy of 7 days. On day 8, after a backup chain is complete, what is the expected outcome when Veeam attempts to delete the backup files according to the job's retention policy?

Accepted Answer

The deletion will fail because the file system's immutable flag (`chattr +i`) prevents modification or deletion by any user, including root, until the 10-day period expires.

Answer

The Linux Hardened Repository leverages the `chattr +i` command to set an immutable flag at the file system level. This OS-level protection overrides the application-level retention policy, preventing any user—including the root user—from deleting or modifying the file until the immutability period has passed. Veeam's retention process will fail for these files and will only succeed after day 10.

Question 2

When configuring a Scale-Out Backup Repository (SOBR) Capacity Tier with Amazon S3, which native S3 feature must be enabled on the bucket beforehand to support Veeam's immutability functionality?

Accepted Answer

S3 Object Lock

Answer

Veeam leverages Amazon S3's native Object Lock feature to make backup data stored in the Capacity Tier immutable for a specified duration. While S3 Versioning is a mandatory prerequisite for enabling S3 Object Lock, Object Lock is the specific feature that provides the WORM (Write-Once-Read-Many) capability that Veeam utilizes to enforce immutability.

Question 3

An administrator is enabling encryption for a new backup job to protect data at rest. Which of the following is a critical consequence of losing the encryption password?

Accepted Answer

If the password is lost and no password loss protection mechanism (like Veeam Backup Enterprise Manager) is in place, the data within the encrypted backup files is permanently unrecoverable.

Answer

Veeam's native backup file encryption is highly secure. There is no backdoor or master key. If the password is lost, the data is rendered inaccessible. The only safeguard is the Password Loss Protection feature, which requires Veeam Backup Enterprise Manager to be deployed and configured *before* the password is lost.

Question 4

A critical VM was compromised by a virus. An administrator must restore it from a backup created before the infection, but they need to ensure the restored VM does not re-introduce the virus to the production network. Which Veeam feature is specifically designed to address this scenario?

Accepted Answer

Secure Restore

Answer

Secure Restore allows an administrator to trigger an antivirus scan on a backup before restoring it. Veeam mounts the backup to a mount server and uses an installed antivirus engine to scan the contents. If malware is found, the administrator can choose to abort the restore or restore the VM without network adapters connected, preventing the threat from spreading.

Question 5

A company must archive backups for 10 years to meet compliance regulations, ensuring the data cannot be altered or deleted during this period. Which technology, when used in a Veeam tape job, provides hardware-enforced immutability?

Accepted Answer

WORM (Write Once, Read Many) Tapes

Answer

WORM (Write Once, Read Many) tapes are specifically designed for long-term, unalterable data archival. Once data is written to a WORM cartridge, the drive's firmware prevents it from being overwritten or erased, providing true, hardware-level immutability. While GFS media pools manage retention schedules and LTO-9 is a tape format, only WORM enforces the inability to change the written data.

(VMCE) Veeam Certified Engineer Practice Test

(VMCE) Veeam Certified Engineer Practice Test

VMCE Security and Immutability Questions and Answers