VMCE Security and Immutability Questions and Answers — Questions and Answers
Question 1: An administrator sets up a Linux Hardened Repository with a 10-day immutability period. A backup job targeting this repository has a retention policy of 7 days. On day 8, after a backup chain is complete, what is the expected outcome when Veeam attempts to delete the backup files according to the job's retention policy?
- The deletion will succeed because the Veeam retention policy is shorter than the immutability period.
- The deletion will fail because the file system's immutable flag (`chattr +i`) prevents modification or deletion by any user, including root, until the 10-day period expires. (Correct answer)
- Veeam will automatically remove the immutable flag to perform the deletion and then log the action.
- The files will be moved to a temporary location until the immutability period expires, after which they will be permanently deleted.
Correct answer: The deletion will fail because the file system's immutable flag (`chattr +i`) prevents modification or deletion by any user, including root, until the 10-day period expires.
The Linux Hardened Repository leverages the `chattr +i` command to set an immutable flag at the file system level. This OS-level protection overrides the application-level retention policy, preventing any user—including the root user—from deleting or modifying the file until the immutability period has passed. Veeam's retention process will fail for these files and will only succeed after day 10.
Question 2: When configuring a Scale-Out Backup Repository (SOBR) Capacity Tier with Amazon S3, which native S3 feature must be enabled on the bucket beforehand to support Veeam's immutability functionality?
- S3 Glacier Deep Archive
- S3 Cross-Region Replication
- S3 Object Lock (Correct answer)
- S3 Versioning
Correct answer: S3 Object Lock
Veeam leverages Amazon S3's native Object Lock feature to make backup data stored in the Capacity Tier immutable for a specified duration. While S3 Versioning is a mandatory prerequisite for enabling S3 Object Lock, Object Lock is the specific feature that provides the WORM (Write-Once-Read-Many) capability that Veeam utilizes to enforce immutability.
Question 3: An administrator is enabling encryption for a new backup job to protect data at rest. Which of the following is a critical consequence of losing the encryption password?
- The password can be reset from the target repository's host operating system.
- Restore operations can proceed without the password, but job modifications will be blocked.
- If the password is lost and no password loss protection mechanism (like Veeam Backup Enterprise Manager) is in place, the data within the encrypted backup files is permanently unrecoverable. (Correct answer)
- Veeam support can provide a universal key to decrypt the backup files after identity verification.
Correct answer: If the password is lost and no password loss protection mechanism (like Veeam Backup Enterprise Manager) is in place, the data within the encrypted backup files is permanently unrecoverable.
Veeam's native backup file encryption is highly secure. There is no backdoor or master key. If the password is lost, the data is rendered inaccessible. The only safeguard is the Password Loss Protection feature, which requires Veeam Backup Enterprise Manager to be deployed and configured *before* the password is lost.
Question 4: A critical VM was compromised by a virus. An administrator must restore it from a backup created before the infection, but they need to ensure the restored VM does not re-introduce the virus to the production network. Which Veeam feature is specifically designed to address this scenario?
- Instant VM Recovery to an isolated vSwitch
- Secure Restore (Correct answer)
- Staged Restore
- SureBackup
Correct answer: Secure Restore
Secure Restore allows an administrator to trigger an antivirus scan on a backup before restoring it. Veeam mounts the backup to a mount server and uses an installed antivirus engine to scan the contents. If malware is found, the administrator can choose to abort the restore or restore the VM without network adapters connected, preventing the threat from spreading.
Question 5: A company must archive backups for 10 years to meet compliance regulations, ensuring the data cannot be altered or deleted during this period. Which technology, when used in a Veeam tape job, provides hardware-enforced immutability?
- GFS Media Pools
- Tape Encryption
- LTO-9 Tapes
- WORM (Write Once, Read Many) Tapes (Correct answer)
Correct answer: WORM (Write Once, Read Many) Tapes
WORM (Write Once, Read Many) tapes are specifically designed for long-term, unalterable data archival. Once data is written to a WORM cartridge, the drive's firmware prevents it from being overwritten or erased, providing true, hardware-level immutability. While GFS media pools manage retention schedules and LTO-9 is a tape format, only WORM enforces the inability to change the written data.
Question 6: A backup job targeting a Linux Hardened Repository uses a forward incremental chain. The repository is configured with a 15-day immutability period. What happens when Veeam attempts to perform a synthetic full or merge operation on backup files that are 10 days old?
- The operation is queued and will execute automatically after the 15-day immutability period expires.
- The operation fails because the backup files (VBK and VIBs) are marked as immutable and cannot be modified or merged. (Correct answer)
- The operation succeeds, as synthetic operations are considered metadata changes and are exempt from immutability.
- A new active full backup is created automatically, and the old, immutable chain is left in place.
Correct answer: The operation fails because the backup files (VBK and VIBs) are marked as immutable and cannot be modified or merged.
Synthetic full and merge operations require modifying existing backup files (specifically, the full VBK file). On a Linux Hardened Repository, these files are protected by the immutable flag (`chattr +i`) for the duration of the immutability period. The Linux kernel will block any attempts to write to or change these files, causing the merge or synthetic full operation to fail. The backup chain will grow with more incremental files until the immutability on the older restore points expires.
VMCE Security and Immutability Questions and Answers
An administrator sets up a Linux Hardened Repository with a 10-day immutability period.
A backup job targeting this repository has a retention policy of 7 days.
On day 8, after a backup chain is complete, what is the expected outcome when Veeam attempts to delete the backup files according to the job's retention policy?