Security and Immutability Flashcards
7 cards from real VMCE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Security and Immutability flashcards as text
Which port must be open between the Veeam Backup & Replication server and a hardened Linux repository for management traffic?
Answer: TCP 9401
TCP 9401 is used for management communication between the VBR server and Linux-based repository components.
When using Veeam with Object Storage as an immutable target (e.g., AWS S3 Object Lock), which lock mode should be used for the strongest ransomware protection?
Answer: Compliance mode
Compliance mode prevents any user, including root, from deleting or overwriting objects before the retention period expires, providing the strongest protection.
What is the role of the 'Veeam Configuration Backup' from a security standpoint?
Answer: It preserves VBR server settings, job configurations, and encryption keys for disaster recovery
Configuration backup saves VBR server settings and optionally encryption keys, enabling full disaster recovery of the backup infrastructure itself.
Which Veeam capability allows administrators to detect and alert on suspicious backup activity, such as unusually high data change rates that may indicate ransomware encryption?
Answer: Veeam ONE anomaly detection
Veeam ONE includes anomaly detection that monitors backup metrics and alerts on unusual change rates that may signal an active ransomware attack.
In Veeam's security hardening guidance, why is it recommended to isolate the backup network from the production network?
Answer: To prevent ransomware or attackers on the production network from reaching backup infrastructure directly
Network isolation ensures that even if ransomware compromises production systems, it cannot directly communicate with or attack the backup infrastructure.
What does enabling 'per-machine backup files' on a repository do from a security perspective?
Answer: Stores each machine's backups in separate files, limiting blast radius if one backup chain is corrupted
Per-machine backup files isolate each workload's backup chain so that corruption or ransomware affecting one chain does not impact others on the same repository.
Which Veeam security feature requires administrators to provide a reason and obtain approval before accessing or restoring sensitive backup data?
Answer: Four-eyes authorization for restore operations
Four-eyes authorization for restores enforces a dual-approval workflow, ensuring sensitive data access is reviewed and justified by a second administrator.