Security and Immutability Flashcards

An administrator sets up a Linux Hardened Repository with a 10-day immutability period. A backup job targeting this repository has a retention policy of 7 days. On day 8, after a backup chain is complete, what is the expected outcome when Veeam attempts to delete the backup files according to the job's retention policy?

Answer: The deletion will fail because the file system's immutable flag (`chattr +i`) prevents modification or deletion by any user, including root, until the 10-day period expires.

The Linux Hardened Repository leverages the `chattr +i` command to set an immutable flag at the file system level. This OS-level protection overrides the application-level retention policy, preventing any user—including the root user—from deleting or modifying the file until the immutability period has passed. Veeam's retention process will fail for these files and will only succeed after day 10.

When configuring a Scale-Out Backup Repository (SOBR) Capacity Tier with Amazon S3, which native S3 feature must be enabled on the bucket beforehand to support Veeam's immutability functionality?

Answer: S3 Object Lock

Veeam leverages Amazon S3's native Object Lock feature to make backup data stored in the Capacity Tier immutable for a specified duration. While S3 Versioning is a mandatory prerequisite for enabling S3 Object Lock, Object Lock is the specific feature that provides the WORM (Write-Once-Read-Many) capability that Veeam utilizes to enforce immutability.

An administrator is enabling encryption for a new backup job to protect data at rest. Which of the following is a critical consequence of losing the encryption password?

Answer: If the password is lost and no password loss protection mechanism (like Veeam Backup Enterprise Manager) is in place, the data within the encrypted backup files is permanently unrecoverable.

Veeam's native backup file encryption is highly secure. There is no backdoor or master key. If the password is lost, the data is rendered inaccessible. The only safeguard is the Password Loss Protection feature, which requires Veeam Backup Enterprise Manager to be deployed and configured *before* the password is lost.

A critical VM was compromised by a virus. An administrator must restore it from a backup created before the infection, but they need to ensure the restored VM does not re-introduce the virus to the production network. Which Veeam feature is specifically designed to address this scenario?

Answer: Secure Restore

Secure Restore allows an administrator to trigger an antivirus scan on a backup before restoring it. Veeam mounts the backup to a mount server and uses an installed antivirus engine to scan the contents. If malware is found, the administrator can choose to abort the restore or restore the VM without network adapters connected, preventing the threat from spreading.

A company must archive backups for 10 years to meet compliance regulations, ensuring the data cannot be altered or deleted during this period. Which technology, when used in a Veeam tape job, provides hardware-enforced immutability?

Answer: WORM (Write Once, Read Many) Tapes

WORM (Write Once, Read Many) tapes are specifically designed for long-term, unalterable data archival. Once data is written to a WORM cartridge, the drive's firmware prevents it from being overwritten or erased, providing true, hardware-level immutability. While GFS media pools manage retention schedules and LTO-9 is a tape format, only WORM enforces the inability to change the written data.

A backup job targeting a Linux Hardened Repository uses a forward incremental chain. The repository is configured with a 15-day immutability period. What happens when Veeam attempts to perform a synthetic full or merge operation on backup files that are 10 days old?

Answer: The operation fails because the backup files (VBK and VIBs) are marked as immutable and cannot be modified or merged.

Synthetic full and merge operations require modifying existing backup files (specifically, the full VBK file). On a Linux Hardened Repository, these files are protected by the immutable flag (`chattr +i`) for the duration of the immutability period. The Linux kernel will block any attempts to write to or change these files, causing the merge or synthetic full operation to fail. The backup chain will grow with more incremental files until the immutability on the older restore points expires.