VMCE Security and Immutability 2 — Questions and Answers
Question 1: Which Veeam repository type natively supports immutability without requiring any additional third-party storage appliance?
- Windows Server with ReFS
- Linux hardened repository with XFS (Correct answer)
- SMB share with NTFS
- NetApp ONTAP with SnapVault
Correct answer: Linux hardened repository with XFS
A Linux hardened repository using XFS with immutability enabled is Veeam's native immutable backup storage solution requiring no third-party appliance.
Question 2: When configuring a hardened Linux repository, what is the minimum recommended approach for the service account used by Veeam?
- Use root account for full access
- Create a dedicated non-root account with limited sudo privileges (Correct answer)
- Use an LDAP-integrated admin account
- Use the default 'veeam' system account created during installation
Correct answer: Create a dedicated non-root account with limited sudo privileges
A dedicated non-root account with only the necessary sudo privileges reduces the attack surface on the hardened repository.
Question 3: What happens to immutable backups in a Linux hardened repository when the immutability period expires?
- They are automatically deleted by the Veeam server
- They revert to mutable status and follow normal retention policies (Correct answer)
- They require manual administrator action to delete
- They are automatically archived to tape
Correct answer: They revert to mutable status and follow normal retention policies
Once the immutability period expires, backup files become mutable again and are subject to standard Veeam retention policies.
Question 4: Which encryption mode in Veeam ensures that backup data stored on a repository is unreadable even if the physical media is stolen?
- In-flight encryption
- Storage-level encryption at rest (Correct answer)
- Source-side deduplication with AES
- Transport encryption via TLS 1.2
Correct answer: Storage-level encryption at rest
Storage-level (at-rest) encryption encrypts backup files on the repository, protecting data from physical media theft.
Question 5: In Veeam's four-eyes authorization model, what is required before a protected configuration setting can be changed?
- A second administrator must approve the change via a separate account (Correct answer)
- The primary admin must reboot the VBR server
- A support ticket must be opened with Veeam
- The backup job must be stopped first
Correct answer: A second administrator must approve the change via a separate account
Four-eyes authorization requires a second authorized administrator to confirm sensitive configuration changes, preventing single-point compromise.
Question 6: Which Veeam feature prevents ransomware from deleting or modifying backup files by making them read-only at the OS level for a defined period?
- Backup copy job GFS retention
- Immutability flag (chattr +i) on Linux hardened repository (Correct answer)
- Veeam Backup & Replication encrypted backup chain
- ReFS block-cloning on Windows
Correct answer: Immutability flag (chattr +i) on Linux hardened repository
Veeam uses the Linux 'chattr +i' immutability flag on XFS volumes to make backup files read-only at the OS level for the configured immutability window.
Question 7: What is the purpose of the 'Make recent backups immutable for X days' setting in a Linux hardened repository configuration?
- It delays deletion of backups for X days after the retention period ends
- It sets the chattr +i flag on new backup files for X days, preventing modification or deletion (Correct answer)
- It replicates backups to an offsite location for X days
- It enables encryption for backups created in the last X days
Correct answer: It sets the chattr +i flag on new backup files for X days, preventing modification or deletion
This setting applies the immutability flag to newly created backup files, ensuring they cannot be altered or deleted for the specified number of days.
