VMCE Security and Immutability 3 — Questions and Answers
Question 1: Which port must be open between the Veeam Backup & Replication server and a hardened Linux repository for management traffic?
- TCP 443
- TCP 9401 (Correct answer)
- TCP 2500-3300
- TCP 6180
Correct answer: TCP 9401
TCP 9401 is used for management communication between the VBR server and Linux-based repository components.
Question 2: When using Veeam with Object Storage as an immutable target (e.g., AWS S3 Object Lock), which lock mode should be used for the strongest ransomware protection?
- Governance mode
- Compliance mode (Correct answer)
- Legal hold mode
- Versioning-only mode
Correct answer: Compliance mode
Compliance mode prevents any user, including root, from deleting or overwriting objects before the retention period expires, providing the strongest protection.
Question 3: What is the role of the 'Veeam Configuration Backup' from a security standpoint?
- It backs up all VM data to an encrypted offsite location
- It preserves VBR server settings, job configurations, and encryption keys for disaster recovery (Correct answer)
- It creates a snapshot of the Linux hardened repository
- It exports RBAC roles to Active Directory
Correct answer: It preserves VBR server settings, job configurations, and encryption keys for disaster recovery
Configuration backup saves VBR server settings and optionally encryption keys, enabling full disaster recovery of the backup infrastructure itself.
Question 4: Which Veeam capability allows administrators to detect and alert on suspicious backup activity, such as unusually high data change rates that may indicate ransomware encryption?
- Veeam ONE anomaly detection (Correct answer)
- Veeam DataLabs SureBackup verification
- Veeam Agent threat monitoring
- Veeam Backup & Replication job reporting
Correct answer: Veeam ONE anomaly detection
Veeam ONE includes anomaly detection that monitors backup metrics and alerts on unusual change rates that may signal an active ransomware attack.
Question 5: In Veeam's security hardening guidance, why is it recommended to isolate the backup network from the production network?
- To increase backup throughput by eliminating network contention
- To prevent ransomware or attackers on the production network from reaching backup infrastructure directly (Correct answer)
- To comply with GDPR data segregation requirements
- To allow Veeam to use faster UDP-based protocols
Correct answer: To prevent ransomware or attackers on the production network from reaching backup infrastructure directly
Network isolation ensures that even if ransomware compromises production systems, it cannot directly communicate with or attack the backup infrastructure.
Question 6: What does enabling 'per-machine backup files' on a repository do from a security perspective?
- Encrypts each VM's backup separately with a unique key
- Stores each machine's backups in separate files, limiting blast radius if one backup chain is corrupted (Correct answer)
- Enables immutability on a per-machine basis rather than per-repository
- Allows each machine to authenticate independently to the repository
Correct answer: Stores each machine's backups in separate files, limiting blast radius if one backup chain is corrupted
Per-machine backup files isolate each workload's backup chain so that corruption or ransomware affecting one chain does not impact others on the same repository.
Question 7: Which Veeam security feature requires administrators to provide a reason and obtain approval before accessing or restoring sensitive backup data?
- RBAC with least privilege
- Four-eyes authorization for restore operations (Correct answer)
- Backup encryption with key escrow
- Secure Restore with antivirus scanning
Correct answer: Four-eyes authorization for restore operations
Four-eyes authorization for restores enforces a dual-approval workflow, ensuring sensitive data access is reviewed and justified by a second administrator.
VMCE Security and Immutability 3
Which port must be open between the Veeam Backup & Replication server and a hardened Linux repository for management traffic?