VMCE Security and Immutability 4 — Questions and Answers
Question 1: What does Veeam's Secure Restore feature do before mounting a restored VM to the production environment?
- Verifies backup file checksums against the original
- Scans restored VM content with an antivirus engine to detect malware before bringing the VM online (Correct answer)
- Validates the VM's OS license against Microsoft KMS
- Tests network connectivity from the restored VM to all production hosts
Correct answer: Scans restored VM content with an antivirus engine to detect malware before bringing the VM online
Secure Restore integrates with antivirus software to scan restored VM disks for malware, preventing reinfection of the production environment from a compromised backup.
Question 2: In the context of Veeam RBAC, which built-in role should be assigned to a user who only needs to initiate restore operations but should not be able to modify or delete backup jobs?
- Veeam Backup Administrator
- Veeam Restore Operator (Correct answer)
- Veeam Backup Operator
- Veeam Tape Operator
Correct answer: Veeam Restore Operator
The Veeam Restore Operator role grants permissions to perform restores without allowing modification of backup infrastructure or jobs.
Question 3: When immutability is enabled on a Scale-Out Backup Repository (SOBR) with an object storage extent, which component enforces immutability?
- The SOBR policy engine on the VBR server
- The object storage service's native object lock (e.g., S3 Object Lock) (Correct answer)
- The Veeam Data Mover on the gateway server
- The Linux hardened repository used as a capacity tier cache
Correct answer: The object storage service's native object lock (e.g., S3 Object Lock)
When offloading to object storage, Veeam relies on the cloud provider's native object lock feature (such as S3 Object Lock) to enforce immutability on the capacity tier.
Question 4: What is the primary security reason for enabling MFA (multi-factor authentication) on the Veeam Backup & Replication console login?
- To encrypt the configuration database at rest
- To prevent unauthorized access to the VBR console even if credentials are stolen (Correct answer)
- To satisfy the immutability verification requirement
- To enable automatic session timeout after inactivity
Correct answer: To prevent unauthorized access to the VBR console even if credentials are stolen
MFA adds a second verification factor so that stolen credentials alone are insufficient for an attacker to gain access to the VBR management console.
Question 5: Which encryption algorithm does Veeam use to encrypt backup data when backup encryption is enabled?
- RSA-2048
- AES-256 (Correct answer)
- 3DES-168
- ChaCha20-Poly1305
Correct answer: AES-256
Veeam uses AES-256 encryption for backup data, which is the current industry standard for strong symmetric encryption.
Question 6: A hardened Linux repository should NOT have which of the following installed to reduce its attack surface?
- OpenSSH server for Veeam management access
- X Window System (GUI) and unnecessary packages (Correct answer)
- XFS filesystem tools required for immutability
- Perl runtime used by Veeam data mover
Correct answer: X Window System (GUI) and unnecessary packages
GUI environments and unnecessary packages expand the attack surface; a hardened repository should run a minimal OS with only required components installed.
Question 7: What is the effect of enabling 'Encrypt backup traffic' in a Veeam job targeting a remote repository over a WAN link?
- It applies AES-256 encryption to backup files stored on the repository
- It encrypts backup data in transit between the source and repository using TLS (Correct answer)
- It enables both in-flight and at-rest encryption simultaneously
- It compresses the backup stream before encrypting it with RSA
Correct answer: It encrypts backup data in transit between the source and repository using TLS
Enabling backup traffic encryption secures data in transit with TLS, protecting backup streams from interception on untrusted networks like the internet.
VMCE Security and Immutability 4
What does Veeam's Secure Restore feature do before mounting a restored VM to the production environment?