VMCE Security and Immutability 5 — Questions and Answers
Question 1: When a Veeam hardened Linux repository is configured, which SSH authentication method is recommended over password authentication?
- Kerberos ticket-based authentication
- SSH public key authentication (Correct answer)
- LDAP-bound authentication via sssd
- Certificate-based authentication via a CA
Correct answer: SSH public key authentication
SSH public key authentication is recommended because it eliminates password-based brute-force risks and is the standard for securing Linux server access.
Question 2: Which Veeam feature allows you to verify that a backup is actually recoverable by automatically booting the VM in an isolated environment and running tests?
- Secure Restore
- SureBackup with DataLabs (Correct answer)
- Instant VM Recovery
- Backup Verification Assistant
Correct answer: SureBackup with DataLabs
SureBackup uses DataLabs to automatically boot backed-up VMs in an isolated virtual lab and run configurable verification tests to confirm recoverability.
Question 3: In a 3-2-1-1-0 backup rule as implemented by Veeam, what does the final '0' represent?
- Zero backups older than one year
- Zero unverified backups — all backups must pass automated recovery verification (Correct answer)
- Zero backups stored without encryption
- Zero recovery point objectives exceeded
Correct answer: Zero unverified backups — all backups must pass automated recovery verification
The '0' in the 3-2-1-1-0 rule means zero errors on restore verification — every backup must be tested and proven recoverable.
Question 4: Which setting prevents the Veeam Backup & Replication service account from being used interactively to log into Windows servers, reducing lateral movement risk?
- Enable Windows Firewall on VBR server
- Deny local logon and remote desktop rights to the service account via Group Policy (Correct answer)
- Enable RBAC on the VBR console
- Use a managed service account (gMSA) for the VBR service
Correct answer: Deny local logon and remote desktop rights to the service account via Group Policy
Denying interactive logon rights to the VBR service account via Group Policy prevents attackers who steal the account from using it to pivot to other systems.
Question 5: What is the consequence of losing the encryption password for an encrypted Veeam backup if no password hint or key recovery option was configured?
- Veeam support can decrypt the backup using your license key
- The backup data is permanently inaccessible and cannot be recovered (Correct answer)
- The VBR server can regenerate the key from the configuration database
- You can reset the password using the Veeam Backup Enterprise Manager
Correct answer: The backup data is permanently inaccessible and cannot be recovered
AES-256 encrypted backups without a recoverable key or password hint are permanently inaccessible — Veeam has no backdoor to decrypt them.
Question 6: Which Veeam component acts as a centralized password management store that can recover encryption keys from multiple VBR servers in an enterprise environment?
- Veeam ONE
- Veeam Backup Enterprise Manager (Correct answer)
- Veeam Agent Management Server
- Veeam Cloud Connect
Correct answer: Veeam Backup Enterprise Manager
Veeam Backup Enterprise Manager can store encryption key hints and enable password recovery across multiple VBR servers when configured before data loss occurs.
Question 7: When configuring immutability on a Linux hardened repository, which filesystem must be used to support the immutability flag?
- ext4
- XFS (Correct answer)
- Btrfs
- ZFS
Correct answer: XFS
Veeam's Linux hardened repository immutability feature requires XFS as the underlying filesystem to support the chattr +i immutability flag correctly.
VMCE Security and Immutability 5
When a Veeam hardened Linux repository is configured, which SSH authentication method is recommended over password authentication?