VEEAM VMCE_v12 Practice Exam Questions & Answers

To ensure that the VM data remains encrypted throughout the backup process, the job should be configured to use the proxies with the NBDSSL (Network Block Device SSL) transport mode. This mode encrypts data transferred over the network, adhering to the company policy that prioritizes data security. While DirectSAN Access is fast, it does not provide encryption of in-flight data. Reference:

Veeam Backup & Replication User Guide: Transport Modes

Veeam Best Practices: Securing Backup Traffic

In Veeam Backup & Replication, to meet the business requirements of having both the database backup and transaction logs stored at a secondary location, a Backup Copy Job can be configured. The Backup Copy Job can be set to include both the VM backup and the transaction logs, ensuring that the database's recovery points are consistent and available at the DR site. The transaction logs backup every 30 minutes can be specified as the source for the Backup Copy Job, ensuring that the transaction log backups are also copied to the secondary repository.

When configuring Veeam Backup & Replication in a VMware vSAN environment, the best practice is to use the Virtual Appliance transport mode. This mode is also referred to as 'hot-add' and allows the backup proxy to mount VM disks directly from the datastore. This method is more isolated from the VMkernel network traffic, as it does not require network connectivity to the hosts to retrieve data, thus providing a level of isolation that meets the requirement stated in the question. The Direct NFS and Direct SAN options are not applicable for vSAN, and Network mode would not provide the necessary isolation from VMkernel network traffic.

To provide immutable backups on a secondary site with a different media, the best option given the context is B: Create a Scale Out Backup Repository (SOBR) with the existing Microsoft Windows Server as the performance tier and an AWS S3 bucket with immutability enabled as the capacity tier.

This approach involves leveraging the existing backup infrastructure (Microsoft Windows Server with direct-attached storage) as the performance tier of the SOBR, where the most recent backups are stored for fast access. For long-term storage and immutability, backups can be offloaded to an AWS S3 bucket configured with Object Lock. The Object Lock feature in AWS S3 provides an additional layer of data protection by making the backup data immutable, meaning it cannot be deleted or modified for a specified duration. This setup ensures that backup data is protected against accidental deletion, ransomware, and other malicious activities.

By implementing this configuration, the engineer can achieve the desired level of data protection and immutability, utilizing cloud storage as a secure and scalable secondary backup location, distinct from the primary on-premises storage media.

To achieve the goal of recovering a single SQL Database in a consistent manner with minimal impact on the production environment during production hours, while allowing for granular restores through the Veeam console, the engineer should A: Schedule transaction log processing every 30 minutes. By enabling application-aware processing for the SQL VM and scheduling the main backup job to run every 24 hours, the base image of the SQL database is protected. However, to achieve a more granular Recovery Point Objective (RPO) and ensure the ability to restore to specific points in time, transaction log backups must be performed more frequently. Configuring the backup job to process transaction logs every 30 minutes captures the SQL database changes more frequently without the overhead of a full backup, allowing for point-in-time restores directly from the Veeam console without the need for SQL Management Studio (SSMS) or a Database Administrator (DBA). This setup aligns with the goals of maintaining operational efficiency and minimizing the impact on production while ensuring robust data protection capabilities.