VMCE Security and Immutability 2 — Questions and Answers
Question 1: Which Veeam repository type natively supports immutability without requiring any additional third-party storage appliance?
- Windows Server with ReFS
- Linux hardened repository with XFS (Correct answer)
- SMB share with NTFS
- NetApp ONTAP with SnapVault
Correct answer: Linux hardened repository with XFS
A Linux hardened repository using XFS with immutability enabled is Veeam's native immutable backup storage solution requiring no third-party appliance.
Question 2: When configuring a hardened Linux repository, what is the minimum recommended approach for the service account used by Veeam?
- Use root account for full access
- Create a dedicated non-root account with limited sudo privileges (Correct answer)
- Use an LDAP-integrated admin account
- Use the default 'veeam' system account created during installation
Correct answer: Create a dedicated non-root account with limited sudo privileges
A dedicated non-root account with only the necessary sudo privileges reduces the attack surface on the hardened repository.
Question 3: What happens to immutable backups in a Linux hardened repository when the immutability period expires?
- They are automatically deleted by the Veeam server
- They revert to mutable status and follow normal retention policies (Correct answer)
- They require manual administrator action to delete
- They are automatically archived to tape
Correct answer: They revert to mutable status and follow normal retention policies
Once the immutability period expires, backup files become mutable again and are subject to standard Veeam retention policies.
Question 4: Which encryption mode in Veeam ensures that backup data stored on a repository is unreadable even if the physical media is stolen?
- In-flight encryption
- Storage-level encryption at rest (Correct answer)
- Source-side deduplication with AES
- Transport encryption via TLS 1.2
Correct answer: Storage-level encryption at rest
Storage-level (at-rest) encryption encrypts backup files on the repository, protecting data from physical media theft.
Question 5: In Veeam's four-eyes authorization model, what is required before a protected configuration setting can be changed?
- A second administrator must approve the change via a separate account (Correct answer)
- The primary admin must reboot the VBR server
- A support ticket must be opened with Veeam
- The backup job must be stopped first
Correct answer: A second administrator must approve the change via a separate account
Four-eyes authorization requires a second authorized administrator to confirm sensitive configuration changes, preventing single-point compromise.
Question 6: Which Veeam feature prevents ransomware from deleting or modifying backup files by making them read-only at the OS level for a defined period?
- Backup copy job GFS retention
- Immutability flag (chattr +i) on Linux hardened repository (Correct answer)
- Veeam Backup & Replication encrypted backup chain
- ReFS block-cloning on Windows
Correct answer: Immutability flag (chattr +i) on Linux hardened repository
Veeam uses the Linux 'chattr +i' immutability flag on XFS volumes to make backup files read-only at the OS level for the configured immutability window.
Question 7: What is the purpose of the 'Make recent backups immutable for X days' setting in a Linux hardened repository configuration?
- It delays deletion of backups for X days after the retention period ends
- It sets the chattr +i flag on new backup files for X days, preventing modification or deletion (Correct answer)
- It replicates backups to an offsite location for X days
- It enables encryption for backups created in the last X days
Correct answer: It sets the chattr +i flag on new backup files for X days, preventing modification or deletion
This setting applies the immutability flag to newly created backup files, ensuring they cannot be altered or deleted for the specified number of days.
VMCE Security and Immutability 2
Which Veeam repository type natively supports immutability without requiring any additional third-party storage appliance?