💾 ToastVault
Home · Blueprint

Section 1 Fundamentals, Strategy & Design

Exam weight 14%

trapmemorisedefault valuetiplab Rate yourself: ○ not yet · ◐ shaky · ● know it (saved in this browser)

  1. 1.1 RPO, RTO and the 3-2-1-1-0 rule
  2. 1.2 Transport modes (VMware vSphere)
  3. 1.3 Ports you should know
  4. 1.4 Permissions
  5. 1.5 Designing a solution

Objective 1.1 RPO, RTO and the 3-2-1-1-0 rule

3 cards practice questions

On the official blueprint

• Define RPO and RTO
• Define transport modes
• Define ports
• Define permission requirements
• Identify business objectives
• Identify infrastructure requirements
• Identify workload protection requirements
• Design Veeam solutions

1.1.1 RPO, RTO and the 3-2-1-1-0 rule

RPO (Recovery Point Objective) is how much data you can afford to lose, measured in time. A nightly backup gives an RPO of up to 24 hours.

RTO (Recovery Time Objective) is how long the business can wait for the workload to come back.

MEMORISE

RPO = data loss. RTO = downtime. RPO looks backwards from the disaster. RTO looks forwards.

Pick the protection method from the targets:

• Backup job · Typical RPO: Hours · Typical RTO: Minutes (Instant Recovery) to hours (full restore)
• Replication job · Typical RPO: Minutes · Typical RTO: Minutes (power on the replica)
• CDP policy · Typical RPO: Seconds · Typical RTO: Minutes

MEMORISE

3-2-1-1-0: 3 copies of data, on 2 different media, 1 copy offsite, 1 copy offline / air-gapped / immutable, 0 errors after recovery verification (SureBackup).

• Air-gapped: No network path an attacker can use to reach the copy (tape on a shelf, rotated drives).
• Immutable: Cannot be changed or deleted until a set date, even by an admin.

Official docs for 1.1 (1)

Objective 1.2 Transport modes (VMware vSphere)

3 cards practice questions

1.2.1 Transport modes (VMware vSphere)

The transport mode is how the backup proxy reads VM disk data from the datastore. In automatic mode the proxy tries them in this order:

1. Direct storage access: the proxy reads straight from the storage. Two flavours: Direct SAN (FC / iSCSI) and Direct NFS. Fastest and no load on ESXi.
2. Virtual appliance (HotAdd): the proxy is a VM. The disks of the VM being backed up are hot-added to the proxy VM. The proxy must be able to see the same datastores.
3. Network (NBD): data comes through the ESXi management interface over TCP 902. Works everywhere. Slowest. Fallback when the others fail.

MEMORISE

Order of preference: Direct storage → Virtual appliance → Network. Network mode needs only TCP 902 from the proxy to ESXi.

TRAP

HotAdd needs the proxy to be a VM on a host that can access the source datastores. A physical proxy can never use HotAdd.

DEFAULT

“Failover to network mode if primary mode fails” is enabled on a proxy by default, so a job does not fail just because Direct SAN or HotAdd is unavailable.

Backup from Storage Snapshots reads from a storage-array snapshot instead of keeping a VMware snapshot open for the whole job, which shortens the time the VM runs on a snapshot.

Official docs for 1.2 (1)

Objective 1.3 Ports you should know

6 cards practice questions

1.3.1 Ports you should know

• Backup server / proxy → vCenter · Port: TCP 443 · Purpose: vSphere API
• Proxy → ESXi · Port: TCP 902 · Purpose: NFC data transfer (Network mode)
• Backup server → Windows component · Port: TCP 6160 · Purpose: Veeam Installer Service
• Between components · Port: TCP 6162 · Purpose: Veeam Data Mover (Transport) Service
• Between data movers · Port: TCP 2500–3300 · Purpose: Data transmission channels (older versions used 2500–5000)
• Tenant → cloud gateway · Port: TCP 6180 · Purpose: Cloud Connect
• Console / web UI → backup server (v13) · Port: TCP 443 · Purpose: Was 9392 in v12
• Browser → appliance Host Management · Port: TCP 10443 · Purpose: Veeam Software Appliance OS management

NEW

In v13 the backup console and the new web UI both talk to the backup server over 443. In v12 the console used 9392.

MEMORISE

6160 installs, 6162 moves data, 2500–3300 carries the data streams, 902 is ESXi NFC, 6180 is Cloud Connect.

Official docs for 1.3 (1)

Objective 1.4 Permissions

practice questions

1.4.1 Permissions

• vCenter account: an administrator account is simplest. A least-privilege role is supported if it has every privilege on Veeam's required-permissions list.
• Guest processing (Windows): an account with local Administrator rights in the guest OS.
• Guest processing (Linux): root, or an account that can sudo.
• Hardened repository: single-use credentials. Used once to deploy the Data Mover, then never stored. See Domain 2.

TRAP

If the guest credentials are wrong, the job may still finish with a warning and a crash-consistent backup instead of failing. Read every warning, not just the red errors.

Official docs for 1.4 (1)

Objective 1.5 Designing a solution

practice questions

1.5.1 Designing a solution

Design questions give you business requirements and ask which components and settings meet them. Work in this order:

1. Business objectives: RPO/RTO per tier, retention, compliance (for example, keep yearly backups for 7 years), budget.
2. Workload protection requirements: what is being protected (VMs, physical servers, NAS shares, databases, M365, cloud)?
3. Infrastructure requirements: proxy count and CPU, repository capacity and performance, network bandwidth between sites.
4. Components: backup server, proxies, repositories, a second copy (backup copy job / Cloud Connect / object storage / tape), and immutability.

MEMORISE

Proxies and repositories process work as tasks. One task is roughly one VM disk. A rule of thumb is one CPU core per concurrent task. Check the current Veeam sizing guidance before quoting an exact RAM figure.

DEFAULT

Since v12, new backup jobs use per-machine backup chains (a separate chain per VM) by default.

NEW

v13 adds a second way to deploy the backup server: the Veeam Software Appliance (Linux-based, pre-hardened). The Windows installable version is still available. Both run the same product code.

Official docs for 1.5 (1)