💾 ToastVault
Home · Blueprint

Section 2 Deployment, Configuration & Security

Exam weight 20%

trapmemorisedefault valuetiplab Rate yourself: ○ not yet · ◐ shaky · ● know it (saved in this browser)

  1. 2.1 Installing the backup server
  2. 2.2 Backup infrastructure components
  3. 2.3 Scale-Out Backup Repository (SOBR)
  4. 2.4 Hardened repository and immutability
  5. 2.5 Security features
  6. 2.6 Security best practices

Objective 2.1 Installing the backup server

2 cards practice questions

On the official blueprint

• Install the backup server
• Configure backup server, proxy, repository and SOBR
• Hardened repository
• Immutability
• Security features: MFA, encryption, Credential Manager, roles and permissions
• Security best practices

2.1.1 Installing the backup server

Two deployment options in v13:

• Windows installable software: the traditional installer.
• Veeam Software Appliance (VSA): a Linux-based (JeOS, “just enough OS”) appliance, pre-hardened and updated by Veeam. You manage the OS through Host Management on port 10443.

NEW

The VSA requires MFA for administrator and Security Officer accounts. The Security Officer role approves high-risk actions such as deleting backups.

NEW

High Availability: two VSA nodes in an active/passive cluster. Requires VSA 13.0.1+ and the Veeam Data Platform Premium edition.

DEFAULT

The configuration database is PostgreSQL by default (since v12). Microsoft SQL Server is still supported on Windows installs.

NEW

Veeam Infrastructure Appliance: the same hardened Linux base, used for proxies and hardened repositories. Added with certificate-based authentication instead of SSH single-use credentials. Can only be added to VBR v13.

Official docs for 2.1 (1)

Objective 2.2 Backup infrastructure components

practice questions

2.2.1 Backup infrastructure components

• Backup server · Job: The brain: schedules jobs, holds the configuration database, coordinates everything.
• Backup proxy · Job: Reads source data, compresses and deduplicates it, sends it to the repository. Types: VMware, Hyper-V off-host, file (NAS), CDP.
• Backup repository · Job: Stores backup files. Windows, Linux, hardened Linux, SMB, NFS, dedupe appliance or object storage.
• Gateway server · Job: Runs the Data Mover for repositories that cannot run one themselves (SMB shares, dedupe appliances, object storage).
• Mount server · Job: Mounts backups for file-level restore and Instant Recovery (vPower NFS).
• Guest interaction proxy · Job: Deploys the runtime process into guests for application-aware processing and indexing.
• WAN accelerator · Job: Needed at both ends. Cuts traffic for backup copy and replication over slow links.

Official docs for 2.2 (1)

Objective 2.3 Scale-Out Backup Repository (SOBR)

2 cards practice questions

2.3.1 Scale-Out Backup Repository (SOBR)

A SOBR groups several repositories into one logical target.

• Performance tier: the extents (normal repositories) where backups land first.
• Capacity tier: object storage. Two policies: Copy: copies every new backup to object storage as soon as it is created.
• Move: moves backups older than the operational restore window (N days). Only inactive (sealed) chains can be moved.

Archive tier: cold object storage (for example S3 Glacier or Azure Archive) for long-term GFS fulls.

MEMORISE

Placement policies: Data locality keeps a chain's fulls and increments on the same extent. Performance puts fulls and increments on different extents.

TRAP

The move policy cannot move the active chain. If the chain never closes (forever forward incremental, no periodic fulls), nothing ever moves to the capacity tier.

Maintenance mode takes an extent out of service. Evacuate moves its backups to the other extents in the SOBR.

Official docs for 2.3 (2)

Objective 2.4 Hardened repository and immutability

4 cards practice questions

2.4.1 Hardened repository and immutability

A hardened repository is a Linux repository that makes backup files immutable: they cannot be modified or deleted until a set date, even by root through Veeam or by an attacker who owns the backup server.

• Filesystem: XFS with fast clone (reflink) enabled.
• Single-use credentials: used once to deploy the Data Mover, never saved in the configuration database. If the backup server is compromised, the attacker has no credentials for the repository.
• Immutability uses the Linux immutable file attribute, managed by a Veeam service on the repository.
• No other roles can be assigned to a hardened repository.

MEMORISE

Immutability period: minimum 7 days, maximum 9999 days. Set per repository.

MEMORISE

The period is extended for the whole active chain, so increments cannot be orphaned. GFS fulls stay immutable for their GFS retention period.

TRAP

Supported backup method: forward incremental with periodic active or synthetic fulls. Reverse incremental and forever forward incremental are not supported, because both rewrite the full backup file.

TRAP

Changing the immutability period applies only to new backups, not to files already written.

Object storage gets immutability through S3 Object Lock (or the vendor equivalent). Enable it when the bucket is created.

Official docs for 2.4 (2)

Objective 2.5 Security features

4 cards practice questions

2.5.1 Security features

• MFA: TOTP-based multi-factor authentication for console users (since v12).
• Four-eyes authorization: a second administrator must approve destructive actions such as deleting backups (since v12.1).
• Encryption: AES-256. Three places: backup file encryption (job setting, password-based), network traffic encryption between components, and tape encryption.
• Credential Manager: stores every account Veeam uses, encrypted in the configuration database.
• Roles: Veeam Backup Administrator, Backup Operator, Restore Operator, Backup Viewer, Tape Operator.

NEW

v13 RBAC adds custom roles with scoped permissions, plus SAML 2.0 single sign-on for both the web UI and the console.

TRAP

Lose the encryption password and the backup cannot be restored, unless password loss protection through Enterprise Manager was configured beforehand.

TRAP

A configuration backup includes stored credentials only if the configuration backup itself is encrypted.

DEFAULT

Network traffic encryption is enabled by default for traffic going to and from public networks.

Official docs for 2.5 (2)

Objective 2.6 Security best practices

practice questions

2.6.1 Security best practices

• Keep the backup server out of the production domain (a separate management domain or workgroup).
• Turn on MFA and four-eyes authorization. Use least-privilege roles.
• Keep at least one copy immutable or offline.
• Encrypt backups and configuration backups.
• Run the built-in Security & Compliance Analyzer and fix what it reports.
• Patch Veeam and the OS promptly.

Official docs for 2.6 (1)