To design a solution that meets the needs and requirements of Veeam University Hospital, you need to gather some information during the discovery phase. This information will help you to understand the current state of the environment, the goals and expectations of the stakeholders, and the constraints and challenges of the project.

According to the Veeam Backup & Replication Best Practice Guide1, some of the information that is necessary for designing a solution and must be gathered during discovery are:

•Operating systems used to run the workloads. This information will help you to determine the compatibility and supportability of the workloads with Veeam products and features, as well as the licensing and configuration requirements.

•Allowed backup windows. This information will help you to plan and schedule the backup jobs according to the availability and performance of the workloads, as well as the service level agreements (SLAs) and recovery point objectives (RPOs) of the organization.

•Amount of used disk space. This information will help you to estimate the backup storage requirements, as well as the backup compression and deduplication ratios, based on the type and size of the data.

Based on the customer Windows and Linux file server backup requirements, the best component to help them meet their stated objectives is Backup Enterprise Manager with indexing enabled on virtual machine and Agent backups with RBAC policies. This is because:

•Backup Enterprise Manager allows the customer to manage and monitor backup jobs across multiple backup servers from a single web-based interface1.

•Indexing enables the customer to perform file-level recovery from the backups of Windows and Linux servers, as well as search for files across all backups2.

•RBAC policies allow the customer to delegate permissions to different users and groups for performing file-level recovery, based on their roles and restore scopes3.

References: 1: Veeam Backup Enterprise Manager Guide 2: Veeam Backup & Replication User Guide 3: Veeam Backup Enterprise Manager Guide > Configuring Accounts and Roles

•The RMAN plugin is a component that integrates Veeam Backup & Replication with Oracle RMAN, which is a native tool for Oracle backup and recovery12.

•The RMAN plugin allows you to use Oracle RMAN commands to back up and restore Oracle databases to Veeam backup repositories, as well as perform log shipping and point-in-time recovery12.

•The RMAN plugin supports Oracle databases running on any supported operating system or hypervisor, as well as physical servers or cloud environments12.

•The RMAN plugin leverages the features and benefits of Veeam Backup & Replication, such as compression, deduplication, encryption, scalability, and reliability12.

To design a solution that meets the immutability requirement for Veeam University Hospital, you need to consider how this constraint affects the other requirements and expectations of the customer. This will help you to avoid any conflicts or inconsistencies that may arise from applying immutability settings to the backup data.

According to the Veeam Backup & Replication Best Practice Guide, immutability is a feature that prevents backup files from being deleted or modified by anyone until the specified retention periodexpires. Immutability can be achieved by using S3 Object Lock or Hardened Repository, which are two different solutions that Veeam Backup & Replication supports.

Based on this definition, the requirement that is impacted by the immutability constraint is D. Backup must take advantage of public cloud storage for long-term retention.

This requirement is impacted by the immutability constraint because:

•Public cloud storage is a type of storage that is provided by a third-party service provider over the internet, such as Amazon S3, Microsoft Azure, Google Cloud, etc.

•Public cloud storage can be used for long-term retention, which is a policy that defines how long backup data should be kept for compliance or historical purposes, such as months, years, or decades.

•Public cloud storage can also support immutability, which is a feature that prevents backup data from being deleted or modified by anyone until the specified retention period expires, such as days, weeks, or months.

•However, not all public cloud storage providers or services support immutability, or support it in the same way. For example, Amazon S3 supports S3 Object Lock, which allows you to apply a legal hold or a retention period to individual objects or object versions. Microsoft Azure supports Immutable Blob Storage, which allows you to create time-based policies or legal holds for blob containers. Google Cloud supports Bucket Lock, which allows you to lock a bucket and prevent objects from being overwritten or deleted.

•Therefore, the choice of the public cloud storage provider or service may affect the immutability setting and requirement for the backup data. You need to verify and compare the compatibility and supportability of the public cloud storage providers or services with Veeam Backup & Replication and with the customer expectation.

•Backup copy jobs with GFS enabled. This type of job does not support using immutability from S3 Object Lock because it uses synthetic full backups, which require modifying existing backup files. Synthetic full backups are not compatible with immutability settings, as they violate the principle of not changing the backup files.

The Gateway Server is a component that acts as a data mover between the backup proxy and the NFS storage. By placing the backup proxy and the Gateway Server together at the source site, you can reduce the network traffic and latency between them, and improve the data transfer speed. The Gateway Server will read data from the NFS storage and send it to the backup proxy over a local connection, and the backup proxy will process and compress the data before sending it to the target site1

To design a solution that meets the SureBackup job design requirements for Veeam University Hospital, you need to consider some of the environmental parameters that may affect the possible SureBackup job design. This will help you to ensure the functionality and reliability of the SureBackup feature, which allows you to verify the recoverability of your backups in an isolated environment.

According to the Veeam Backup & Replication Best Practice Guide, some of the environmental parameters that may affect the possible SureBackup job design are:

•Virtual machines are stored on VMware encrypted datastores. This parameter may affect the possible SureBackup job design because VMware encrypted datastores require special handling and configuration for backup and restore operations. You need to enable encryption support in the backup infrastructure settings, as well as provide the necessary credentials and permissions for accessing the encrypted datastores. You also need to ensure that the virtual lab where the SureBackup jobs run supports encrypted datastores, which may require additional resources and licenses.

•Each site has 20 vLANs in use, with 16 being used for VMware workloads. This parameter may affect the possible SureBackup job design because vLANs require network mapping and routing for backup and restore operations. You need to configure the network settings and rules for the virtual lab where the SureBackup jobs run, as well as for the application group and backup job that are included in the SureBackup job. You also need to ensure that the network isolation and connectivity are maintained and tested for the virtual machines that are verified by the SureBackup job.

To design a solution that meets the replication requirement for Veeam University Hospital, you need to consider some of the mitigating techniques that might be required for the virtual machines that have several separate large VMDKs with a high change rate per virtual machine on the same datastore. This will help you to overcome some of the challenges and limitations that may affect the replication performance and efficiency, as well as the recovery point objective (RPO) of the organization.

According to the Veeam Backup & Replication Best Practice Guide, some of the mitigating techniques that might be required are:

•Implement WAN accelerator. This technique can help you to reduce the amount of data that needs to be transferred and processed between the source and target sites, by using caching, deduplication, compression, and encryption. You need to deploy a pair of WAN accelerators, one at the source site and one at the target site, and configure them in the replication job settings. This technique can improve the replication speed and efficiency, as well as save network bandwidth and storage space.

•Recommend migrating some of the VMDKs to alternative datastores. This technique can help you to avoid performance degradation and resource contention on the source datastore, by distributing the load and I/O across multiple datastores. You need to use VMware tools or commands, such as Storage vMotion or svmotion, to migrate some of the VMDKs to other datastores that have enough capacity and performance. This technique can improve the replication stability and reliability, as well as reduce the impact on the production environment.

Therefore, based on these techniques, the answer that describes which mitigating techniques might be required is A and C.

The additional condition of the offsite backup that is presumed by the immutability requirement is that a copy of backup data must reside in a public cloud local to each region. Immutability means that the backup data cannot be modified, deleted, or overwritten by anyone, including the backup administrator, the cloud provider, or malicious actors1. Veeam Backup & Replication v11 supports immutability for backups stored in Amazon S3 and Microsoft Azure Blob Storage, using the Object Lock feature2. Therefore, the offsite backup must use one of these cloud providers, and must be located in the same region as the source data, to comply with the data locality and privacy laws. The other options are not related to the immutability requirement, as they are either already stated in the business requirements (option A), technical requirements (option B), or not relevant for the Veeam solution (option C). References: Immutability, Object StorageImmutability.

Backup from storage snapshot is a feature of Veeam Backup & Replication that leverages the native snapshot capabilities of the storage system to create a consistent point-in-time copy of the VM data. Veeam Backup & Replication then reads data directly from the storage snapshot, bypassing the ESXi host and reducing the impact on the production environment1. Backup from storage snapshot is supported for VSAN datastores on NetApp, Nimble, Dell EMC, HPE, and Pure Storage systems2.

Using backup from storage snapshot for the virtualized stock trading application servers can improve the backup performance and reduce the latency, as it minimizes the time that the VM is running on a snapshot and avoids the network overhead of other transport modes3.

The other options are not recommended because:

• B) Implementing Veeam Agent on the virtualized stock trading application servers is not necessary, as Veeam Backup & Replication can protect VMware VMs without agents. Veeam Agent is mainly used for physical servers, workstations, or cloud instances4.
• C) Using Veeam Replication to create replicas of the virtualized stock trading application servers at the remote site, then back up the replicas is not optimal, as it adds more complexity and cost to the backup process. Veeam Replication is mainly used for disaster recovery purposes, not for backup5.
• D) Turning off application-aware processing for the virtualized stock trading application servers is not advisable, as it may compromise the consistency and recoverability of the application data. Application-aware processing is a feature of Veeam Backup & Replication that ensures that the application data is in a consistent state before the backup or replication job starts.

You can find more information about backup from storage snapshot and other backup options for VSAN in the following resources:

• Backup from Storage Snapshots
• Storage Systems Supported for Backup from Storage Snapshots
• Optimizing Veeam Backup & Replication Configuration for VMware VSAN
• Veeam Agent Management
• Veeam Replication
• [Application-Aware Processing]

If you separated the large VMDKs into their own backup jobs, you would be creating more manual work for the backup administrator, who would have to configure and maintain multiple jobs for the same group of VMs. This would go against the requirement of reducing administrative overhead by using dynamic scoping.

Dynamic scoping is a feature of Veeam Backup & Replication that allows you to automatically include or exclude VMs from backup jobs based on tags, attributes, or policies1. For example, you can use VMware tags to assign a backup policy to a VM, and then use the tag as a filter in the backup job. This way, any VM with that tag will be automatically added to the backup job, and any VM without that tag will be automatically excluded. This simplifies the backup management and ensures that all VMs are protected according to their assigned policy.

For large VMDKs with high I/O, you can use alternative backup methods to avoid performance impact and stuns, such as storage snapshots, direct SAN access, or hot-add2. You can also use different storage optimization options to balance the deduplication ratio and the backup file size3. These options can be configured within the same backup job, without the need to separate the large VMDKs.

You can find more information about dynamic scoping and backup methods for large VMDKs in the following resources:

• How to Use Dynamic Scoping in Veeam Backup & Replication
• Backing up large vmdks (~12 TB)
• Backup strategies for a large VM

The requirement C will act as a constraint on the decision of whether to use a local repository or not for the remote sites. Data locality and privacy laws may vary by country or region, and may impose restrictions on where the backup data can be stored or transferred. For example, some countries may prohibit the export of personal data outside their borders, or require encryption or anonymization of sensitive data. Therefore, the Veeam solution must comply with these laws and regulations, and may need to use a local repository for each remote site, or use a cloud provider that has a local presence in each region. The other requirements are not constraints, as they can be met with either a local or a central repository, using the features and options of the Veeam solution. References: Veeam Certified Architect 2022 Exam Guide, page 11; Veeam Backup & Replication v11: Architecture and Design course, module 5.

Backup from Storage Snapshots and Direct NFS are the preferred processing modes for NFS datastores, as they offer the best performance and reliability for backup and restore operations12.

Backup from Storage Snapshots is a feature of Veeam Backup & Replication that leverages the native snapshot capabilities of the storage system to create a consistent point-in-time copy of the VM data. Veeam Backup & Replication then reads data directly from the storage snapshot, bypassing the ESXi host and reducing the impact on the production environment3. Backup from Storage Snapshots is supported for NFS datastores on NetApp, Nimble, Dell EMC, HPE, and Pure Storage systems4.

Direct NFS is a proprietary transport mode of Veeam Backup & Replication that uses a native NFS client deployed on the backup proxy to read and write data directly from and to the NFS datastore. Veeam Backup & Replication also bypasses the ESXi host and reduces the load on the production environment. Direct NFS is supported for NFS datastores on any storage system that supports NFS version 3 or 4.1.

The other options are not preferred because:

• B) Network (NBD) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network. This mode produces additional load on the ESXi host and the network, and may result in slower backup and restore performance.
• C) Virtual Appliance (HotAdd) mode is a transport mode that uses the VMware VDDK to attach the disks of the processed VM to the backup proxy VM. This mode also produces additional load on the ESXi host and the network, and may cause issues with disk alignment or SCSI controller limitations.
• D) Network mode with Encryption (NBDSSL) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network with SSL encryption. This mode provides an extra layer of security, but also adds more overhead and reduces the backup and restore performance.

You can find more information about the processing modes and how to choose the best one for your environment in the following resources:

• Transport Modes
• Selecting a Transport Mode
• Backup from Storage Snapshots
• Storage Systems Supported for Backup from Storage Snapshots
• [Direct NFS Access]
• [Network Mode]
• [Virtual Appliance Mode]
• [Network Mode with Encryption]

The retention requirement for this project is 12 weekly backups, six monthly backups and seven yearly backups. This is stated in the business requirements section of the scenario, where it says “To meet regulatory requirements, backups must be retained for four years.” This implies that the backup data must be archived for long-term retention, and the Veeam solution supports the 3-2-1 rule, which means having three copies of data, on two different types of media, with one copy off-site1. The other options are not retention requirements, but rather technical requirements or design choices, such as having on-premises backups on hardened repositories, having at least one copy of data on-premises, or having 14 daily backups on-site. References: Veeam Certified Architect 2022 Exam Guide, page 9; Veeam Backup & Replication v11: Architecture and Design course, module 4.

The Veeam feature that can be used to help achieve compliance with privacy regulations is location tags on repositories. Location tags are labels that can be assigned to backup repositories to indicate their physical or logical location, such as country, region, or data center1. Location tags can help ensure that backup data is stored and processed in compliance with data residency and privacy laws, such as GDPR or CCPA, by allowing backup administrators to create backup policies based on the location of the source and target data2. The other options are not related to privacy compliance, as they are either used for network optimization (preferred networks), server identification (location tags on Veeam Backup & Replication servers), or backup scope (location tags on subnets). References: Location Tags, Using Location Tags.

Database administrators and operations team are the most relevant stakeholders to talk to in order to collect business and technical requirements related to virtual infrastructure. Database administrators can provide information about the performance, availability, and recovery needs of the SQL and Oracle servers, as well as the custom financial application on AIX servers. Operations team can provide information about the network bandwidth, firewall rules, storage capacity, and backup windows for the virtual machines and NAS devices. The other stakeholders are less relevant, as they are either not directly involved with the virtual infrastructure (web design team, sales staff) or have minimal requirements (laptop users). References: Veeam Certified Architect 2022 Exam Guide, page 8; Veeam Backup & Replication v11: Architecture and Design course, module 2.

Immutable repositories are backup storage locations that prevent unauthorized modifications or deletions of backup data, ensuring its integrity and recoverability. Immutable repositories are essential for protecting backups against ransomware attacks, accidental deletions, or malicious insiders1.

Veeam Backup & Replication supports several types of immutable repositories, such as hardened repositories, immutable object storage repositories, and immutable deduplicating storage appliances2. Among these options, the best configuration for ensuring SLA compliance and providing protection against ransomware is to leverage hardened repositories at both primary and secondary sites, and offload to object storage in a public cloud with immutability enabled.

Hardened repositories are Linux-based repositories that use XFS file system with immutability flag to protect backup files from changes or removals. Hardened repositories can be used as primary or secondary backup targets, and can be combined with Veeam Scale-out Backup Repository to simplify backup management and optimize storage utilization3.

Object storage repositories are cloud-based repositories that use object storage services, such as Amazon S3, Microsoft Azure Blob Storage, or Google Cloud Storage, to store backup data. Object storage repositories can be used as secondary backup targets, and can leverage the immutability feature of the cloud provider to prevent backup data from being overwritten or deleted.

By using hardened repositories at both primary and secondary sites, you can achieve high availability and redundancy for your backup data, as well as fast and reliable restores. By offloading to object storage in a public cloud with immutability enabled, you can achieve long-term retention and compliance, aswell as cost savings and scalability. This configuration also follows the 3-2-1-1 backup rule, which recommends having three copies of data, on two different types of media, with one copy off-site and one copy immutable.

You can find more information about immutable repositories and how to configure them in the following resources:

• Immutable Backup Solutions: Linux Hardened Repository
• Unstructured Data Backups in Immutable Repositories
• Hardened Repository
• [Immutability for Object Storage Repositories]
• [3-2-1-1 Backup Rule]

Reducing the recovery point objective (RPO) for silver tier workloads means that the backup frequency will increase, resulting in more backup data being generated and transferred. This will affect the sizing requirements of the Veeam components that are responsible for storing and processing the backup data, namely the Veeam repository and proxy roles1.

The Veeam repository is a storage location where the backup files are stored. The repository size depends on the amount of data to be backed up, the backup method, the retention policy, and the compression and deduplication settings2. Reducing the RPO will increase the amount of data to be backed up, and may require more frequent synthetic full backups or active full backups to maintain the retention policy. This will increase the repository size and the disk space consumption.

The Veeam proxy is a data mover that performs backup, replication, and restore tasks. The proxy size depends on the number of concurrent tasks, the transport mode, the backup method, and the compression and deduplication settings3. Reducing the RPO will increase the number of concurrent tasks and the amount of data to be processed by the proxy. This will increase the proxy size and the CPU and memory consumption.

You can find more information about the sizing requirements and best practices for the Veeam repository and proxy roles in the following resources:

• Veeam Backup & Replication Best Practices
• Veeam Backup Repository Sizing Calculator
• Veeam Proxy Sizing Calculator

The best way to accomplish the goal of ensuring backups are free of malware before data is restored is to ensure a compatible antivirus solution is available on mount servers for secure restores. Secure restore is a feature of Veeam Backup & Replication that allows you to scan backup files for malware before performing a restore operation, using a built-in or third-party antivirus solution1. Mount servers are components of Veeam Backup & Replication that mount backup files to the backup server or backup proxy2. By having a compatible antivirus solution on mount servers, you can leverage the secure restore feature to check the backup data for malware and prevent any infection from spreading to the production environment. The other options are either not feasible (option A and B, as staged restore and Veeam Data Integration API are not designed for malware detection34) or not sufficient (option C, as Veeam Data Integration API alone cannot scan backup files for malware). References: Secure Restore, Mount Servers, Staged Restore, Veeam Data Integration API.

The reason that justifies the decision to separate out proxies for gold tier and silver/bronze tier is that gold tier virtual machines run frequently and should not share resources with lower priority virtual machines. This is because gold tier virtual machines have a high RPO of one hour or less, which means that they need to run backup jobs more often than silver/bronze tier virtual machines. Therefore, they should have dedicated proxies that can process their data without competing with other backup jobs for proxy resources. This can improve backup performance, reliability, and scalability for gold tier virtual machines.

If the repositories are able to accomplish much higher throughput, a new issue that might come up is that the bandwidth between sites might not be sufficient to support the backup copy jobs that need to run daily between Fresno and Carson City. This could cause the backup copy jobs to fail, take longer than expected, or consume too much network resources. Therefore, it is important to measure the available bandwidth between the sites and compare it with the backup copy data size and window. If the bandwidth is not sufficient, some possible solutions are to use compression, deduplication, or WAN acceleration to reduce the backup copy traffic.

The recommended step that Veeam Life and Indemnity can take to improve the latency encountered during backup of the virtualized MSSQL Server database running on vSAN is to implement Veeam Agent for Microsoft Windows on the virtualized MSSQL Server database servers. Veeam Agent for Microsoft Windows is a data protection solution that allows you to back up physical or virtual Windows machines at the guest OS level. Veeam Agent for Microsoft Windows can provide application-aware processing and transaction log backup for MSSQL servers, as well as support for vSAN storage snapshots. Veeam Agent for Microsoft Windows can also reduce the latency by performing backups without using VMware snapshots, which can cause stun issues on vSAN.

A possible issue that could arise if you put the backup repositories in the backup network only is that laptop agents cannot communicate with the repository. This is because laptop agents are not part of the backup network, which is non-routable according to the existing technical environment.Therefore, laptop agents cannot access or write data to the backup repositories in the backup network unless there is a proxy or gateway server that can bridge the communication between them.

References: [Veeam Agents Management Guide], [Veeam Backup Infrastructure Sizing Calculator]

The repository type that will be most impacted by using Veeam’s native encryption is dedupe repositories. Dedupe repositories are backup repositories that use deduplication appliances or software to reduce backup size and optimize storage utilization. However, if you use Veeam’s native encryption for backup jobs that target dedupe repositories, you will lose most of the deduplication benefits, as encrypted data blocks cannot be deduplicated effectively. Therefore, it is recommended to use either the encryption feature of the deduplication device or software, or avoid encryption altogether for dedupe repositories.

The component that can help meet the requirement of alternative decryption capabilities on encrypted backups in the event of lost passwords is Veeam Backup Enterprise Manager. Veeam Backup Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides a password loss protection feature that enables authorized users to restore encrypted backups without entering passwords if they forget or lose them. This feature requires enabling password loss protection in Veeam Backup Enterprise Manager settings and assigning a security officer role to a user who can approve password recovery requests.

References: [Veeam Backup Enterprise Manager], [Password Loss Protection]

The factor that should be considered in the physical design when implementing backup copy jobs between sites is to use physical servers for the Veeam backup proxies at each site. A Veeam backup proxy is a data mover component that performs data processing and transfer tasks for backup and backup copy jobs. A physical server is preferred over a virtual server for better performance, reliability, and isolation. A physical server can also leverage hardware encryption offload to reduce CPU load and network traffic encryption to secure data in transit.

The best way to configure backups for a group of MSSQL systems running in an Always-On cluster and sensitive to virtual machine stun is to deploy Veeam agents configured for failover clustering. Veeam agents can provide application-aware processing and transaction log backup for MSSQL servers, as well as support for failover clustering and cluster shared volumes. Veeam agents can also reduce the impact of virtual machine stun by performing backups at the guest OS level, without using VMware snapshots.

The component that should be deployed based on the customer’s security requirements around restore capabilities is Enterprise Manager with granular RBAC policies defined. Enterprise Manager is a web-based interface that allows centralized management of multiple Veeam backup servers. It also provides granular RBAC policies that enable control over user permissions and access to restore data. For example, you can assign different roles to different users or groups based on their responsibilities and needs, such as backup administrator, restore operator, security officer, etc. You can also define custom scopes and rules for each role to limit their access to specific objects, jobs, or actions.

The configuration that would verify the SLA compliance during audits and protection against exposure to personally identifiable information in the event of exposure is to create a virtual lab environment and periodically perform staged restores with custom scripts. A virtual lab is an isolated environment where you can run your backups or replicas without affecting the production environment. A staged restore is a process that allows you to run custom scripts on the restored data before publishing it to the production environment. By using these features, you can demonstrate that your backups are recoverable and compliant with legal regulations, as well as remove or mask any sensitive data before restoring it.