The backup repository design that would meet the security, throughput, and retention requirements is to use backup jobs to Hardened Linux XFS-based repositories at the same site as the source data and use Backup copy jobs to Hardened Linux XFS-based repositories at the secondary site. A Hardened Linux repository is a type of backup repository that provides immutability and ransomware protection for backup files by using XFS file system features and Linux access control mechanisms. A Backup copy job is a type of backup job that copies backups from one repository to another, either on-site or off-site, with different retention settings. By using these features, you can ensure that your backups are secure, efficient, and compliant with regulatory and business needs.

The transport modes that could be used during the redesign for gold tier virtual machines with a one-hour RPO are Virtual Appliance (HotAdd) and Backup from Storage Snapshots. A transport mode is a method of retrieving VM data from the source storage during backup or replication. Virtual Appliance (HotAdd) is a transport mode that allows a proxy server running on a VM to attach disks of another VM to itself via hot-add SCSI commands and read data directly from these disks. Backup from Storage Snapshots is a transport mode that allows a proxy server to retrieve data from storage snapshots created by supported storage systems without affecting the production VMs or hosts. Both transport modes can improve backup performance, reduce backup window, and minimize impact on the production environment.

The methods that should be used to scope virtual machine backups based on customer requirements are to create backups based on tags and to create backup jobs with same retention requirements. Creating backups based on tags allows dynamic scoping of backups based on VMware tags assignedto virtual machines. This can simplify backup management, as new or modified virtual machines will be automatically included or excluded from backup jobs based on their tags. Creating backup jobs with same retention requirements allows consistent application of backup policies based on the backup tiers defined by the customer. This can ensure compliance with regulatory and business needs, as different tiers of virtual machines will have different retention periods and restore points.

The types of jobs that do not support using immutability from S3 Object Lock or hardened repositories are NAS backups and Agent for Mac backups. These types of jobs do not have the option to enable immutability in their settings, unlike VMware, Hyper-V, Linux Agent, or Windows Agent backup jobs. Therefore, they cannot leverage the immutability feature of S3 Object Lock or hardened repositories to protect their backups from ransomware or malicious deletion.

References: [S3 Object Lock Immutability], [Hardened Linux Repository], [NAS Backup], [Agent for Mac]

The additional Veeam capabilities that must be included in the conceptual design for gold level systems are SureBackup and Secure Restore. SureBackup is a feature that allows you to automatically verify the recoverability of your backups by running them in an isolated virtual lab. This can help you meet the requirement of testing the gold tier backups to verify recoverability. Secure Restore is a feature that allows you to scan your backups for malware before restoring them to the production environment. This can help you meet the requirement of scanning all backups for malware before restoring.

References: [SureBackup], [Secure Restore]

The information related to sizing the NAS infrastructure that is missing and must be collected during the discovery are the size of the source data set and the recovery point objective (RPO). These information are important for designing and sizing the NAS backup jobs and repositories. For example, you can use the size of the source data set to estimate how much storage space and network bandwidth are required for backing up NAS devices. You can also use the RPO to determine how frequently you need to run NAS backup jobs and how many restore points you need to keep on the backup repositories.

The number of vSphere clusters and the total of virtual machines are important information related to the virtual infrastructure that are missing and must be collected during the discovery phase. These information can help you estimate the backup performance, scalability, and resource requirements for the Veeam backup infrastructure. For example, you can use the number of vSphere clusters to determine how many Veeam backup servers and proxies you need to deploy and how to distribute the backup load among them. You can also use the total of virtual machines to calculate the total amount of data to be backed up, the storage space required, and the network bandwidth needed.

References: [Veeam Backup & Replication Best Practices], [Veeam Backup Infrastructure Sizing Calculator]

To design a solution that meets the needs and requirements of Veeam University Hospital, you need to gather some information during the discovery phase. This information will help you to understand the current state of the environment, the goals and expectations of the stakeholders, and the constraints and challenges of the project.

According to the Veeam Backup & Replication Best Practice Guide1, some of the information that is necessary for designing a solution and must be gathered during discovery are:

•Operating systems used to run the workloads. This information will help you to determine the compatibility and supportability of the workloads with Veeam products and features, as well as the licensing and configuration requirements.

•Allowed backup windows. This information will help you to plan and schedule the backup jobs according to the availability and performance of the workloads, as well as the service level agreements (SLAs) and recovery point objectives (RPOs) of the organization.

•Amount of used disk space. This information will help you to estimate the backup storage requirements, as well as the backup compression and deduplication ratios, based on the type and size of the data.

To access encrypted datastores in VMware, you need to use a transport mode that supports encryption. The following transport modes support encryption:

•Network mode with Encryption (NBDSSL): This mode uses an encrypted network connection between the backup proxy and the ESXi host to read and write data from the encrypted datastore. This mode does not require direct access to the datastore, but it can be slower than other modes due to network traffic and encryption overhead2

•Virtual Appliance (HotAdd) mode: This mode uses a virtual backup proxy that runs on an ESXi host and attaches virtual disks of the encrypted VMs to itself using the VMware vSphere API. This mode requires that the backup proxy and the source VMs reside on the same datastore or on datastores that are accessible by the same ESXi host. This mode can offer better performance than network mode, but it can also cause SCSI reservation conflicts if multiple backup proxies access the same datastore simultaneously3

•Direct SMB: This mode uses a physical backup proxy that accesses the encrypted datastore over the SMB protocol. This mode requires that the datastore is configured as an SMB share and that the backup proxy has read and write permissions on it. This mode can offer high performance and scalability, but it also requires additional configuration steps and security considerations4

The following transport modes do not support encryption:

•Network (NBD) mode: This mode uses an unencrypted network connection between the backup proxy and the ESXi host, which cannot access encrypted datastores2

•Direct SAN: This mode uses a physical backup proxy that accesses the encrypted datastore over the SAN fabric, which cannot decrypt encrypted data5

•Direct NFS: This mode uses a physical backup proxy that accesses the encrypted datastore over the NFS protocol, which does not support encryption6

References:

1: Hardened Repository - User Guide for VMware vSphere 2: Network Mode - User Guide for VMware vSphere 3: Virtual Appliance Mode - User Guide for VMware vSphere 4: Direct SMB Access Mode - User Guide for VMware vSphere 5: Direct SAN Access Mode - User Guide forVMware vSphere 6: Direct NFS Access Mode - User Guide for VMware vSphere

Backup from Storage Snapshots and Direct NFS are the preferred processing modes for NFS datastores, as they offer the best performance and reliability for backup and restore operations12.

Backup from Storage Snapshots is a feature of Veeam Backup & Replication that leverages the native snapshot capabilities of the storage system to create a consistent point-in-time copy of the VM data. Veeam Backup & Replication then reads data directly from the storage snapshot, bypassing the ESXi host and reducing the impact on the production environment3. Backup from Storage Snapshots is supported for NFS datastores on NetApp, Nimble, Dell EMC, HPE, and Pure Storage systems4.

Direct NFS is a proprietary transport mode of Veeam Backup & Replication that uses a native NFS client deployed on the backup proxy to read and write data directly from and to the NFS datastore. Veeam Backup & Replication also bypasses the ESXi host and reduces the load on the production environment. Direct NFS is supported for NFS datastores on any storage system that supports NFS version 3 or 4.1.

The other options are not preferred because:

• B) Network (NBD) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network. This mode produces additional load on the ESXi host and the network, and may result in slower backup and restore performance.
• C) Virtual Appliance (HotAdd) mode is a transport mode that uses the VMware VDDK to attach the disks of the processed VM to the backup proxy VM. This mode also produces additional load on the ESXi host and the network, and may cause issues with disk alignment or SCSI controller limitations.
• D) Network mode with Encryption (NBDSSL) mode is a transport mode that uses the VMware VDDK to communicate with the ESXi host over the network with SSL encryption. This mode provides an extra layer of security, but also adds more overhead and reduces the backup and restore performance.

You can find more information about the processing modes and how to choose the best one for your environment in the following resources:

• Transport Modes
• Selecting a Transport Mode
• Backup from Storage Snapshots
• Storage Systems Supported for Backup from Storage Snapshots
• [Direct NFS Access]
• [Network Mode]
• [Virtual Appliance Mode]
• [Network Mode with Encryption]

The additional information that is necessary for sizing the backup solution and must be gathered during further discovery are the amount of virtual machines to be protected and the total amount of production storage provisioned space. These metrics are used to calculate the backup storage requirements, the backup proxy and transporter resources, and the backup job configuration. The other options are either not relevant for sizing the backup solution (repository storage file system, replication schedule) or already provided in the scenario (the available bandwidth per site). References: Veeam Certified Architect 2022 Exam Guide, page 10; Veeam Backup & Replication v11: Architecture and Designcourse, module 3.