VMCE_v13 Practice Questions PDF

Prévia do material em texto

https://www.passcert.com/VMCE_v13.html
Page 2
15 questions selected from source version V8.02
VEEAM CERTIFIED ENGINEER PLUS
Question 1
Scenario: A company is configuring a Scale-Out Backup Repository (SOBR) with an Amazon S3 bucket as
the Capacity Tier. They want to ensure that data is completely protected from malicious deletion and strictly
follows Veeam's immutable best practices.
Which two settings must be configured across the AWS S3 bucket and the VBR console to successfully
enable Capacity Tier immutability? (Choose two)
A. The Amazon S3 bucket must have both Versioning and Object Lock enabled at the exact time of bucket
creation.
B. The "Make recent backups immutable" checkbox must be explicitly enabled within the Veeam Add
External Repository wizard.
C. The assigned AWS IAM user must strictly utilize the s3: BypassGovernanceRetention permission to allow
VBR to write data blocks.
D. The SOBR performance tier must be formatted with the XFS or ReFS file system to successfully pass the
immutable flags to the cloud tier.
E. The Veeam Backup & Replication server must install the AWS CLI software locally to execute the required
immutability API calls.
Answer: A, B
Explanation
Correct Logic (A, B): To support immutability in an AWS S3 Capacity Tier, the S3 bucket must be created with both
Versioning and Object Lock enabled from day one (AWS restriction). Furthermore, inside the VBR console, the administrator
must check the "Make recent backups immutable" option and specify the retention period in days when adding the object
storage repository. Veeam then manages the Object Lock compliance mode natively via its API integration.
Teardown of Distractors:
C is incorrect: Veeam uses Compliance mode, not Governance mode, for Object Lock. Providing bypass permissions defeats
the purpose of strict immutability.
D is incorrect: The file system of the local Performance Tier (ext4, NTFS, XFS, ReFS) has absolutely zero dependency or
impact on the object storage Capacity Tier's ability to use S3 Object Lock.
E is incorrect: VBR has native AWS S3 REST API integration built directly into its core services. It does not require or use the
AWS CLI tool to function.
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 3
VEEAM CERTIFIED ENGINEER PLUS
Question 2
Scenario: A customer wants to implement the "Four-Eyes Authorization" (Two-person control) feature
introduced in Veeam Data Platform v13. The goal is to prevent rogue administrators or compromised
accounts from silently deleting backup repositories, altering immutability settings, or changing retention
policies.
Which strict prerequisite condition must be met to successfully activate and utilize this security feature?
A. The Veeam Backup Enterprise Manager must be deployed and federated with the primary VBR server to
handle the approval workflows.
B. The VBR server must be directly integrated with an external Identity Provider (IdP) supporting SAML 2.0 or
OAuth authentication.
C. At least two distinct user accounts or Active Directory groups must be assigned the Veeam Backup
Administrator role within the console.
D. The primary backup repository must be configured with a hardware-based WORM appliance or a certified
Linux Hardened Repository.
Answer: C
Explanation
Correct Logic (C): Four-Eyes Authorization requires that when one administrator initiates a highly sensitive action (like
deleting a repository or changing a password), a second administrator must log in and approve the request. Therefore, it is a
hard prerequisite that at least two different users (or groups) possess the Veeam Backup Administrator role. If only one
admin exists, the feature cannot be enabled because there is no one else to approve the requests.
Teardown of Distractors:
A is incorrect: Four-Eyes Authorization is built directly into the VBR console and database. It does not require Enterprise
Manager to function.
B is incorrect: While MFA and IdP integrations are great security practices, Four-Eyes Authorization works natively with
standard Windows/Active Directory authentication and does not require an external IdP.
D is incorrect: This feature protects the VBR configuration and settings. It can be enabled regardless of what type of storage
repositories are deployed on the backend.
VEEAM CERTIFIED ENGINEER PLUS
Question 3
Scenario: An enterprise requires a complex retention policy for a critical database. The policy dictates 14
days of daily backups, 12 monthly backups, and 3 yearly backups. The storage repository is configured with
XFS and Fast Clone enabled. The customer notices that when a monthly backup is generated, the synthetic
full process completes instantly without moving data, but their repository storage consumption eventually
spikes heavily after several months of operation.
A. The XFS block cloning mechanism requires a proprietary defragmentation schedule that temporarily
doubles storage usage before releasing the deduplicated extents back to the file system.
B. The background synthetic process inherently uncompresses the Veeam proprietary backup blocks to
calculate the ReFS/XFS pointers, permanently altering the underlying volume footprint.
C. XFS Fast Clone only saves space as long as the referenced data blocks remain unchanged; over months
of database transactional changes, the divergence of unique blocks naturally consumes significant storage.
D. GFS retention rules applied to a primary backup job automatically disable Fast Clone integration to ensure
the long-term archival points are completely independent and self-sufficient.
Answer: C
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 4
Question 3 continued
Explanation
Correct Logic (C): Fast Clone (Block Cloning) via XFS or ReFS is incredibly efficient upon creation because it simply creates
metadata pointers to existing data blocks rather than duplicating them. However, as time passes-especially on highly
transactional database servers-the original blocks are modified or overwritten in production. As new, unique blocks are
ingested in subsequent backups, the shared pointers reference a shrinking percentage of the total data. The natural
divergence of data over months inherently leads to increased storage consumption, regardless of the initial Fast Clone
savings.
Teardown of Distractors:
A is incorrect: XFS does not require a proprietary Veeam defragmentation schedule that doubles storage usage. Block
cloning operates purely on metadata extents.
B is incorrect: Veeam does not uncompress data to calculate pointers. Fast Clone operates directly on the compressed data
blocks written to the repository.
D is incorrect: GFS (Grandfather-Father-Son) retention rules absolutely support and heavily rely on Fast Clone to save
space. Enabling GFS does not disable the integration.
VEEAM CERTIFIED ENGINEER PLUS
Question 4
Scenario: A managed service provider (MSP) uses Veeam ONE v13 to monitor a large customer
environment. The MSP wants to ensure they are proactively notified if a customer's environment is potentially
compromised by a "malicious insider" attempting to intentionally weaken the data protection and compliance
posture before launching an attack.
Which two specific Veeam ONE alarms should the MSP prioritize configuring to detect this exact type of
insider threat? (Choose two)
A. Veeam Backup repository immutability settings reduced or disabled.
B. Veeam Four-Eyes Authorization globally disabled or bypassed.
C. Suspicious virtual machine incremental backup size detected.
D. Veeam CDP proxy CPU usage consistently exceeded threshold.
E. Active orphaned virtual machine snapshots detected on datastore.
Answer: A, B
Explanation
Correct Logic (A, B): A malicious insider preparing for a ransomware attack or data destruction event will systematically
attempt to lower the defenses. In Veeam Data Platform v13, disabling the "Four-Eyes Authorization" (B) removes the
requirement for dual-admin approval, and reducing theimmutability period on a repository (A) allows them to prematurely
delete protected backups. Veeam ONE specifically tracks these administrative configuration changes to alert security teams
of insider sabotage.
Teardown of Distractors:
C is incorrect: The "Suspicious incremental backup size" alarm is highly valuable for detecting an active ransomware payload
(because encryption causes massive data churn), but it does not indicate a malicious insider weakening the administrative
posture before the attack.
D is incorrect: High CDP proxy CPU usage simply indicates undersized infrastructure or a sudden spike in production I/O. It
is a performance metric, not a security posture alert.
E is incorrect: Orphaned snapshots are a vSphere operational hazard that causes datastore space issues; they are not an
indicator of a malicious insider altering Veeam security settings.
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 5
VEEAM CERTIFIED ENGINEER PLUS
Question 5
Scenario: An enterprise customer needs to protect a 100TB corporate file share hosted on an SMB NAS
appliance. The compliance department requires that 30 days of daily file versions be kept on-premises for
rapid operational recovery, while yearly backups must be kept for 5 years on a cost-effective, long-term
storage tier (such as an AWS S3 Glacier bucket).
How should the Veeam administrator natively configure this specific retention policy?
A. Create a Scale-Out Backup Repository (SOBR) with the S3 Glacier bucket as the Capacity Tier, and rely
on the SOBR "Move" policy to automatically tier the NAS backups after 30 days.
B. Configure a standard Backup Copy Job linked to the primary NAS backup job, and explicitly enable the
Grandfather-Father-Son (GFS) yearly retention policy targeting the cloud repository.
C. Deploy a Veeam NAS Archive Proxy to autonomously intercept older SMB metadata blocks from the
primary repository and transmit them to the S3 Glacier bucket.
D. Configure the primary File Share Backup Job with a secondary destination targeting the S3 repository,
specifically configuring the "Archive for long-term retention" settings within the job.
Answer: D
Explanation
Correct Logic (D): Unstructured data (NAS/File Share) backups in Veeam do not use standard Backup Copy Jobs or SOBR
Capacity Tier offloading in the same way VM image-level backups do. To achieve long-term archival of file shares, you must
configure the native "Archive" tier directly within the settings of the File Share Backup Job itself. You specify a secondary
repository (like Object Storage) and define the retention policy (e.g., keeping yearly versions for 5 years).
Teardown of Distractors:
A is incorrect: SOBR Capacity Tier policies (Move/Copy) are designed for image-level backups (VMs, physical agents). They
do not govern the granular file-level archiving of the Veeam NAS backup engine.
B is incorrect: You cannot link a standard Backup Copy Job to a File Share Backup Job. NAS backups utilize an entirely
different backup structure and mechanism.
C is incorrect: There is no such component as a "NAS Archive Proxy" that autonomously intercepts blocks. The data
movement is controlled by the primary job configuration and executed by standard file proxies.
VEEAM CERTIFIED ENGINEER PLUS
Question 6
Scenario: A Linux virtual machine utilizing the XFS file system and Logical Volume Manager (LVM) requires
a granular file-level restore. The backup files are stored on a Windows Server 2022 Veeam repository. The
administrator initiates a "Guest files (Linux and other)" restore from the VBR console.
How does Veeam securely mount and read the Linux file system data from the Windows repository?
A. Veeam temporarily injects a compiled Linux kernel driver (vfs-mount) directly into the VBR Windows OS,
allowing native translation of the XFS metadata.
B. Veeam utilizes the VMware Tools API to execute localized bash commands inside the production VM to
extract the required files over the network.
C. Veeam automatically deploys and boots a temporary FLR (File-Level Recovery) Helper Appliance on a
designated ESXi host to mount the disks and present the files.
D. Veeam strictly requires the administrator to manually pre-install open-source XFS and LVM drivers onto
the Windows-based backup repository before initiating the restore.
Answer: C
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 6
Question 6 continued
Explanation
Correct Logic (C): Windows cannot natively read Linux file systems like XFS, ext4, or LVM structures. To overcome this
during a File-Level Restore, Veeam automatically deploys a tiny, customized Linux VM (the FLR Helper Appliance) onto the
vSphere infrastructure. Veeam mounts the backup disks to this appliance via vPower NFS, the appliance reads the Linux file
system, and then it serves the files back to the Veeam console so the administrator can browse and restore them.
Teardown of Distractors:
A is incorrect: Veeam does not inject custom Linux kernel drivers into the Windows OS to read file systems. It completely
isolates this process using the Helper Appliance.
B is incorrect: Veeam does not extract files by running bash commands inside the production VM. The restore happens from
the backup file, completely independent of the production VM's state.
D is incorrect: Administrators do not need to install third-party, open-source Linux drivers on their Windows Veeam servers.
The process is fully automated via the Helper Appliance.
VEEAM CERTIFIED ENGINEER PLUS
Question 7
Scenario: A critical production virtual machine protected by a Veeam Continuous Data Protection (CDP)
policy experiences a massive database index rebuild, generating millions of I/O operations within a few
minutes. The source ESXi host's local staging buffer quickly reaches its maximum capacity.
What happens to the Veeam CDP replication process during this specific storage I/O spike?
A. The Veeam Backup & Replication server automatically converts the CDP policy into a standard
snapshot-based replication job to consolidate the massive I/O churn over the network.
B. The VAIO filter driver seamlessly suspends the production virtual machine for a few seconds to force a
memory state flush, preventing the staging buffer from overflowing.
C. The VAIO filter driver stops intercepting new write I/O to protect production datastore performance,
causing the CDP policy to drop into an error state until a manual Active Full is triggered.
D. The VAIO filter driver stops intercepting new write I/O, the policy drops out of its SLA, and once the buffer
is flushed to the target, the policy transitions into a "Syncing" state to read the missed changes from the disk.
Answer: D
Explanation
Correct Logic (D): Veeam CDP prioritizes production performance above all else. If the local staging buffer on the source
ESXi host fills up completely (because the WAN or target storage cannot keep up with a massive I/O spike), the VAIO filter
driver will simply stop intercepting new I/O. The policy will miss its RPO SLA. However, it does not break permanently. Once
the spike subsides and the buffer clears, the CDP policy enters a "Syncing" state, where it reads the missed blocks directly
from the VMDK (like a standard incremental) to catch up, before returning to continuous I/O interception.
Teardown of Distractors:
A is incorrect: CDP policies never magically convert themselves into snapshot-based replication jobs. They are fundamentally
different architectures.
B is incorrect: VAIO will never suspend, stun, or pause a production virtual machine. Production uptime is strictly prioritized
over the replication SLA.
C is incorrect: The policy does not require a manual Active Full over the network to recover. The Syncing state automatically
handles the catch-up process natively.
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 7
VEEAM CERTIFIED ENGINEER PLUS
Question 8
Scenario: A service provider isprotecting tenant workloads using Veeam CDP over a dedicated WAN link.
The architect deploys a single CDP proxy at the source data center and a single CDP proxy at the target data
center. As the number of protected virtual machines grows, the source CDP proxy CPU spikes to 100%
continuously, and replication SLAs are constantly missed. The network team confirms the WAN link has
plenty of idle bandwidth, and the storage team confirms the source ESXi hosts show extremely low I/O
latency.
A. Enable the "High Performance" power plan within the Veeam Backup & Replication server's operating
system to proactively prioritize the CDP coordinator service.
B. Reconfigure the CDP policies to utilize the Direct SAN Access transport mode to allow the proxy to bypass
the VMkernel CPU bottleneck entirely.
C. Increase the memory allocation of the VAIO filter driver directly within the ESXi kernel advanced settings
to artificially offload the compression tasks.
D. Deploy additional CDP proxies at the source site and distribute the CDP policies across them to handle
the intense data compression and traffic routing workloads.
Answer: D
Explanation
Correct Logic (D): Veeam CDP Proxies perform heavy lifting. Unlike standard backup proxies that run on a schedule, CDP
proxies continuously ingest, compress, encrypt (if configured), and route a never-ending stream of I/O blocks. When you
scale a CDP environment, a single proxy will quickly exhaust its CPU resources due to the sheer volume of real-time data
processing. The native architectural solution is to scale out by deploying additional CDP proxies and balancing the CDP
policies across them.
Teardown of Distractors:
A is incorrect: The CDP coordinator service runs on the VBR server, but the actual heavy data processing is done by the
CDP Proxy. Changing the VBR server's power plan will not fix a 100% CPU bottleneck on the remote proxy VM.
B is incorrect: Veeam CDP does not utilize traditional transport modes like Direct SAN, HotAdd, or NBD. It relies exclusively
on the VAIO filter driver framework.
C is incorrect: The VAIO filter driver intercepts I/O and buffers it; it does not perform data compression. You cannot magically
offload proxy CPU compression tasks into the ESXi kernel settings.
VEEAM CERTIFIED ENGINEER PLUS
Question 9
Scenario: A cybersecurity advisory is released regarding a new zero-day ransomware strain that embeds a
highly specific hexadecimal signature inside its encrypted files. The CISO mandates that the IT team must
hunt for this specific signature across all existing backups of the company's file servers to identify if they have
been silently compromised, but they must do so without booting the VMs or attaching them to the network.
What Veeam Data Platform v13 capability natively accomplishes this?
A. Configure a Veeam ONE Remediation Action to automatically extract the .vbk files to a sandbox and run a
proprietary MD5 hash comparison script.
B. Utilize the Veeam Explorer for Storage Snapshots to mount the backup payloads directly into a third-party
SIEM platform for behavioral heuristic analysis.
C. Import a custom YARA rule into the Veeam Backup & Replication console and execute an on-demand
malware scan against the targeted file server backup chains.
D. Deploy a Veeam Recon Scanner agent onto the Veeam Mount Server and configure it to perform a
deep-packet inspection of the vPower NFS data streams.
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 8
Question 9 continued
Answer: C
Explanation
Correct Logic (C): Veeam Data Platform v13 introduced comprehensive YARA rule integration. YARA is a standard tool used
by malware researchers to identify malware based on specific text or binary patterns (like hexadecimal signatures).
Administrators can import custom YARA rules into the VBR console and execute an "On-Demand Scan" against existing
backup files on the repository. Veeam will mount the backups safely and scan the file contents for that exact zero-day
signature without ever booting the VMs.
Teardown of Distractors:
A is incorrect: Veeam ONE does not extract .vbk files or run MD5 scripts against backup payloads. It is a monitoring tool.
B is incorrect: Veeam Explorer for Storage Snapshots mounts hardware array snapshots, not Veeam backup files, and SIEM
platforms do not directly ingest raw block mounts for heuristic analysis in this manner.
D is incorrect: Deep-packet inspection monitors live network traffic. It cannot retroactively scan data already resting inside a
compressed backup file on a repository.
VEEAM CERTIFIED ENGINEER PLUS
Question 10
Scenario: A highly secure government agency utilizes Veeam Data Platform v13 integrated with a third-party
Key Management Interoperability Protocol (KMIP) server. This KMIP server centrally manages all
cryptographic keys for Veeam's data-at-rest encryption. A catastrophic disaster completely destroys the
primary data center, including both the central VBR server and the KMIP server infrastructure. The
administrator deploys a fresh VBR server at a disaster recovery site and attaches the surviving immutable
object storage.
How can the administrator decrypt the backup files?
A. The administrator must utilize the Veeam Backup Enterprise Manager's Password Loss Protection feature,
requiring a challenge/response payload signed by the Enterprise Manager private key.
B. The administrator must retrieve the specific KMIP Recovery Password that was strictly required and
defined within the VBR console during the initial KMIP configuration phase.
C. The administrator cannot decrypt the data; Veeam's strict zero-trust architecture dictates that the
permanent loss of the KMIP server inherently results in permanent cryptographic data loss.
D. The administrator must utilize the Veeam Extract Utility and pass the raw AWS S3 Object Lock
compliance tokens directly into the command-line interface to bypass the AES engine.
Answer: B
Explanation
Correct Logic (B): Veeam foresaw the exact risk of a KMIP server acting as a single point of failure. When an administrator
initially configures KMIP integration in the VBR console, Veeam strictly mandates the creation of a "KMIP Recovery
Password." The backup session keys are encrypted by the KMIP server, but they are also encrypted by this specific recovery
password. In a disaster where the KMIP server is destroyed, the administrator simply types this recovery password into the
new VBR console to decrypt the backups.
Teardown of Distractors:
A is incorrect: Password Loss Protection via Enterprise Manager is used for standard password-based encryption. When
KMIP is enabled, the KMIP configuration handles the cryptographic hierarchy, and EM is not the primary fallback mechanism
for KMIP keys.
C is incorrect: Permanent data loss is avoided specifically because of the mandatory KMIP Recovery Password mechanism.
D is incorrect: S3 Object Lock compliance tokens manage immutability (retention limits). They have absolutely zero
mathematical relationship to the AES-256 data-at-rest decryption keys.
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 9
Question 10 continued
VEEAM CERTIFIED ENGINEER PLUS
Question 11
Scenario: An enterprise architect is designing a Scale-Out Backup Repository (SOBR) for long-term data
retention. They provision a local Linux Hardened Repository for the Performance Tier. For the Capacity Tier,
they attach an Amazon S3 Standard bucket. To achieve massive cost savings on 7-year GFS archival
backups, they attempt to configure an Archive Tier targeting a Microsoft Azure Archive Blob storage
container. The Veeam console rejects the configuration.
What is the architectural reason for this rejection?
A. The Microsoft Azure Archive Blob storage container must explicitly have its immutability lifecycle policies
disabled before it can integrate with an AWS S3 Capacity Tier.
B. The SOBR Archive Tier strictly requires the Capacity Tier and the Archive Tier to utilize theexact same
cloud provider to leverage native cloud-to-cloud API data movement.
C. The underlying Performance Tier is formatted with XFS, which mathematically conflicts with Microsoft
Azure's proprietary block-blob deduplication algorithms.
D. The administrator failed to deploy a Veeam Azure Proxy Appliance within the target Azure tenant to
translate the incoming AWS S3 REST API calls.
Answer: B
Explanation
Correct Logic (B): Veeam's SOBR Archive Tier is designed to be highly cost-efficient. To prevent massive egress charges
(downloading data from the internet just to re-upload it to another cloud), Veeam leverages the cloud provider's native
lifecycle and data movement APIs (e.g., AWS S3 to AWS Glacier, or Azure Hot to Azure Archive). Because Veeam relies on
these native backend APIs for direct tier-to-tier movement, the Capacity Tier and the Archive Tier must belong to the same
cloud provider. You cannot natively tier from AWS S3 to Azure Archive within the same SOBR.
Teardown of Distractors:
A is incorrect: Immutability settings are not the cause of this rejection. The core issue is the cross-cloud incompatibility for the
Archive Tier data movement logic.
C is incorrect: The local file system (XFS) of the Performance Tier has absolutely no impact on how the object storage tiers
(Capacity and Archive) communicate with each other in the cloud.
D is incorrect: While Veeam can deploy appliances in Azure, the Archive Tier does not use a "proxy appliance to translate
AWS calls." It strictly relies on same-vendor cloud APIs.
VEEAM CERTIFIED ENGINEER PLUS
Question 12
Scenario: An administrator uses Veeam ONE v13 to monitor a globally distributed backup environment. The
administrator logs into the console and sees a "Veeam Intelligent Diagnostics" critical alarm. The alarm
accurately identifies that a specific remote Veeam Proxy server is suffering from a known memory leak in its
transport service, and the alarm provides a direct link to the exact Veeam Knowledge Base article and hotfix.
How does Veeam ONE natively discover these deep, code-level software issues?
A. Veeam ONE continuously transmits the raw VBR server log files over HTTPS directly to the Veeam
Support cloud, where AI engines analyze the payloads and return the alarm triggers.
B. Veeam ONE deploys a lightweight Endpoint Detection and Response (EDR) agent onto the Proxy server
OS to monitor the Windows memory heap and detect runtime application crashes.
C. Veeam ONE routinely downloads a lightweight signature file from the Veeam web servers and uses it to
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 10
Question 12 continued
parse and analyze the VBR text log files entirely locally within the customer's secure network.
D. Veeam ONE intercepts the proxy's network traffic and utilizes deep packet inspection to identify
malformed Veeam proprietary RPC packets indicative of memory corruption.
Answer: C
Explanation
Correct Logic (C): Veeam Intelligent Diagnostics (VID) is designed for highly secure, air-gapped, or privacy-conscious
environments. Instead of uploading sensitive customer logs to Veeam for analysis, Veeam ONE securely downloads a small
"signature file" (similar to how antivirus software downloads definitions). Veeam ONE then uses these signatures to parse the
VBR log files locally on the customer's own network. When a log matches a known issue signature, it throws the alarm. No
logs are sent to Veeam automatically.
Teardown of Distractors:
A is incorrect: Veeam does not automatically upload customer logs to a cloud AI engine. This would violate strict enterprise
data privacy compliance (like GDPR or HIPAA).
B is incorrect: Veeam ONE is an agentless monitoring solution. It does not deploy EDR agents to monitor OS memory heaps.
D is incorrect: Veeam ONE parses static log files. It does not perform real-time deep packet inspection on RPC network
traffic to diagnose software memory leaks.
VEEAM CERTIFIED ENGINEER PLUS
Question 13
Scenario: A disaster recovery administrator configures a SureBackup job utilizing an advanced Virtual Lab to
test a proprietary CRM virtual machine. The VBR server and the ESXi host running the Virtual Lab reside on
completely different physical subnets (VLAN 100 for VBR, VLAN 200 for ESXi). The CRM virtual machine
successfully powers on inside the isolated network, and VMware Tools initializes. However, the SureBackup
job fails during the network verification phase because the VBR server cannot ping the Masquerade IP
address.
A. The Virtual Lab Proxy Appliance dropped the ICMP packets because the ESXi host on VLAN 200 is
missing the proprietary Veeam vRouter kernel module.
B. The isolated virtual machine requires the Veeam Integration Subsystem to dynamically inject a script that
opens the guest OS firewall for ICMP traffic.
C. The VBR server on VLAN 100 lacks a static IP route directing traffic for the Masquerade subnet to the
external production IP of the Virtual Lab Proxy Appliance on VLAN 200.
D. The Veeam Recovery Orchestrator engine automatically overwrites the Masquerade IP with a localized
DHCP address upon boot to avoid Layer 2 conflicts, breaking the ping test.
Answer: C
Explanation
Correct Logic (C): For a SureBackup ping test to succeed, the VBR server must be able to route traffic to the Masquerade IP
subnet. When the VBR server and the Virtual Lab are on the same subnet, Veeam automatically adds a temporary static
route to the VBR server's Windows routing table, pointing the Masquerade network to the Proxy Appliance's IP. However, if
they are on different subnets (separated by physical routers), the physical network routers between VLAN 100 and VLAN 200
must be manually configured with a static route directing the Masquerade subnet traffic to the Proxy Appliance's IP. Without
this physical router configuration, the ping packets are dropped at the default gateway.
Teardown of Distractors:
A is incorrect: There is no "Veeam vRouter kernel module" installed on ESXi hosts. The routing is handled purely by the
Proxy Appliance VM.
B is incorrect: Veeam does not dynamically inject scripts to modify guest OS firewalls during SureBackup. The guest OS
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 11
Question 13 continued
firewall must already allow ping, which is standard, but the routing is the fundamental failure point here.
D is incorrect: Masquerade IPs are statically mapped based on the Virtual Lab configuration. They are not overwritten by
DHCP during the boot process.
VEEAM CERTIFIED ENGINEER PLUS
Question 14
Scenario: An enterprise requires granular Active Directory object restoration capabilities using the Veeam
Explorer for Microsoft Active Directory. The domain controllers are hosted as virtual machines on vSphere.
The backup administrator configures the VM backup job.
Which three specific job configurations and guest OS prerequisites must be met to ensure the Veeam
Explorer can seamlessly mount the .dit database without requiring manual extraction? (Choose three)
A. The backup job must have the "Application-Aware Processing" feature explicitly enabled.
B. The designated Guest OS credentials must belong to the Domain Admins or Enterprise Admins group.
C. The backup job must utilize the Direct SAN Access transport mode to capture AD memory heaps.
D. The Domain Controller virtual machine must not have any actively open RDP administrative sessions.
E. The guest operating system must not have the native Windows Firewall blocking RPC traffic from the
proxy.
F. The VBR server must be joined to the exact same Active Directory domain as the target Domain
Controller.
Answer: A, B, E
Explanation
Correct Logic (A, B, E): For Veeam to successfully perform application-aware processing (which is strictly required to
gracefully quiesce the AD database and allow the Explorer to automatically mount it), three things must align: The feature
must be enabled in the job (A). Veeam must deploy a temporaryruntime process into the guest OS to trigger VSS, which
requires administrative credentials (B). Finally, the Veeam proxy/VBR server must be able to communicate with the guest OS
over the network to push this runtime process, meaning the guest OS firewall must allow RPC/SMB traffic (E).
Teardown of Distractors:
C is incorrect: Transport modes (Direct SAN, HotAdd, NBD) dictate how the hypervisor storage is read; they have zero
impact on guest-level application VSS quiescence.
D is incorrect: Open RDP sessions have absolutely no technical impact on the Microsoft VSS framework's ability to quiesce
the Active Directory database. F is incorrect: The VBR server can easily be in a workgroup or a completely untrusted domain,
provided it has the correct credentials and network routing to the target VM.
https://www.passcert.com/VMCE_v13.html
https://www.passcert.com/VMCE_v13.html
Page 12
VEEAM CERTIFIED ENGINEER PLUS
Question 15
Scenario: An administrator is configuring a Veeam Recovery Orchestrator (VRO) failover plan. The
production network uses the 192.168.10.0/24 subnet. The disaster recovery site uses the 10.50.10.0/24
subnet. The administrator configures Re-IP rules within the VRO plan to dynamically change the VM IP
addresses during a failover. However, when the administrator executes a scheduled "DataLab Test"
(SureBackup integration) to verify the plan, the application test scripts fail. Upon investigating the isolated
VMs, the administrator sees they are still running their original 192.168.10.0/24 production IPs.
Why did the Re-IP rule fail to apply?
A. The VRO server lacks the Enterprise Plus license tier required to push Re-IP injection scripts into isolated
DataLab environments.
B. During a DataLab test, the isolated network inherently mimics the exact production IP schema to preserve
application dependencies; VRO deliberately skips Re-IP execution unless specifically testing a Re-IP failover
scenario.
C. The VMware Tools service inside the guest OS was not running, preventing the vSphere VMCI channel
from modifying the Windows registry.
D. The Virtual Lab Proxy Appliance dropped the Re-IP packets because the Masquerade IP subnet was not
routed correctly in the core physical switches.
Answer: B
Explanation
Correct Logic (B): This is a critical design concept in Veeam testing. A standard DataLab (SureBackup) test is designed to
verify that the backup works exactly as it was in production. To ensure complex multi-tier applications (like AD and SQL) can
still talk to each other without modifying their OS, the isolated virtual switch perfectly mimics the production IP subnet.
Therefore, VRO intelligently and deliberately skips the Re-IP step during a standard DataLab Test. The VMs boot with their
original IPs. If you explicitly want to test the Re-IP process, you must configure the DataLab differently or run an actual
failover.
Teardown of Distractors:
A is incorrect: Licensing does not gate Re-IP functionality in this manner; it is a fundamental architectural behavior of the
DataLab.
C is incorrect: While VMware Tools is required for Re-IP, the scenario indicates the failure happened because it was a
DataLab test, not because of a guest OS tool failure (the IPs didn't change because Veeam never tried to change them).
D is incorrect: Masquerade routing affects the VBR server's ability to ping the VM; it does not dictate whether the VM gets a
new IP address injected into its OS.
https://www.passcert.com/VMCE_v13.html