Virtualization and Cloud Workload Protection
Domain 4 - Virtualization and Cloud Workload Protection
This domain tests how virtual machine and cloud workloads are discovered, moved and restored. Questions focus on proxy placement, transport mode, changed block tracking and restore granularity.
Core rules
- The Virtual Server Agent discovers VMs from vCenter or a hypervisor host and protects them through subclients whose content is expressed as VM folders, datastores, resource pools, clusters or tags.
- A VSA proxy performs the backup. Transport mode determines the path: hot-add mounts the disk to the proxy VM, NBD reads over the network, and SAN mode reads directly from the datastore. Hot-add requires the proxy to reach both the VM's datastore and the host.
- Incremental VM backups rely on changed block tracking (CBT). CBT must be enabled and is reset by certain events, such as a failed backup or a storage migration, which forces the next backup to behave as a full.
- Quiescing uses VMware Tools to produce an application-consistent snapshot; without it, the backup is crash-consistent only.
- Guest file indexing enables file-level restore from an image-level backup. Without indexing, restores are limited to the whole VM or virtual disks unless you mount and browse manually.
- Cloud workloads use snapshot or image APIs at the provider, with a copy to object storage for long-term retention; region and account scoping decide what gets discovered.
Worked example
A VM fails its nightly backup after being migrated to a datastore the proxy cannot mount. Check the transport mode in use and proxy placement first: if hot-add is configured but the datastore is not mounted on any proxy host, the job falls back or fails. Either present the datastore to a proxy host or allow NBD as a fallback. Then confirm CBT status, because a failed run usually invalidates it and the next successful run will be a full, affecting the backup window and storage consumption.
Traps that cost marks
- Assuming CBT incrementals are guaranteed; failed jobs and migrations reset them.
- Expecting file-level restore from a VM backup that was never indexed.
- Placing the proxy on a host that cannot see the VM's storage, then blaming the network.
- Forgetting that independent disks and some raw device mappings are excluded from VM image backups by default.