Workload and Data Protection Security (Replication, Backup, Recovery)
Protection primitives
Protection Domains group VMs and volume groups. Consistency groups keep multi-VM application sets consistent across snapshots. Snapshots are local and fast; replication copies data to a remote cluster. Replication modes: asynchronous (RPO in minutes), NearSync (RPO in seconds), and synchronous/Metro Availability (zero RPO across a latency-bound stretched pair). Leap orchestrates recovery plans and non-disruptive DR tests. Nutanix Files/Objects and Mine serve as backup targets, and VSS integration delivers application-consistent snapshots for Windows workloads.
The security angle
Treat DR credentials as privileged. Registering a remote cluster uses an account on the target - use a dedicated least-privilege account, never Super Admin. Restrict who can delete snapshots, Protection Domains, or replication relationships, because ransomware operators target backups first. Keep at least one copy offline or immutable, in a separate credential domain. Encrypt data in transit where the release supports it; otherwise tunnel replication over IPsec/VPN between sites. If the data classification requires encryption at rest, confirm the DR cluster also has DARE enabled.
Traps
Confusing RPO (data loss tolerance) with RTO (downtime tolerance). Assuming a local snapshot survives a cluster-destroying event. Assuming replication is encrypted by default. Leaving DR plan testing until the real incident.
Rule of thumb
3-2-1: three copies, two different targets or media, one off-site or immutable - plus a restore test on the calendar, not only in the runbook.