Hosted Private Cloud DR: Same-Site Backup Is Not DR
A company runs 60 VMware VMs on a three-host Hosted Private Cloud in one region. Total provisioned storage is 30 TB. Veeam backs up nightly to a NAS in the same server room, with 14-day retention; the stated RPO is 24 hours and RTO is 8 hours. A new requirement sets RPO at 1 hour and RTO at 4 hours, with an annual documented DR test. The team proposes adding a second NAS in the same room and replicating to it. The application includes a 6 TB file server and a 2 TB SQL Server database; the daily change rate is about 5%. The company has a second OVHcloud region available and a vRack. The security team also wants to reduce standing vSphere administrator access and ensure administrative actions are auditable. There is budget for one additional Hosted Private Cloud host plus backup storage, but not for a fully active-active design.
1. Evaluate the second-NAS proposal and design a DR solution that meets the RPO and RTO.
Read the worked answer
Reject the second NAS in the same room. It shares power, cooling, network and physical risk with the primary, so it is a local copy, not a DR site. Use a second Hosted Private Cloud in a remote region, connected by vRack, and replicate tier-1 VMs with Veeam replication hourly. The 30 TB seed is the hard part; calculate the link and use a seeded copy or shipping process, then replicate only changes. A 5% daily change rate is about 1.5 TB per day, roughly 17 MB/s average, which fits a 1 Gbps link but needs prioritisation and monitoring. With one additional host at the DR site, you cannot run all 60 VMs at full performance; define a priority order (SQL Server, file server, domain controllers) and accept reduced capacity. Document DNS switching, addressing across the vRack, and a 4-hour runbook. Test failover annually and measure actual RTO.
2. Replication is not backup. What independent backup policy remains necessary?
Read the worked answer
Replication is not backup: logical corruption, ransomware encryption or accidental deletion is replicated within the hour. Keep an independent Veeam backup copy in an immutable Object Storage bucket, with a separate credential and account, and retention of 30 daily, 12 weekly and 7 yearly as required. Use GFS and verify the immutability lock period. The 1-hour RPO applies to DR replication for tier-1 systems; the backup copy may have a 24-hour RPO for tier-2. Test a granular file restore and a full VM restore quarterly. Monitor job success, repository capacity and lock violations. Do not let the backup server's credentials be usable from the production vSphere administrators' accounts. Document that restore testing is separate from failover testing.
3. How would you reduce standing vSphere administrator access and make administrative actions auditable?
Read the worked answer
Remove shared administrator accounts and standing domain-admin rights. Give each engineer a named OVHcloud account with MFA, and map vSphere SSO groups to least-privilege roles: read-only for operations, VM operator for service owners, administrator only in a break-glass group. Put administrative access behind a bastion with MFA and log every session; restrict vSphere access to the management network. Forward vSphere and OVHcloud audit logs to the SIEM, alert on role changes, new local users and mass VM deletions, and review access quarterly. Separate the backup administrator role from the vSphere administrator role. Document the break-glass procedure and test it. These controls matter more in a DR design because a compromised production account must not be able to delete the replicas.