COH-285 Cohesity Certified Protection Professional – NetBackup Appliances Questions and Answers

The correct answer is AES 256 bit CTR encryption and SHA256/SHA-2 fingerprinting. In NetBackup, MSDP stands for Media Server Deduplication Pool, and its security model protects deduplicated data using modern encryption and fingerprinting algorithms. Cohesity NetBackup documentation identifies the MSDP data-at-rest cipher as AES-256-CTR, specifically listing “MSDP: AES-256-CTR” under NetBackup data-at-rest encryption ciphers. For fingerprinting, Cohesity documents that NetBackup 8.1 introduced a more secure MSDP fingerprint algorithm where the SHA-2 algorithm replaces the existing MD5-like algorithm. The upgrade documentation further explains that rolling MSDP data conversion converts older containers to the AES encryption and SHA-2 fingerprint algorithm, confirming that Blowfish and MD5-like fingerprints are legacy mechanisms rather than the current MSDP security standard. Therefore, option A is the only choice that combines the correct MSDP encryption mode, AES-256-CTR, with the correct secure fingerprinting family, represented in the option as SHA256 fingerprinting. References/topics: NetBackup Security and Encryption Guide, Ciphers used in NetBackup, MSDP fingerprinting algorithm changes, and MSDP rolling data conversion.

The correct answer is C because the failure is an authorization problem on the NetBackup client, not a basic network-connectivity failure. The job output explicitly states that nbumaster8 “is not an authorized server for host nbclient1,” followed by status 59: access to the client was not allowed. Cohesity NetBackup documentation maps status code 59 to “Access to the client was not allowed.” The controlling configuration is the client’s SERVER list. Cohesity states that the SERVER entry defines the list of NetBackup primary and media servers that can access the NetBackup client, and that media servers or other primary servers must be added for that client. Cohesity also explains that on UNIX servers and clients, the SERVER entries in bp.conf define the NetBackup servers that are allowed access, with additional entries identifying servers that can initiate scheduled backups. Therefore, the client rejected the backup request because the requesting server name was missing from the client’s server list or did not match the expected resolved name. References/topics: Status code 59, SERVER option for NetBackup clients, bp.conf, Host Properties > Clients > Servers, and NetBackup host-name authorization.

The correct answer is A. NetBackup deployment policies use VxUpdate, and VxUpdate relies on the NetBackup package repository located on the primary server. Cohesity documentation states that “VxUpdate uses a repository that resides on the primary server” and that the repository contains the packages that can be deployed to media servers and clients. It also explains that the packages referenced by deployment policies are verified and installed into that repository before use. In the deployment policy workflow, the administrator selects a package from the policy’s Package drop-down list; therefore, the package must already exist in the repository before the policy can run successfully. Cohesity explicitly notes that packages must be added to the VxUpdate repository before creating a working deployment policy, and policies without packages in the repository fail when run. Packages are not manually copied to every client, are not maintained in an external repository, and are not downloaded automatically from support at launch time. The administrator downloads or obtains the appropriate signed VxUpdate package, then adds it using the web UI or nbrepo -a. References/topics: Deployment Management, VxUpdate, Package Repository, and nbrepo repository management.

( NetBackup Compatibility Lists provide a comprehensive list of supported operating systems, applications, and hardware for NetBackup, enabling users to ensure that their backup environment is compatible with NetBackup and avoid potential compatibility issues.)

( The NetBackup documentation landing page includes a variety of resources, including whitepapers, guides, and videos, on best practices for NetBackup, enabling users to optimize their use of the product.)

The replication job starts when the force interval for small replication jobs is reached. NetBackup SLP settings control how Storage Lifecycle Policy jobs are maintained and executed for the selected primary server. Cohesity documentation identifies these as SLP settings used to customize how SLP jobs run. For AIR replication batching, the controlling parameter here is SLP.MIN_SIZE_PER_REPLICATION_JOB. Official NetBackup documentation defines it as the smallest batch size that can run as a single replication job and states that the job does not run until enough images accumulate to reach that size, or until the force interval for small replication jobs is reached. (veritas.com)

In this scenario, three backups of 5GB each create only 15GB of eligible replication data. That is below the configured 20GB threshold, so NetBackup does not start the replication job based on size. Because the backup window has closed and no additional backup images will arrive, the batch cannot reach 20GB. NetBackup therefore submits the small replication batch when the oldest image reaches the configured 60-minute force interval. The force interval is specifically designed to prevent NetBackup from waiting too long before submitting a small replication job. (veritas.com)

The correct action is to increase the Maximum I/O Streams for the MSDP disk pool. In NetBackup disk storage, the disk pool stream limit is the effective gate for concurrent read/write activity against that pool. Cohesity documentation identifies Limit I/O streams as the disk-pool property that controls read and write streams, and notes that if the limit is reached, NetBackup queues jobs until a volume becomes available. The storage-unit Maximum concurrent jobs setting controls how many jobs NetBackup sends to a disk storage unit, but Cohesity also states that this setting is not the only concurrency limiter and depends on disk-pool and media-server factors. NetBackup performance guidance is more explicit for this scenario: the disk pool Max I/O Streams value sets concurrent read/write operations, while the storage unit concurrent-jobs value addresses backup/restore jobs and does not control secondary operations such as duplications and replications; those are usually dictated by Max I/O Streams. Therefore, increasing storage-unit jobs or SLP priority does not guarantee that AIR replications can run while backups consume all available disk-pool streams. The correct tuning point is the disk pool’s Maximum I/O Streams.

With ALL_LOCAL_DRIVES and Allow multiple data streams enabled, NetBackup can split each client backup into separate streams per drive or file system; Cohesity documentation states that NetBackup backs up the client and “splits the data from each drive” into its own stream when multiple data streams are enabled. However, the number of streams that can run concurrently is still constrained by job limits. Cohesity’s policy documentation states that concurrent stream count is affected by Maximum jobs per client, Limit jobs per policy, and related storage limits; when Maximum data streams is not explicitly set, NetBackup uses the lower of Maximum jobs per client or Limit jobs per policy. The default Maximum jobs per client is one job, so only one backup stream per client can run. With five clients, that means 5 active backup jobs, not 15.

The storage unit’s Maximum concurrent jobs = 15 does not restrict restores, because Cohesity states this setting controls backup and duplication traffic, not restore jobs. The disk pool’s Maximum I/O Streams = 20 limits read and write streams; restores read backup images and backups write them. Five backups plus ten restores equals 15 total streams, so all 10 restores can run.

The correct causes are an incorrect client host-name resolution entry on the primary server and stopped NetBackup client processes. The bptestbpcd utility is specifically used to establish a connection from a NetBackup server to the bpcd daemon on a NetBackup host or client, and successful output reports the socket connections that were established. A status 25: cannot connect on socket means the primary server could not complete that socket connection. Official NetBackup troubleshooting guidance states that status 25 commonly results when the client does not acknowledge the TCP connection, the server cannot resolve the client, the client is not listening on bpcd/vnetd, or name resolution fails. Therefore, an incorrect hosts-file entry for clientA on the primary server can send the connection attempt to the wrong address or prevent proper resolution. Likewise, if the NetBackup processes on the client are stopped, the client will not be listening on the required bpcd/vnetd ports. The troubleshooting procedure specifically instructs administrators to verify that the client has bpcd and vnetd ports in listening mode. Options B and E are unrelated to this client-side connection test, while C aligns more closely with authorization failures such as status 59. References/topics: bptestbpcd, status code 25, client name resolution, and bpcd/vnetd client connectivity troubleshooting.

The unsupported backup storage is BasicDisk. In NetBackup, Media server load balancing is a storage unit group selection method that directs jobs based on a capacity-managed approach, helping NetBackup avoid sending backup work to overloaded media servers. Cohesity NetBackup documentation states that NetBackup evaluates factors such as media server rank, current job count, and available disk space before selecting the most suitable storage unit. Most importantly, the same official topic explicitly states that Media server load balancing cannot be selected for a storage unit group that includes a BasicDisk storage unit, and a BasicDisk storage unit cannot be added to an existing group where Media server load balancing is already enabled.

This makes option C correct. AdvancedDisk, MSDP, and Media Manager storage are valid NetBackup storage technologies used in storage unit group designs, though the recommended selection method can vary by storage type. Cohesity documentation notes that Failover is recommended for AdvancedDisk, MSDP, and OpenStorage, while Media server load balancing remains a selectable storage unit group method for supported configurations. Reference topics: Configuring storage unit groups, Storage unit selection criteria within a group, and Media server load balancing.

The correct resources are the operating system logs and the robtest command. The failure is not a client file-read problem; it occurs when bptm requests tape media and the robot cannot complete the operation. Cohesity NetBackup documentation describes the tape workflow: bptm reserves drives and issues mount requests through the Media Manager and robotic daemons, which perform the physical media mount. When the job detail reports “Robot operation failed” and “All drives down,” the fault domain is tape device access, robotic control, drive visibility, zoning, library state, or OS-level SCSI communication. Official troubleshooting guidance states that NetBackup uses OS-level commands and drivers for tape operations, and recommends starting at the OS and hardware layer and checking OS system/event logs. The robtest utility is also directly relevant because it issues basic SCSI commands to a robotic device attached to a NetBackup media server and can test drive status, slot status, move operations, and robot readiness. Options B, C, and D are less relevant: bpbkar is a backup client read process, nbdevconfig is primarily disk-storage configuration, and bpmedia manages media records rather than robotic motion or drive connectivity.

( To configure cloud storage in NetBackup, you need to define cloud storage credentials and configure a cloud storage server, which involves specifying the cloud storage endpoint, access key, and secret key, among other parameters.)

The required step is to verify that the third-party OST target supports Accelerator with VMware-type policies in the Hardware Compatibility List. Cohesity NetBackup documentation states that Accelerator for virtual machines uses VMware Changed Block Tracking (CBT) to identify changes inside the virtual machine, not the Windows NTFS or ReFS change journal. The same VMware Accelerator requirements topic lists supported disk storage destinations and includes qualified third-party OpenStorage devices, then specifically instructs administrators to verify Accelerator support for the storage unit in the NetBackup hardware compatibility list for supported OST vendors. It also warns that if the storage unit does not support Accelerator, the backup can fail with messages such as the storage server type not supporting accelerator backup. The HCL further identifies Accelerator with VMware-type policies as a distinct OpenStorage supported-functionality entry, meaning generic OST support is not sufficient; the vendor/device must support the VMware Accelerator capability. (Veritas Download) Option A applies to file-system Accelerator behavior for Windows clients, not VMware image-level backups. Option C is not mandatory for the first successful VMware backup. Option D is incorrect because VMware Accelerator does not require manually creating a client track log.

The correct log to review is nbpem, the NetBackup Policy Execution Manager log. Cohesity NetBackup documentation states that nbpem creates policy and client tasks and determines when jobs are run, and its logging location is install_path\NetBackup\logs\nbpem on Windows and /usr/openv/logs/nbpem on UNIX/Linux. In the scheduled backup workflow, nbpem initiates a backup when the job becomes due. It determines whether the policy, schedule, and backup window are valid, retrieves policy information through nbproxy, and then submits the due job to nbjm to obtain a job ID.

Therefore, when an automatic schedule does not launch a backup at the expected time, the first diagnostic focus is the scheduler and policy-evaluation component, not the later job-control or resource-allocation components. nbjm manages submitted jobs after nbpem hands them off, nbrb brokers resources, and nbemm manages media and device/resource database functions. Since the failure occurs before the job launches automatically, nbpem is the authoritative debug log for determining why the policy schedule did not trigger. Reference topics: Backup process, nbpem logging, and Policy Execution Manager scheduling behavior.

The correct behavior is that Maximum jobs per client is ignored, and NetBackup applies the lower value between Maximum data streams and Limit jobs per policy. In Cohesity NetBackup, the Maximum data streams property is configured under Hosts > Host properties > primary server > Client attributes > General tab. This setting defines the maximum number of jobs allowed at one time for each selected client, and Cohesity documentation clarifies that it applies to client job count even when multistreaming is not used. The guide further states that when Maximum data streams is not set, NetBackup limits jobs by either Maximum jobs per client or Limit jobs per policy, whichever is lower. However, when Maximum data streams is set, NetBackup ignores Maximum jobs per client and uses either Maximum data streams or Limit jobs per policy, whichever is lower. Therefore, option B precisely matches the documented interaction. The storage-unit Maximum concurrent jobs setting is unrelated to this specific client attribute behavior, so options C and D are incorrect. Reference topics: Client attributes properties, General tab of the Client attributes properties, and Limit jobs per policy.

( To create a new disk pool in NetBackup, you can use the NetBackup Web UI by navigating to the Storage > Disk Pools tab and clicking Add, where you can specify the disk pool name, storage unit group, and other disk pool parameters.)

The correct feature is Synthetic backups. Cohesity NetBackup documentation explains that, in a traditional full backup, all files are copied from the client to the primary or media server, even if the files have not changed. With a synthetic full backup, NetBackup combines the previous full backup with subsequent incremental backups on the media server to create a new full image. Because the processing occurs on the primary and media servers rather than repeatedly reading all data from the client, synthetic backups reduce client-to-server network traffic; files are transferred over the network only once. Synthetic backups can also be written to disk storage units, making them appropriate for an AdvancedDisk target backed by a high-speed disk array. This fits the scenario because Windows and Linux file servers map to MS-Windows and Standard policy types, which are supported for synthetic backups. NetBackup Accelerator is not the best answer here because Accelerator requires supported disk targets such as MSDP, NetBackup appliance storage, cloud storage, or qualified OST storage, not a generic AdvancedDisk storage unit. Client-side deduplication similarly requires deduplication storage, and network resiliency improves fault tolerance rather than reducing backup traffic. References/topics: Synthetic backups, AdvancedDisk storage units, backup traffic optimization, and Accelerator requirements.

( The NetBackup Appliance product page provides detailed information about the hardware specifications of the appliance, including processor, memory, and storage capacities, to help customers choose the right appliance for their backup and recovery needs.)

The correct prerequisites are to enable granular recovery in the policy and ensure Network File System (NFS) is enabled/installed on the Active Directory client. Cohesity NetBackup documentation states that an Active Directory backup policy can be configured to allow restore of “objects and attributes” and that, in the policy Attributes tab, the administrator must select MS-Windows as the policy type and then Enable the Enable granular recovery option; if it is not enabled, the backup can run, but it cannot produce granular restores. Cohesity also defines the system requirement for Active Directory granular backup and recovery: NFS must be installed on the media server and all Active Directory domain controllers or ADAM/LDS hosts. This matches option E because the Active Directory domain controller is the NetBackup client in this workflow. Option C is incorrect because NBFSD is not installed as a client prerequisite; the client mounts a mapped drive, while the media server handles requests through the NBFS/NBFSD service. Option B is wrong because the documented policy type is MS-Windows, not FlashBackup-Windows. References/topics: Active Directory granular backups and recovery, GRT, NFS configuration, and Creating a policy that allows Active Directory granular restores.