COH-285 Cohesity Certified Protection Professional – NetBackup Appliances Questions and Answers

The correct answer is A. The DISALLOW_SERVER_FILE_WRITES client configuration entry controls whether NetBackup servers are allowed to write files on the client host. Cohesity NetBackup documentation states that this entry “prevents the NetBackup server from creating files on the NetBackup server or client” and further explains that it prevents NetBackup servers from remotely performing restores or remotely changing client configurations. In practical administration terms, this disables server-directed restores to that client. Cohesity also maps the related Windows Backup, Archive, and Restore interface setting to File > NetBackup Client Properties > Allow server-directed restores, confirming that the function is specifically about whether restores can be initiated from the NetBackup server side toward the client. This is why option A is the best match. Option B refers to redirected restores, which are governed by alternate-client restore permissions and client authorization behavior, not this setting alone. Option C is too broad because client-initiated restore capability is controlled separately, such as by DISALLOW_CLIENT_RESTORE. Option D is unrelated to backup write permission. References/topics: Client configuration options, DISALLOW_SERVER_FILE_WRITES, Allow server-directed restores, and NetBackup host security controls.

With ALL_LOCAL_DRIVES and Allow multiple data streams enabled, NetBackup can split each client backup into separate streams per drive or file system; Cohesity documentation states that NetBackup backs up the client and “splits the data from each drive” into its own stream when multiple data streams are enabled. However, the number of streams that can run concurrently is still constrained by job limits. Cohesity’s policy documentation states that concurrent stream count is affected by Maximum jobs per client, Limit jobs per policy, and related storage limits; when Maximum data streams is not explicitly set, NetBackup uses the lower of Maximum jobs per client or Limit jobs per policy. The default Maximum jobs per client is one job, so only one backup stream per client can run. With five clients, that means 5 active backup jobs, not 15.

The storage unit’s Maximum concurrent jobs = 15 does not restrict restores, because Cohesity states this setting controls backup and duplication traffic, not restore jobs. The disk pool’s Maximum I/O Streams = 20 limits read and write streams; restores read backup images and backups write them. Five backups plus ten restores equals 15 total streams, so all 10 restores can run.

The correct answer is A. NetBackup deployment policies use VxUpdate, and VxUpdate relies on the NetBackup package repository located on the primary server. Cohesity documentation states that “VxUpdate uses a repository that resides on the primary server” and that the repository contains the packages that can be deployed to media servers and clients. It also explains that the packages referenced by deployment policies are verified and installed into that repository before use. In the deployment policy workflow, the administrator selects a package from the policy’s Package drop-down list; therefore, the package must already exist in the repository before the policy can run successfully. Cohesity explicitly notes that packages must be added to the VxUpdate repository before creating a working deployment policy, and policies without packages in the repository fail when run. Packages are not manually copied to every client, are not maintained in an external repository, and are not downloaded automatically from support at launch time. The administrator downloads or obtains the appropriate signed VxUpdate package, then adds it using the web UI or nbrepo -a. References/topics: Deployment Management, VxUpdate, Package Repository, and nbrepo repository management.

( To configure cloud storage in NetBackup, you need to define cloud storage credentials and configure a cloud storage server, which involves specifying the cloud storage endpoint, access key, and secret key, among other parameters.)

The first command is Scan. After a storage shelf is physically connected and the appliance is powered on, the appliance must discover and refresh the newly attached storage hardware before the disks can be added or assigned. The NetBackup Appliance administration procedure states that storage devices are scanned from Main > Manage > Storage, and the administrator should enter the Scan command to scan connected storage devices. It specifically notes that whenever a storage device is connected or disconnected, this command is used to detect the storage device or refresh its status. The scan operation refreshes the storage inventory and, on 53xx appliances, can create new disk/RAID groups on external storage before reporting success. Only after the scan makes the disks visible as New Available should the administrator use Add to add the disks into unallocated storage. Grow and Resize are later capacity-management actions and are not the discovery step. References/topics: Manage > Storage, Scanning storage devices, Adding newly available disks, and storage shelf expansion workflow.

The correct answer is media servers and clients. Cohesity NetBackup documentation defines VxUpdate as a deployment-management mechanism for updating non-primary NetBackup hosts. The official NetBackup Upgrade Guide states that “VxUpdate provides a policy-based upgrade tool for media servers and clients,” and further explains that the policy format simplifies media server and client upgrades while signed packages are added to the VxUpdate repository on the primary server for later deployment. Cohesity’s Repository management topic reinforces this by stating that the VxUpdate repository resides on the primary server and contains packages that can be deployed to media servers and clients. It also explicitly says that administrators can upgrade NetBackup media servers and clients to a newer NetBackup version with VxUpdate.

Therefore, option D is correct. Option A is incorrect because the primary server hosts the VxUpdate repository and controls deployment, but it is not itself upgraded through VxUpdate deployment policies. Option B and option C are incomplete because VxUpdate is not limited to only one of those host roles. Reference topics: NetBackup Deployment Management with VxUpdate, About VxUpdate, and Repository management.

The correct action is to increase the Maximum I/O Streams for the MSDP disk pool. In NetBackup disk storage, the disk pool stream limit is the effective gate for concurrent read/write activity against that pool. Cohesity documentation identifies Limit I/O streams as the disk-pool property that controls read and write streams, and notes that if the limit is reached, NetBackup queues jobs until a volume becomes available. The storage-unit Maximum concurrent jobs setting controls how many jobs NetBackup sends to a disk storage unit, but Cohesity also states that this setting is not the only concurrency limiter and depends on disk-pool and media-server factors. NetBackup performance guidance is more explicit for this scenario: the disk pool Max I/O Streams value sets concurrent read/write operations, while the storage unit concurrent-jobs value addresses backup/restore jobs and does not control secondary operations such as duplications and replications; those are usually dictated by Max I/O Streams. Therefore, increasing storage-unit jobs or SLP priority does not guarantee that AIR replications can run while backups consume all available disk-pool streams. The correct tuning point is the disk pool’s Maximum I/O Streams.

The correct action is to increment the job priority in Activity Monitor for the specific queued job. Cohesity NetBackup documentation states that an administrator can dynamically change the priority of selected queued or active jobs that wait for resources directly from the Activity Monitor by selecting the job and choosing Change Job Priority. The available options include setting a specific priority, incrementing the job priority, or decrementing it, and the change affects only the selected job rather than all jobs of that type. This matches the requirement: a small subset of queued jobs must be favored during the same backup session, without changing long-term policy behavior.

Changing the priority in the policy is less appropriate because the policy attribute defines how that policy competes with other policies for resources, and is a configuration-level setting rather than an immediate per-job intervention. NetBackup uses job priority as a scheduling guide; higher-priority requests are evaluated before lower-priority requests, although resource optimization can still influence final selection. Therefore, the operationally correct response is option A.

The correct answer is AES 256 bit CTR encryption and SHA256/SHA-2 fingerprinting. In NetBackup, MSDP stands for Media Server Deduplication Pool, and its security model protects deduplicated data using modern encryption and fingerprinting algorithms. Cohesity NetBackup documentation identifies the MSDP data-at-rest cipher as AES-256-CTR, specifically listing “MSDP: AES-256-CTR” under NetBackup data-at-rest encryption ciphers. For fingerprinting, Cohesity documents that NetBackup 8.1 introduced a more secure MSDP fingerprint algorithm where the SHA-2 algorithm replaces the existing MD5-like algorithm. The upgrade documentation further explains that rolling MSDP data conversion converts older containers to the AES encryption and SHA-2 fingerprint algorithm, confirming that Blowfish and MD5-like fingerprints are legacy mechanisms rather than the current MSDP security standard. Therefore, option A is the only choice that combines the correct MSDP encryption mode, AES-256-CTR, with the correct secure fingerprinting family, represented in the option as SHA256 fingerprinting. References/topics: NetBackup Security and Encryption Guide, Ciphers used in NetBackup, MSDP fingerprinting algorithm changes, and MSDP rolling data conversion.

The unsupported backup storage is BasicDisk. In NetBackup, Media server load balancing is a storage unit group selection method that directs jobs based on a capacity-managed approach, helping NetBackup avoid sending backup work to overloaded media servers. Cohesity NetBackup documentation states that NetBackup evaluates factors such as media server rank, current job count, and available disk space before selecting the most suitable storage unit. Most importantly, the same official topic explicitly states that Media server load balancing cannot be selected for a storage unit group that includes a BasicDisk storage unit, and a BasicDisk storage unit cannot be added to an existing group where Media server load balancing is already enabled.

This makes option C correct. AdvancedDisk, MSDP, and Media Manager storage are valid NetBackup storage technologies used in storage unit group designs, though the recommended selection method can vary by storage type. Cohesity documentation notes that Failover is recommended for AdvancedDisk, MSDP, and OpenStorage, while Media server load balancing remains a selectable storage unit group method for supported configurations. Reference topics: Configuring storage unit groups, Storage unit selection criteria within a group, and Media server load balancing.

The correct location is Media and Device Management > Device Monitor > Disk Pools. In NetBackup, the Devices > Disk Pools view is primarily used to view configured disk pools, manage disk-pool properties, delete disk pools, or perform inventory-related actions. It is not the operational monitoring location used to change the runtime state of a disk pool. Cohesity documentation distinguishes the disk-pool management view from state monitoring; for example, it states that disk pool state is UP or DOWN and that the state is displayed in the Status column when locating the disk pool. The classic NetBackup Administration Console procedure states that to change disk pool state, the administrator selects Media and Device Management > Device Monitor, opens the Disk Pools tab, selects the disk pool, and then chooses Actions > Up or Actions > Down. Cohesity’s disk-pool state guidance also notes that changing a disk pool to DOWN requires the disk pool not to be busy; assigned backup jobs must complete or be canceled before the state change succeeds. Therefore, the correct console path is option B.

A Storage Unit is a logical NetBackup object used to represent the storage destination for backup data. The official Cohesity NetBackup documentation defines it directly: “A storage unit is a label that NetBackup associates with physical storage.” It further explains that the label can identify a robot, a path to a volume, or a disk pool. This makes option C the precise definition. Option A is incomplete because a storage unit does not merely define a physical location; it abstracts storage resources so policies and storage lifecycle operations can target them. Option B is incorrect because storage plans or lifecycle policies may use storage units, but a storage unit itself is not created for the sole purpose of creating a plan. Option D is too narrow because Media Manager is associated primarily with tape/robotic media handling, while storage units are broader NetBackup entities and can represent tape, disk, or disk-pool destinations. Cohesity NetBackup storage topics also describe storage units as part of the recognized storage configurations and note that they can be included in storage unit groups or storage lifecycle policies.

The correct logs are the NetBackup bpfis logs on the client and the operating system logs on the client. The job details show a Windows snapshot failure: GLOBALROOT\Device\HarddiskVolumeShadowCopy..., status: 156: snapshot error encountered, and status: 1542: An existing snapshot is no longer valid. In Cohesity NetBackup snapshot processing, bpbrm starts bpfis on the client, and bpfis creates the snapshot of the client data and returns snapshot completion status. Therefore, the bpfis client log is the primary NetBackup log for the snapshot creation, mount, and delete phases.

Because this is a Microsoft Windows client snapshot issue, the Windows operating system logs are equally important. Cohesity’s status 156 troubleshooting topic identifies VSS framework failures and notes that VSS-related application events may be written on the affected Windows system; it also references bpfis log content for snapshot failures. The media server bpbrm log can show orchestration status, but it usually reports what the client-side snapshot component returned. The bptm log is for media/data movement and is not the best source for VSS snapshot root cause.

The correct recovery options are recovering the MSDP catalog from an MSDP catalog backup and restoring the MSDP catalog from an MSDP catalog shadow copy. Cohesity documentation explains that the NetBackup Deduplication Manager automatically creates daily MSDP catalog shadow copies and transaction logs. If corruption is detected, the Deduplication Manager restores the catalog from the most recent shadow copy and replays the transaction log so the recovered catalog is current. Cohesity also states that administrators should protect the MSDP catalog with a dedicated MSDP catalog backup policy, because a NetBackup catalog backup does not include the MSDP catalog. The MSDP catalog backup is the second tier of protection and is used when shadow copies are unavailable or corrupt. The official recovery guidance identifies the two MSDP catalog recovery options as Restore from a shadow copy and Recover from a backup, specifically noting that a hardware problem can cause complete loss of the MSDP catalog and shadow copies. Options C and D are not the documented standard recovery choices for bringing the MSDP catalog online, and option E is incorrect because the NetBackup catalog backup excludes the MSDP catalog. References/topics: MSDP shadow catalog, MSDP catalog backup policy, Recovering the MSDP catalog, and drcontrol-based catalog protection.

The correct answer is Cumulative incremental backup. In NetBackup policy schedule configuration, the Synthetic backup schedule attribute is not limited only to a Full schedule. Cohesity documentation states that the Synthetic backup attribute allows a backup image to be assembled from prior backup images and that “a synthetic backup may be a synthetic full or a synthetic cumulative incremental backup.” This directly identifies cumulative incremental as the additional schedule type that can be configured as synthetic. Differential incremental backups are normally used as component images that feed the synthetic operation; they capture changed data and are later consolidated, but they are not the synthetic schedule type in this question. User archive and Vault catalog backup schedules are unrelated to synthetic backup image construction. Cohesity also explains that a synthetic cumulative incremental backup is produced by consolidating component images, including differential incremental backups taken since the last cumulative backup and, when available, the last cumulative incremental backup. Therefore, besides Full, the schedule type that supports synthetic configuration is Cumulative incremental backup. References/topics: Synthetic backup schedule attribute, Synthetic cumulative incremental backups, and Schedules required for synthetic backups.

The correct causes are an incorrect client host-name resolution entry on the primary server and stopped NetBackup client processes. The bptestbpcd utility is specifically used to establish a connection from a NetBackup server to the bpcd daemon on a NetBackup host or client, and successful output reports the socket connections that were established. A status 25: cannot connect on socket means the primary server could not complete that socket connection. Official NetBackup troubleshooting guidance states that status 25 commonly results when the client does not acknowledge the TCP connection, the server cannot resolve the client, the client is not listening on bpcd/vnetd, or name resolution fails. Therefore, an incorrect hosts-file entry for clientA on the primary server can send the connection attempt to the wrong address or prevent proper resolution. Likewise, if the NetBackup processes on the client are stopped, the client will not be listening on the required bpcd/vnetd ports. The troubleshooting procedure specifically instructs administrators to verify that the client has bpcd and vnetd ports in listening mode. Options B and E are unrelated to this client-side connection test, while C aligns more closely with authorization failures such as status 59. References/topics: bptestbpcd, status code 25, client name resolution, and bpcd/vnetd client connectivity troubleshooting.

The unavailable credential type is Secret key. In the Cohesity NetBackup Web UI Cloud Administrator’s Guide topic “Add a cloud provider for a Snapshot Manager,” the Microsoft Azure configuration table identifies the supported credential types as Application service principal, System managed identity, and User managed identity. For an Application service principal, the wizard requires related parameters such as Tenant ID, Client ID, and Secret key; however, Secret key is listed as a field used by the application service principal, not as an independent credential type. Cohesity describes the secret key simply as “the secret key of the application,” while the actual credential type heading remains Application service principal. The same table separately lists System managed identity, which requires enabling system-managed identity on the Snapshot Manager host in Azure and assigning the role, and User managed identity, which uses the Client ID of the user-managed identity connected to the Snapshot Manager host. Therefore, options A, B, and D are valid Azure Snapshot Manager credential types, while option C is only an authentication parameter under service-principal configuration. Reference topics: NetBackup Web UI Cloud Administrator’s Guide, Configure Snapshot Manager in NetBackup, and Add a cloud provider for a Snapshot Manager.