COH-285 Cohesity Certified Protection Professional – NetBackup Appliances Questions and Answers

( The NetBackup 10.0 Release Notes provide a comprehensive list of new features, enhancements, and bug fixes in the latest version of NetBackup, enabling users to get up-to-date information on the product.)

The correct answer is A. NetBackup deployment policies use VxUpdate, and VxUpdate relies on the NetBackup package repository located on the primary server. Cohesity documentation states that “VxUpdate uses a repository that resides on the primary server” and that the repository contains the packages that can be deployed to media servers and clients. It also explains that the packages referenced by deployment policies are verified and installed into that repository before use. In the deployment policy workflow, the administrator selects a package from the policy’s Package drop-down list; therefore, the package must already exist in the repository before the policy can run successfully. Cohesity explicitly notes that packages must be added to the VxUpdate repository before creating a working deployment policy, and policies without packages in the repository fail when run. Packages are not manually copied to every client, are not maintained in an external repository, and are not downloaded automatically from support at launch time. The administrator downloads or obtains the appropriate signed VxUpdate package, then adds it using the web UI or nbrepo -a. References/topics: Deployment Management, VxUpdate, Package Repository, and nbrepo repository management.

The correct action is to run content router queue processing on the media server that hosts the MSDP storage server. In an MSDP environment, expiring backup images with bpexpdate removes or marks the NetBackup catalog references, but the deduplicated segment references in MSDP are reclaimed through the deduplication transaction queue. Cohesity NetBackup documentation explains that after images are expired, MSDP may not immediately reclaim the freed space and that administrators can accelerate reclamation by manually processing the MSDP transaction queue. The deduplication process writes transaction log data into the queue directory, and that queue data is later processed during the next content router queue processing operation. Official NetBackup Deduplication procedures specify running crcontrol --processqueue on the MSDP storage server, not on the primary server. Image cleanup alone is not the MSDP space-reclamation mechanism after manual expiration, and a storage-pool inventory does not dereference deduplicated fragments. Therefore, the required step is option A.

The correct command is nbcertcmd -listCertDetails. Cohesity NetBackup documentation states that host ID-based certificate details can be viewed with the NetBackup web UI, the nbcertcmd command, or NetBackup APIs. In the command procedure, Cohesity specifically instructs administrators to run nbcertcmd -listCertDetails on the NetBackup host to view host IDs and associated certificate details for that host. The NetBackup Commands Reference also confirms that nbcertcmd is the utility used to request and manage host ID-based security certificates on NetBackup hosts, including primary servers, media servers, and clients. It lists -listCertDetails as the operation that displays certificate details for security certificates deployed on the NetBackup host.

Option A is incorrect because -listCACertDetails displays trusted CA certificate details, not the local host-ID certificate expiry. Option B is invalid in this context because enrollment status is not viewed with bpclntcmd. Option C, -hostSelfCheck, checks whether the host certificate is revoked, not its expiration date. Reference topics: NetBackup Security and Encryption Guide, Viewing host ID-based certificate details, and nbcertcmd command reference.

The correct log to review is nbpem, the NetBackup Policy Execution Manager log. Cohesity NetBackup documentation states that nbpem creates policy and client tasks and determines when jobs are run, and its logging location is install_path\NetBackup\logs\nbpem on Windows and /usr/openv/logs/nbpem on UNIX/Linux. In the scheduled backup workflow, nbpem initiates a backup when the job becomes due. It determines whether the policy, schedule, and backup window are valid, retrieves policy information through nbproxy, and then submits the due job to nbjm to obtain a job ID.

Therefore, when an automatic schedule does not launch a backup at the expected time, the first diagnostic focus is the scheduler and policy-evaluation component, not the later job-control or resource-allocation components. nbjm manages submitted jobs after nbpem hands them off, nbrb brokers resources, and nbemm manages media and device/resource database functions. Since the failure occurs before the job launches automatically, nbpem is the authoritative debug log for determining why the policy schedule did not trigger. Reference topics: Backup process, nbpem logging, and Policy Execution Manager scheduling behavior.

The correct answer is Cumulative incremental backup. In NetBackup policy schedule configuration, the Synthetic backup schedule attribute is not limited only to a Full schedule. Cohesity documentation states that the Synthetic backup attribute allows a backup image to be assembled from prior backup images and that “a synthetic backup may be a synthetic full or a synthetic cumulative incremental backup.” This directly identifies cumulative incremental as the additional schedule type that can be configured as synthetic. Differential incremental backups are normally used as component images that feed the synthetic operation; they capture changed data and are later consolidated, but they are not the synthetic schedule type in this question. User archive and Vault catalog backup schedules are unrelated to synthetic backup image construction. Cohesity also explains that a synthetic cumulative incremental backup is produced by consolidating component images, including differential incremental backups taken since the last cumulative backup and, when available, the last cumulative incremental backup. Therefore, besides Full, the schedule type that supports synthetic configuration is Cumulative incremental backup. References/topics: Synthetic backup schedule attribute, Synthetic cumulative incremental backups, and Schedules required for synthetic backups.

( Storage unit groups in NetBackup enable load balancing and failover for backup jobs, by allowing you to define multiple storage units for a backup policy and specify the order in which they are used for backups.)

The correct command is vxlogview -o 118 -d D,T,x. Status code 96 commonly indicates that NetBackup could not allocate required media or storage resources, so troubleshooting should focus on the NetBackup Resource Broker, also known as nbrb. Cohesity NetBackup documentation identifies originator ID 118 as nbrb, the NetBackup Resource Broker, which maintains available resource information and locates the physical and logical resources needed for backup and tape restore operations. The vxlogview command is the supported utility for reading unified logs, because unified log files are binary and must be assembled by vxlogview. The -o 118 option filters log records for the Resource Broker originator, while -d D,T,x displays the required fields: date, timestamp, and actual log message text. The command reference defines D as display date, T as display timestamp, and x as display actual log message text. Option C is incorrect because w displays who logged diagnostic/debug messages, not the actual message text. References/topics: NetBackup unified logging, vxlogview, originator IDs, nbrb Resource Broker logging, and status 96 resource allocation troubleshooting.

The correct log is the vnetd proxy log. NetBackup secure host communication uses host ID-based certificates and certificate revocation lists (CRLs). When communication fails between the primary/master server and a client because a certificate is revoked, unavailable, missing, or affected by CRL validation, the relevant troubleshooting path is the vnetd proxy process log files. Cohesity’s NetBackup Troubleshooting Guide states that for host-certificate troubleshooting, administrators should examine job details for certificate, revocation, and CRL messages, and “may need to examine the vnetd proxy process log files” for related messages and status codes. The same guide notes that NetBackup hosts must have a valid host ID-based security certificate and a valid CRL to communicate; otherwise, communication fails. For a revoked primary server certificate, Cohesity specifically identifies that the vnetd proxy process log files on hosts show that the primary server certificate is revoked. Therefore, nbemm is for Enterprise Media Manager functions, bprd is request processing, and nbrb is resource brokering; none is the primary diagnostic log for certificate revocation analysis. Reference topics: Troubleshooting security certificate revocation, Viewing vnetd proxy log files, and Test the vnetd proxy connections.

The correct recovery options are recovering the MSDP catalog from an MSDP catalog backup and restoring the MSDP catalog from an MSDP catalog shadow copy. Cohesity documentation explains that the NetBackup Deduplication Manager automatically creates daily MSDP catalog shadow copies and transaction logs. If corruption is detected, the Deduplication Manager restores the catalog from the most recent shadow copy and replays the transaction log so the recovered catalog is current. Cohesity also states that administrators should protect the MSDP catalog with a dedicated MSDP catalog backup policy, because a NetBackup catalog backup does not include the MSDP catalog. The MSDP catalog backup is the second tier of protection and is used when shadow copies are unavailable or corrupt. The official recovery guidance identifies the two MSDP catalog recovery options as Restore from a shadow copy and Recover from a backup, specifically noting that a hardware problem can cause complete loss of the MSDP catalog and shadow copies. Options C and D are not the documented standard recovery choices for bringing the MSDP catalog online, and option E is incorrect because the NetBackup catalog backup excludes the MSDP catalog. References/topics: MSDP shadow catalog, MSDP catalog backup policy, Recovering the MSDP catalog, and drcontrol-based catalog protection.

The correct command is nbstlutil. In NetBackup, lifecycle-managed images are controlled by Storage Lifecycle Policies (SLPs), and the dedicated command-line utility for inspecting and intervening in SLP processing is nbstlutil. Cohesity’s NetBackup Commands Reference defines nbstlutil as the command used to “run the NetBackup storage lifecycle policies utility,” and its description states that it provides a way for users to intervene in storage lifecycle policy operations. Most directly, the same official command reference lists the report function under nbstlutil and states that report shows a rollup of incomplete copies of lifecycle-managed images. Therefore, the practical command would be nbstlutil report, with optional filters such as lifecycle name, client, media ID, media server, storage server, or SLP version.

The other commands do not target this SLP-specific view. bpimage is associated with backup image operations, bpimmedia reports media/image relationships, and bpimagelist lists backup image catalog information. They do not provide the SLP incomplete-copy rollup requested in the question. Reference topics: NetBackup Commands Reference Guide, nbstlutil, Storage Lifecycle Policy operations, and lifecycle-managed image status reporting.

The correct answer is media servers and clients. Cohesity NetBackup documentation defines VxUpdate as a deployment-management mechanism for updating non-primary NetBackup hosts. The official NetBackup Upgrade Guide states that “VxUpdate provides a policy-based upgrade tool for media servers and clients,” and further explains that the policy format simplifies media server and client upgrades while signed packages are added to the VxUpdate repository on the primary server for later deployment. Cohesity’s Repository management topic reinforces this by stating that the VxUpdate repository resides on the primary server and contains packages that can be deployed to media servers and clients. It also explicitly says that administrators can upgrade NetBackup media servers and clients to a newer NetBackup version with VxUpdate.

Therefore, option D is correct. Option A is incorrect because the primary server hosts the VxUpdate repository and controls deployment, but it is not itself upgraded through VxUpdate deployment policies. Option B and option C are incomplete because VxUpdate is not limited to only one of those host roles. Reference topics: NetBackup Deployment Management with VxUpdate, About VxUpdate, and Repository management.

( The NetBackup Appliance product page provides detailed information about the hardware specifications of the appliance, including processor, memory, and storage capacities, to help customers choose the right appliance for their backup and recovery needs.)

The correct setting is Network Connections > Maximum concurrent jobs. In Cohesity NetBackup documentation, the Scalable Storage host property is accessed from Hosts > Host properties, selecting the media server, editing media server properties, and choosing Scalable storage. These settings cover cloud encryption, metering, bandwidth throttling, and network connections between NetBackup hosts and the cloud storage provider. The key requirement in the question is to reduce network use by limiting the number of parallel backup streams. Cohesity documents Maximum concurrent jobs as “the default maximum number of concurrent jobs that the media server can run for the cloud storage server,” and notes that when jobs exceed the allowed connection count, additional backup or restore jobs fail after the maximum is reached. By reducing this value, the administrator directly limits simultaneous cloud backup streams and therefore reduces concurrent network consumption. The other options control different behaviors: Metering interval affects reporting collection frequency, Total available bandwidth defines the cloud connection speed, and Sampling interval controls how often bandwidth usage is measured for throttling. References/topics: Scalable Storage properties, Network Connections, Maximum concurrent jobs, and Cloud storage server bandwidth throttling properties.

The correct permissions are View and Subscribe. In NetBackup RBAC, adding an asset to a Protection Plan is treated as subscribing the asset to that plan, not creating, updating, or managing the plan itself. Cohesity documentation describes the workflow as selecting one or more assets, clicking Add protection, choosing a protection plan, and clicking Protect; it also states that a single asset or group of assets can be subscribed to one or more protection plans. The RBAC permissions model separates plan administration from asset subscription. The role-permissions topic defines protection plans as the area used to manage how backups are performed with protection plans, while assets are managed separately under the Assets permission category. Official NetBackup RBAC guidance states that to add assets to a protection plan, the user requires View and Subscribe permissions on the protection plan, with corresponding asset permissions to view and protect the assets. Therefore, View and Subscribe is the permission pair directly aligned with adding an asset to a Protection Plan. References/topics: RBAC role permissions, Protection Plans, Subscribe an asset or asset group, and Workload asset protection workflow.

The correct procedure is to delete the incorrectly discovered tape entry, configure the Media ID generation rule correctly, re-inventory the library, and then run the recovery. The catalog recovery request requires MediaID GBP847 for barcode GBP847S1, but the new server inventoried the tape as P847S1. Cohesity NetBackup documentation explains that, by default, NetBackup generates a media ID from the last six characters of a tape barcode. For barcode GBP847S1, the last six characters are P847S1, which exactly matches the incorrect media ID shown in the Administration Console. Cohesity further states that media ID generation rules override this default and define which barcode characters NetBackup uses to create the media ID. In this case, the rule must generate the media ID from the first six characters, producing GBP847. The rule is configured from the robot inventory advanced options under Media ID Generation. A barcode rule is not sufficient because barcode rules assign media attributes such as media type or volume pool, whereas media ID generation controls the actual media ID. bplabel is also inappropriate because it can relabel media and risks invalidating existing backup data. References/topics: Catalog recovery, robot inventory, media ID generation rules, and tape barcode handling.