Chapter 15: End-to-End Architecture Scenarios and Exam Synthesis

The previous fourteen chapters built the vocabulary, mechanics, and design patterns of the Cohesity Data Cloud one layer at a time. The CCAE exam, however, almost never asks about a single layer in isolation. It asks you to assemble layers into a coherent design that satisfies a business problem under hard constraints. This final chapter walks through three full reference architectures end-to-end, decodes the exam blueprint and scenario question pattern in detail, and gives you a 30-day plan plus a test-day playbook so you walk into the proctoring session knowing exactly how to spend your 90 minutes.

Scenario 1: Global Enterprise with Multi-Region DR

The Business Problem

A multinational manufacturer operates three primary data centers (Dallas, Frankfurt, Singapore) plus 42 branch and plant sites across the Americas, EMEA, and APAC. Targets: Tier-0 ERP/MES need RPO 15 min, RTO 60 min; Tier-1 file/VM need RPO 4 h, RTO 4 h; Tier-2 archive/dev need RPO 24 h, RTO 24 h; seven-year retention; cross-region replication must survive loss of any one regional data center; SaaS control plane allowed but no third-party SaaS for production data.

Topology Choice: Hub-and-Spoke Per Region with One-to-Many Across Regions

The reference pattern that maps cleanly to this requirement set is hub-and-spoke within each region and one-to-many across regions. Each branch deploys a Cohesity Robo or small Virtual Edition cluster sized for local backups. Spokes replicate inbound to the regional hub. Each regional hub then replicates Tier-0 and Tier-1 data to one of the other two regions in a triangular mesh that survives any single regional loss.

Translating SLAs to Policies

For the Tier-0 RTO of 60 minutes the architect leverages Instant Mass Restore at the regional hub. SiteContinuity runbooks orchestrate failover - power-on order, IP re-mapping, dependency groups - and a non-disruptive test failover runs quarterly into an isolated network bubble for audit evidence.

Capacity, Bandwidth, and Cost Sanity Check

A useful analogy: the regional hubs are regional water reservoirs. Each branch is a small upstream tank; water flows downhill into the regional reservoir at low pressure (deduplicated WAN-optimized streams). Reservoirs exchange water across long pipes (cross-region replication) only for the most critical workloads, because long pipes are expensive. The cloud archive is the underground aquifer - slow to recall but cheap and effectively infinite.

WAN bandwidth is dimensioned around the change rate of Tier-0 and Tier-1 data, not total front-end TB. If Tier-0 produces 200 GB of unique change daily after dedupe, a 25 Mbps committed cross-region link comfortably absorbs the load.

Key Takeaway: A global enterprise design layers hub-and-spoke (intra-region) with one-to-many (inter-region) replication, drives every workload through tiered Helios policies, uses CloudArchive for long-term retention without hot-capacity bloat, and orchestrates recovery through SiteContinuity runbooks.

Scenario 2: Healthcare with HIPAA and Ransomware Posture

The Business Problem

A 600-bed health system runs Epic EHR, PACS imaging, lab systems, and clinical research across two on-prem data centers. The CISO requires: PHI never leaves the covered entity (no SaaS vaulting); WORM-immutable backups that compromised admins cannot delete; encryption with customer-managed keys via KMIP; quorum approval for any retention change; ransomware anomaly detection on backup ingestion; clean-room recovery validated quarterly; Helios control plane without outbound SaaS connectivity.

Stack Selection: DataLock + FortKnox Self-Managed + DataHawk + Helios Self-Managed

The 3-2-1 Defense in Depth

1. Primary copy - production storage (Epic ODB, PACS arrays, file shares).
2. Secondary copy - Cohesity DataProtect cluster on-prem with DataLock WORM. Tier-0 backups every 15 minutes via log-based RPO. KMIP-managed encryption.
3. Tertiary vault - FortKnox Self-Managed in a logically and physically isolated network segment, behind a separate management VLAN, with an inbound-only transfer window. Production admins do not have credentials for the vault; vault admins do not have credentials for production.

Analogy: FortKnox Self-Managed is the safe-deposit vault inside a bank inside a city. The DataProtect cluster is the bank. The vault sits behind a second locked door whose key is held by a different person, and the door opens only on a published schedule.

Detection and Clean Recovery

DataHawk performs anomaly detection on every backup ingestion, comparing change rates and entropy against historical baselines; an unusual spike fires a Helios alert. Threat scanning then uses curated IOCs to identify which restore points are clean. Quarterly clean-room recoveries restore Epic and PACS into an isolated network bubble for HIPAA contingency-plan audit evidence.

Audit, Logging, and HIPAA Alignment

All admin actions stream to Splunk via the Cohesity Data Security Alliance integration. RBAC follows least privilege: Backup Operator (restores, no retention changes), Compliance Officer (legal hold, no delete), Cluster Admin (config, but cannot bypass DataLock). MFA is mandatory; quorum approval is required for retention reduction and DataLock policy changes.

Key Takeaway: Healthcare ransomware-resilient design is a layered stack: DataLock provides immutability, FortKnox Self-Managed provides the air-gapped vault inside the covered entity, DataHawk provides detection and classification, KMIP provides customer-controlled keys, Helios Self-Managed provides the dark-site control plane, and quorum + MFA + RBAC provide segregation of duties. Removing any layer fails one of the requirements.

Scenario 3: Service Provider Multi-Tenant DMaaS

The Business Problem

An MSP wants to launch BaaS for mid-market customers: 25 initial tenants growing to 200 in 18 months; per-tenant isolation; tenants self-serve via a branded portal; metered chargeback; tenant onboarding under one business day; offboarding with data destruction in 30 days; deliver as DMaaS for the first wave.

Why DMaaS for the Initial Wave

Cohesity DMaaS delivers DataProtect as a SaaS offering with the MSP as a managed-service overlay. The MSP avoids capex and operational burden by consuming Cohesity's regional SaaS instances and picks the region that satisfies tenant data-residency requirements (us-east-1 for US tenants, eu-west-1 for EU tenants).

Tenant Isolation via Organizations

The MSP retains an MSP-Admin role across Organizations for ops but cannot access tenant data without explicit, audited break-glass procedures.

Self-Service via Helios

Tenants log into Helios with their own SAML IdP and see only their Organization. They create Protection Groups, attach pre-approved policies (Bronze/Silver/Gold), trigger restores, view SLA dashboards, and download compliance reports. The platform's self-service surface absorbs routine tickets.

Chargeback, Onboarding, Offboarding

Helios exposes consumption metrics that the MSP pulls via REST API into its billing system. A monthly cron job joins per-Organization metrics with tier price and emits invoices. The Cohesity Terraform provider versions tenant configs alongside the rest of IaC. Onboarding: Terraform creates the Organization, View Boxes, network bindings, default policies, SAML federation; Ansible registers sources and applies the chosen tier. Offboarding: 30-day grace period with restore-only access, then cryptographic erasure by destroying the per-tenant key.

Key Takeaway: A DMaaS MSP design rests on three pillars: Organizations for tenant isolation, Helios for self-service, and APIs (REST/Terraform/Ansible) for metering and lifecycle automation. Service tiers, not custom configurations, are the unit of sale.

CCAE Exam Blueprint and Scenario Question Pattern

The Numbers You Must Internalize

Ninety minutes for sixty questions is a 90-second budget. Memorize platform vocabulary so reading time is short and decision time is long.

Domain Weights and Per-Domain Question Counts

The Scenario Question Pattern

1. A scenario paragraph with constraints (RPO/RTO, budget, bandwidth, compliance, residency).
2. Four candidate designs, each plausible at first glance.
3. The correct answer satisfies all stated constraints.
4. Each distractor fails exactly one constraint.

The correct answer is almost always the option that balances competing objectives while applying the right Cohesity feature for the constraint set.

Decision Criteria Checklist

1. Have I mapped every requirement to a measurable SLA (RPO, RTO, retention, residency, compliance)?
2. Does the protection technique match the workload class - VM snapshot, application-aware, agent, cloud-native, SaaS?
3. Is the hardware/edition appropriate for the performance, footprint, and refresh cycle?
4. Is the design policy-driven via Helios rather than hand-configured per job?
5. Are encryption, RBAC/MFA, immutability, and vaulting answered explicitly, not bolted on?
6. Is the design validated by a PoC artifact or as-built vs as-used review?

30-Day Study Plan and Test-Day Strategy

Phase Allocation

Analogy: a marathon training schedule, not a sprint. Domain 2 is the long-run portion of the week. Domain 5 is the cooldown. The synthesis weekend is the taper; the exam is race day.

Test-Day Strategy

The Day Before

• Confirm proctoring system check is green, ID is ready, environment is private.
• Re-read your one-page distilled summary of domain weights, RPO/RTO patterns, and the FortKnox + DataLock + DataHawk stack.
• Sleep eight hours. Do not cram.

During the Exam

• First 60 seconds: scan for constraints (RPO, RTO, retention, compliance, residency, budget, existing infrastructure). Underline them mentally.
• Next 30 seconds: eliminate distractors that violate any one constraint.
• If two options remain, pick the one that balances rather than maximizes a single axis.
• Flag any question taking more than two minutes; return on a second pass.
• Reserve the final 10 minutes for flagged questions and any blanks. No penalty for guessing - never leave blank.

After the Exam

• Pass: claim your two-year credential and start logging continuing-education hours.
• Fail: use the 14-day window deliberately. Run a domain-by-domain post-mortem; target the weakest domain for one focused week, then retake.

Key Takeaway: The exam is 90 minutes for 60 scenario MCQs at 60% passing - 90 seconds per question. Win by reading constraints first, eliminating distractors that violate any one constraint, and picking the balanced option. Allocate study time in proportion to domain weights, prioritizing Domain 2.

Chapter Summary

This chapter pulled the entire CCAE curriculum into three end-to-end architectures and one exam strategy. The global enterprise scenario showed how hub-and-spoke replication inside each region combines with one-to-many replication across regions to deliver multi-region survival. The healthcare scenario showed how DataLock, FortKnox Self-Managed, DataHawk, KMIP, and Helios Self-Managed combine into a HIPAA-aligned defense-in-depth stack. The MSP scenario showed how Organizations, Helios self-service, and REST/Terraform/Ansible automation deliver a multi-tenant DMaaS offering with metered chargeback. The exam blueprint section decoded COH500 and made the domain weights actionable. If you can defend each design in the three scenarios above, recognize the four distractor archetypes on sight, and finish a 60-question timed practice with at least 80% under exam conditions, you are ready to sit for the CCAE.