Veeam Enterprise Manager provides centralized management for Veeam Backup & Replication environments.
It enables the administrator to manage licensing and role-based access control across multiple Veeam Backup servers in different locations, offering a unified control panel with minimal effort compared to other options that would require more complex setups or custom development work.References:
* Veeam Backup & Replication User Guide: Veeam Enterprise Manager
* Veeam Help Center: Centralized Management with Enterprise Manager

Explanation
According to the Veeam Agent for Linux User Guide1, Veeam Agent for Linux lets you use the Veeam Recovery Media - a recovery image of the Linux OS that provides an alternative way to boot your computer.
The recovery image is an ISO file that you can burn to a CD/DVD or write to a USB flash drive.

To provide immutable backups on a secondary site with a different media, the best option given the context is B: Create a Scale Out Backup Repository (SOBR) with the existing Microsoft Windows Server as the performance tier and an AWS S3 bucket with immutability enabled as the capacity tier.
This approach involves leveraging the existing backup infrastructure (Microsoft Windows Server with direct-attached storage) as the performance tier of the SOBR, where the most recent backups are stored for fast access. For long-term storage and immutability, backups can be offloaded to an AWS S3 bucket configured with Object Lock. The Object Lock feature in AWS S3 provides an additional layer of data protection by making the backup data immutable, meaning it cannot be deleted or modified for a specified duration. This setup ensures that backup data is protected against accidental deletion, ransomware, and other malicious activities.
By implementing this configuration, the engineer can achieve the desired level of data protection and immutability, utilizing cloud storage as a secure and scalable secondary backup location, distinct from the primary on-premises storage media.

In active full backups, the entire dataset is backed up each time the backup job runs, whereas in synthetic full backups, only the changes since the last full backup are backed up. If the engineer configured the backup job to run active full backups instead of synthetic full backups, it's possible that the data from the full backup taken 60 days ago is still being retained as part of the regular backup process. Therefore, it hasn't been removed automatically after 60 days as expected.

Reference: https://helpcenter.veeam.com/docs/backup/em/em_disk_restore.html?ver=100