ONTAP's Autonomous Anti-ransomware engine reports a potential ransomware attack. The administrator finds the majority of the files appear encrypted…

Upon confirming a ransomware attack, the primary goal is to restore data to a clean, pre-attack state. The standard ONTAP recovery procedure involves using the SnapRestore feature to revert the entire volume to a known-good Snapshot copy created before the attack occurred. This action effectively undoes the encryption performed by the ransomware, minimizing data loss to only the changes made between the time the snapshot was taken and the time of the attack. The Autonomous Ransomware Protection (ARP) feature is designed to facilitate this by identifying the last known good recovery points.

A. Create a FlexClone using the locked snapshot and re-enable the share

The locked snapshot is created by the anti-ransomware engine during the attack and contains the encrypted files. Cloning it is for forensic analysis, not for data recovery.

C. Rehost the volume to a different SVM and create a new share

Moving the volume to a different Storage Virtual Machine (SVM) does not alter the data within it; the files would remain encrypted.

D. Take a manual snapshot and re-enable the share

Taking a new snapshot would preserve the current, encrypted state of the data, which is counterproductive to the recovery effort.

---

1. NetApp Technical Report TR-4878: Security Hardening Guide for NetApp ONTAP 9, Page 48, Section 5.3.2 Ransomware Recovery.

"After you have confirmed that the alert is a true positive, you can begin the recovery process. The first step is to identify the last known good Snapshot copy. ... After you have identified the last known good Snapshot copy, you can use SnapRestore to revert the volume to that point in time." This directly supports using SnapRestore with a pre-attack snapshot for recovery.

2. ONTAP 9 Documentation Center, volume snapshot restore command reference.

"The volume snapshot restore command restores a volume to a previous state as captured in a Snapshot copy." This official command documentation confirms that SnapRestore is the designated tool for reverting a volume to a specific point-in-time snapshot.

3. NetApp Technical Report TR-4572: Ransomware Protection and Recovery with NetApp ONTAP, Page 12, Section "Recovering from an Attack".

"The primary method for recovering from a ransomware attack is to restore from a known good Snapshot copy. ... The SnapRestore feature in ONTAP allows you to revert an entire volume to a previous Snapshot copy." This document explicitly states that SnapRestore is the primary recovery method. It also clarifies on page 11 that the snapshot taken by ARP is for forensic purposes, reinforcing why option A is incorrect.