You want to set up an important management solution that must comply with FIPS 140-2. The solution should support a multi-clusters environment and…

The solution requires centralized key management for a multi-cluster environment while complying with FIPS 140-2. NetApp Volume Encryption (NVE) is a software-based encryption feature that meets these needs. For multi-cluster environments, an external key management server (EKMS) is mandatory to provide centralized control, as the onboard key manager (OKM) is limited to a single cluster. Communication between ONTAP clusters and the EKMS is standardized through the Key Management Interoperability Protocol (KMIP). When a FIPS 140-2 validated EKMS is used with ONTAP's FIPS-validated cryptographic modules, the entire solution complies with the FIPS 140-2 standard.

A. While NSE can use an external key manager, NVE is the more granular and flexible software-based encryption solution typically deployed for this type of management requirement.

B. The onboard key manager is restricted to a single cluster and cannot provide the required centralized management for a multi-cluster environment.

C. The onboard key manager cannot manage multiple clusters, and NSE is hardware-based, making NVE the more appropriate "management solution" for encrypted volumes.

1. NetApp ONTAP 9 Documentation, "Overview of NetApp Volume Encryption and NetApp Aggregate Encryption": "You can use an external key manager when you need to manage keys for a large number of clusters or when your business policies require an external key manager." This confirms the need for an external key manager in a multi-cluster environment.

2. NetApp Technical Report TR-4567, "NetApp Volume Encryption," Page 6, Section: Key Management: "External key managers are recommended for large-scale deployments that span multiple sites and clusters... The onboard key manager is best suited for small to medium-sized environments that do not have an existing key management infrastructure and that want a simple, low-cost, and self-contained solution."

3. NetApp ONTAP 9 Documentation, "How to enable FIPS 140-2 compliance": "ONTAP provides a FIPS 140-2 compliant solution for data-at-rest encryption by using NetApp Volume Encryption (NVE)... and a FIPS 140-2 validated external key manager." This document explicitly links NVE, external key managers, and FIPS 140-2 compliance.