A customer wants to enable tamper-proof Snapshot copies on volume LockingVolume, which is hosted on SVM LockingSVM. They have created the Snapshot…

The term "tamper-proof Snapshot copies" refers to the NetApp SnapLock Compliance feature. A fundamental prerequisite for using SnapLock Compliance on a cluster is the initialization of the secure Compliance Clock. This is a one-time, irreversible operation that must be performed on every node that will host a SnapLock Compliance volume. If the Compliance Clock is not initialized, ONTAP cannot establish the secure, non-resettable time source required to enforce WORM retention, and any attempt to create locked Snapshot copies will fail, even if the volume and policy are configured correctly.

A. volume modify -volume LockingVolume -anti-ransomware-state enable

This command enables the separate Autonomous Ransomware Protection (ARP) feature, which is distinct from SnapLock and does not create tamper-proof WORM Snapshot copies.

B. volume modify -volume LockingVolume -snapdir-access false

This command only controls client visibility of the .snapshot directory. It does not affect the WORM (tamper-proof) state of the Snapshot copies within it.

C. snaplock event-retention apply -vserver LockingSVM

This command is used for applying an Event-Based Retention (EBR) policy. It is a feature used with SnapLock but is not the initial step required to enable the core SnapLock functionality.

1. NetApp ONTAP 9.12.1 Documentation, "How to initialize the ComplianceClocks": "Before you can create a SnapLock Compliance aggregate, you must initialize the ComplianceClock on each node in the cluster that will contain the aggregate. You initialize the ComplianceClocks by using the snaplock compliance-clock initialize command." This confirms that initializing the clock is a mandatory prerequisite.

2. NetApp ONTAP 9.12.1 Command Reference, snaplock compliance-clock initialize: "The snaplock compliance-clock initialize command initializes the compliance clock on one or more nodes. The compliance clock must be initialized on a node before a SnapLock Compliance aggregate can be created on that node. This is a one-time operation and cannot be reversed." This directly supports the answer by defining the command's purpose as a prerequisite.

3. NetApp ONTAP 9.12.1 Documentation, "Overview of Autonomous Ransomware Protection": This document describes the anti-ransomware feature, showing it is a separate mechanism from SnapLock for protecting against ransomware via workload analysis and automatic Snapshot creation, not WORM locking. This clarifies why option A is incorrect.