A ransomware attack has compromised all files on a CIFS share. The volume had a retention policy of five daily Snapshot copies, but unfortunately, no…

The scenario describes a situation where Snapshot copies were deleted by a malicious actor who only had access to the CIFS share, not administrative access to the ONTAP cluster. This is possible if the .snapshot directory is visible and accessible to clients. The command volume modify -snapdir-access false disables client visibility and access to the .snapshot directory within the volume. By making this directory inaccessible from the CIFS share, ransomware (or any user) is prevented from traversing into it and deleting the Snapshot copies, thus preserving the primary quick restore mechanism.

A. volume autosize -autogrow disable

This command prevents a volume from growing automatically. It is a capacity management feature and does not provide any security against the deletion of Snapshot copies.

B. security multi-admin-verify modify -enabled true

This enables multi-admin verification for privileged administrative commands. It would not prevent Snapshot deletion via a client protocol like CIFS, as the attacker did not have cluster-level access.

D. volume snapshot -autodelete disabled

This prevents ONTAP from automatically deleting Snapshot copies for space reclamation. It does not prevent a malicious user with share access from manually deleting them if the .snapshot directory is accessible.

1. NetApp Technical Report TR-4572, "Ransomware Protection Using NetApp ONTAP":

Section: "ONTAP Snapshot copies," Page 8.

Content: "By default, the Snapshot directory is visible to clients... To prevent ransomware from traversing the Snapshot directory and deleting backups, you should disable this feature by using the volume modify -vserver -volume -snapdir-access false command." This directly supports the correct answer as a primary ransomware mitigation step.

2. NetApp ONTAP 9 Commands: Manual Page Reference, volume modify:

Parameter: -snapdir-access {true|false}

Content: The documentation specifies that this parameter controls "whether the .snapshot directory is visible and accessible to clients." Setting it to false makes it inaccessible, which is the required action in the question's scenario.

3. NetApp ONTAP 9 Security Hardening Guide for NAS:

Section: "Snapshot copy security," Page 18.

Content: "You should disable access to the Snapshot directory from the client... Disabling access to the Snapshot directory prevents users from accidentally (or intentionally) deleting files in Snapshot copies." This reinforces the best practice of using -snapdir-access false.