NS0-950 Practice Questions

ONTAP's Autonomous Ransomware Protection (ARP) is a built-in security feature that uses machine learning to detect file activity indicative of a ransomware attack, such as unusual file entropy changes. When a potential threat is identified, the ARP AutoSnapshot Response mechanism is automatically triggered. This feature takes an immediate, immutable (locked) local Snapshot copy of the affected volume. This preserves a clean recovery point just before widespread encryption can occur, minimizing potential data loss and providing a rapid recovery option.

A. SnapMirror Sync: This is a synchronous data replication feature for zero data loss disaster recovery, not a ransomware detection or response tool.

B. SnapCenter Alert Workflow: This is a higher-level automation tool. The primary, built-in ONTAP mechanism for immediate snapshot response is ARP.

D. NDMP Replication Agent: NDMP is a network data management protocol for backups and is not involved in real-time threat detection or automated snapshot responses.

1. NetApp ONTAP Documentation. (2023). Overview of Autonomous Ransomware Protection. NetApp Product Documentation. It states, "When a threat is detected, ARP automatically takes a Snapshot copy of the affected volume to protect the data before it is encrypted."

2. NetApp. (2023). TR-4878: NetApp Autonomous Ransomware Protection. Section: "Automatic Snapshot copies". This technical report details the automatic response, explaining that when the workload analytics engine detects an attack, it "triggers an automatic Snapshot copy of the volume."

NetApp Active IQ Digital Advisor is a cloud-based AIOps platform that provides predictive analytics and proactive wellness checks for a customer's entire NetApp infrastructure. It automatically collects telemetry data from all registered systems and audits them against NetApp's best practices. This includes a comprehensive assessment of data protection coverage, highlighting clusters and volumes that are not protected, thereby ensuring compliance with business policies across a multi-cluster environment.

A. SnapVault Monitor is not a distinct NetApp service; SnapVault is a technology monitored by tools like Active IQ Unified Manager, not a standalone compliance auditor.

C. SnapCenter Orchestrator is focused on creating and managing application-consistent backups and clones, not on providing a high-level, automated compliance audit service.

D. FabricPool Manager is not a NetApp service. FabricPool is a data tiering technology managed through ONTAP System Manager or the CLI.

1. NetApp Active IQ Digital Advisor Datasheet. "Active IQ Digital Advisor". The datasheet describes its function: "It continuously checks the health of your NetApp environment... It identifies risks to availability, protection, performance, and efficiency."

2. NetApp Official Blog. "What is NetApp Active IQ?". The article explains that Active IQ provides "Actionable intelligence for data protection" and identifies "unprotected systems."

NetApp SnapLock in Compliance mode is the feature designed to provide immutable, WORM (Write Once, Read Many) data protection. When a volume is configured for SnapLock Compliance, the data and any associated Snapshot copies are locked for a specified retention period. During this period, the data cannot be modified or deleted by anyone, including a system administrator. This provides the highest level of protection against ransomware, which often attempts to delete or encrypt backups to prevent recovery.

A. SnapVault: This is a backup relationship technology; while it can send snapshots to a SnapLock destination, SnapVault itself does not provide immutability.

B. Snapshot autodelete: This feature automatically deletes older snapshots to free up space, which is the opposite of preventing deletion.

D. NDMP: This is a protocol used for backing up NAS data to third-party backup applications; it is not an ONTAP immutability feature.

1. NetApp, Inc. (2022). TR-4526: SnapLock. Section: "SnapLock Compliance," p. 8. States that in Compliance mode, "a file cannot be deleted until it has passed its retention date, even by an administrator."

2. NetApp, Inc. (2022). TR-4574: NetApp Solution for Ransomware. Section: "Immutable Snapshot copies," p. 9. Recommends SnapLock to "prevent Snapshot copies from being deleted by a rogue administrator or ransomware."

3. NetApp, Inc. (2023). ONTAP 9 Documentation: How SnapLock works. This document describes how SnapLock Compliance meets strict regulatory requirements (like SEC Rule 17a-4) for non-erasable, non-rewritable data storage.

A SnapVault policy contains rules that define which source Snapshot copies are transferred to the destination. Each rule is based on a "SnapMirror label," which is a text tag associated with a snapshot. During a SnapVault update, ONTAP identifies new snapshots on the source that have a label matching a rule in the policy and transfers them to the vault destination. This label-based mechanism allows for granular control over the backup schedule (e.g., "daily," "weekly," "monthly").

B. The retention count is part of the policy rule, but it defines how many snapshots to keep on the destination, not which ones to transfer.

C. The snapshot autodelete policy is a volume-level setting that manages local snapshot deletion to reclaim space and is unrelated to replication.

D. Mirror consistency policy is not a standard ONTAP term. Consistency is an attribute of a relationship, not a policy for selecting snapshots.

1. NetApp ONTAP 9 Documentation Center. (2022). Data protection using SnapMirror technology. Section: "Create a SnapMirror policy for SnapVault relationships". "You create rules for the policy that specify the SnapMirror label of the Snapshot copies to be transferred and the number of copies to be retained on the destination."

2. NetApp, Inc. (2020). TR-4015: SnapMirror Configuration and Best Practices Guide for ONTAP 9.8. Section 3.1, "SnapMirror Policy Types," p. 14. "The Vault policy transfers Snapshot copies that have a matching SnapMirror label."

NetApp Storage Encryption (NSE) provides hardware-based, full-disk encryption for data at rest using self-encrypting drives (SEDs). Each NSE drive has a built-in cryptographic engine that automatically encrypts all data written to the drive and decrypts all data read from it, without any performance impact on the storage controller. This ensures data on a drive is secure even if it is physically removed from the storage system. NSE provides a foundational layer of security at the hardware level.

A. NVE (NetApp Volume Encryption) is a software-based encryption feature that operates at the volume level, not the hardware/disk level.

B. NAE (NetApp Aggregate Encryption) is a software-based encryption feature that operates at the aggregate level, encrypting all volumes within it.

D. SnapVault Encryption refers to the encryption of backup data during transit or at the destination, not hardware-based encryption on the primary system's disks.

1. NetApp ONTAP Documentation Center. (2023). Overview of NetApp Storage Encryption. In ONTAP 9 Security and data encryption. The document states, "NetApp Storage Encryption (NSE) is a solution that uses special self-encrypting drives to provide full disk, hardware-based encryption of data at rest."

2. NetApp. (2022). TR-4567: NetApp ONTAP Encryption Power Guide. Section 2.1, "NetApp Storage Encryption (NSE)," describes NSE as a hardware-based solution using self-encrypting drives (SEDs).

The vault SnapMirror policy is specifically designed for long-term retention and archival. It replicates a history of snapshots from the source volume to the destination, based on rules defined in the policy (e.g., keep 30 daily, 12 monthly). This creates multiple, distinct points in time on the destination volume. Consequently, it offers the most granular options for restoring data from various historical points, which is ideal for backup and compliance purposes. Other policies are designed for disaster recovery with fewer recovery points.

B. mirror-latest replicates only the most recent snapshot, providing a single recovery point for disaster recovery, not historical granularity.

C. sync (SnapMirror Synchronous) maintains a real-time mirror with a zero Recovery Point Objective (RPO), offering no historical snapshot retention.

D. replica is a general term for a copy of data and not a specific, pre-defined SnapMirror policy type in ONTAP.

1. NetApp. (2023). TR-4015: ONTAP Data Protection Power Guide. Section: "SnapMirror policy types," pp. 12-13. This document explicitly states, "A vault policy is used to create a remote backup copy of the source volume for long-term retention."

2. NetApp. (2023). ONTAP 9 Data protection administration guide. Section: "SnapMirror policy types". This guide details that the vault policy type is used to transfer a specified set of Snapshot copies for archival purposes.

The mirror-all-snapshots policy type is designed for SnapMirror relationships where the destination volume must be an exact, block-for-block replica of the source. This includes replicating the entire history of Snapshot copies, both scheduled and manually created (custom), from the source volume to the destination. This ensures the destination has the same point-in-time recovery options as the source.

A. mirror-latest only replicates the most recent Snapshot copy, not the entire history, making it unsuitable for retaining all custom snapshots.

B. vault is used for SnapVault relationships and transfers only those snapshots that match a specific SnapMirror label defined in the policy.

D. sync refers to a synchronous replication type (SnapMirror Synchronous) that replicates data writes in real-time, not historical Snapshot copies.

1. NetApp, Inc. (2020). TR-4015: SnapMirror Configuration and Best Practices Guide for ONTAP 9.8. Section 3.1, "SnapMirror Policy Types," p. 13. "The MirrorAllSnapshots policy replicates all Snapshot copies from the source volume to the destination volume."

2. NetApp ONTAP 9 Documentation Center. (2022). Data protection using SnapMirror technology. Section: "SnapMirror policy types". "MirrorAllSnapshots: Replicates all the Snapshot copies from the source volume to the destination volume."

The volume create command in the ONTAP CLI is used to provision new volumes. To enable NetApp Volume Encryption (NVE) on a new volume at the time of its creation, the -encrypt true parameter must be included. This flag instructs ONTAP to associate an encryption key with the volume and encrypt all data written to it. An onboard or external key manager must be configured on the cluster beforehand for this operation to succeed. The full command requires other parameters like -vserver, -volume, and -aggregate.

B. The security key-manager create command is used to configure a connection to an external key management server, a prerequisite for encryption, not for creating an encrypted volume.

C. The snapmirror create -encrypt command is used to enable encryption for in-flight data during a SnapMirror replication, not for creating an encrypted volume at rest.

D. The aggregate create -secure command syntax is incorrect. Aggregate-level encryption (NAE) is enabled with the -encrypt-with-aggr-key true parameter during aggregate creation.

1. NetApp ONTAP 9 Commands. (2023). volume create. NetApp Product Documentation. Retrieved from docs.netapp.com. The command manual lists -encrypt [true|false] as the parameter to "Specify whether the volume is encrypted."

2. NetApp ONTAP Documentation. (2023). Encrypting a new volume. NetApp Product Documentation. Retrieved from docs.netapp.com. This guide provides the exact procedure: "You can encrypt a new FlexVol volume or FlexGroup volume by using the volume create command with the -encrypt parameter set to true."

Storing tamper-proof snapshots on a separate volume, ideally in a different aggregate or cluster, provides an "air gap" or isolation. If the primary volume is compromised by a ransomware attack that encrypts or attempts to delete the volume, the isolated snapshot copies remain unaffected. This ensures that an immutable, unencrypted copy of the data is available for recovery. This separation is a critical component of a defense-in-depth strategy against ransomware, preventing the attack from spreading to the backup data.

A. Storing snapshots separately does not inherently reduce latency; it could slightly increase latency for restores compared to local snapshots.

B. Snapshot autodelete policies are managed at the volume level; separation does not simplify this process and could add management overhead.

D. Separating snapshots from their primary volume can reduce storage efficiency, as it may limit cross-volume deduplication opportunities.

1. NetApp. (2022). TR-4572: Ransomware Protection and Recovery with NetApp ONTAP. Section 3.2, "Isolate Data Copies". This document states, "To protect against an attack that compromises the primary storage system, you must have a copy of your data that is physically separate from the primary system."

2. NetApp. (2023). ONTAP 9.13.1 Documentation: Protect against ransomware. This guide recommends, "Create a logically air-gapped copy of your data by replicating it to a different cluster or to object storage." This logical separation isolates the backup data.

NetApp Volume Encryption (NVE) is a software-based feature in ONTAP that provides granular, volume-level encryption for data at rest. It encrypts all data within a volume, including all snapshots of that volume. NVE uses a unique XTS-AES-256 key for each volume, ensuring data is secure even if a disk is removed from the system. This feature can be enabled on new or existing volumes (via a volume move) and is managed through an onboard or external key manager.

A. NetApp SnapLock is a WORM (Write Once, Read Many) feature for data retention and compliance, not a general-purpose encryption technology.

C. FabricPool is a data tiering technology that moves inactive data to object storage; it is not a primary data-at-rest encryption feature for volumes.

D. SnapMirror Sync is a synchronous data replication feature for disaster recovery, focused on data availability, not encryption of the source volume.

1. NetApp ONTAP Documentation Center. (2023). Overview of NetApp Volume Encryption. In ONTAP 9 Security and data encryption. Retrieved from NetApp documentation. This document states, "NetApp Volume Encryption (NVE) is a software-based, full-volume encryption solution... NVE encrypts all data in a volume."

2. NetApp. (2022). TR-4567: NetApp ONTAP Encryption Power Guide. This technical report details NVE as the software-based, volume-granular encryption solution. Section 2, "NetApp Encryption Solutions," describes NVE's function.