A storage admin wants automatic snapshot creation when ransomware is detected. Which ONTAP mechanism should be enabled?

ONTAP's Autonomous Ransomware Protection (ARP) is a built-in security feature that uses machine learning to detect file activity indicative of a ransomware attack, such as unusual file entropy changes. When a potential threat is identified, the ARP AutoSnapshot Response mechanism is automatically triggered. This feature takes an immediate, immutable (locked) local Snapshot copy of the affected volume. This preserves a clean recovery point just before widespread encryption can occur, minimizing potential data loss and providing a rapid recovery option.

A. SnapMirror Sync: This is a synchronous data replication feature for zero data loss disaster recovery, not a ransomware detection or response tool.

B. SnapCenter Alert Workflow: This is a higher-level automation tool. The primary, built-in ONTAP mechanism for immediate snapshot response is ARP.

D. NDMP Replication Agent: NDMP is a network data management protocol for backups and is not involved in real-time threat detection or automated snapshot responses.

1. NetApp ONTAP Documentation. (2023). Overview of Autonomous Ransomware Protection. NetApp Product Documentation. It states, "When a threat is detected, ARP automatically takes a Snapshot copy of the affected volume to protect the data before it is encrypted."

2. NetApp. (2023). TR-4878: NetApp Autonomous Ransomware Protection. Section: "Automatic Snapshot copies". This technical report details the automatic response, explaining that when the workload analytics engine detects an attack, it "triggers an automatic Snapshot copy of the volume."