Which command enables encryption when creating a new volume?

The volume create command in the ONTAP CLI is used to provision new volumes. To enable NetApp Volume Encryption (NVE) on a new volume at the time of its creation, the -encrypt true parameter must be included. This flag instructs ONTAP to associate an encryption key with the volume and encrypt all data written to it. An onboard or external key manager must be configured on the cluster beforehand for this operation to succeed. The full command requires other parameters like -vserver, -volume, and -aggregate.

B. The security key-manager create command is used to configure a connection to an external key management server, a prerequisite for encryption, not for creating an encrypted volume.

C. The snapmirror create -encrypt command is used to enable encryption for in-flight data during a SnapMirror replication, not for creating an encrypted volume at rest.

D. The aggregate create -secure command syntax is incorrect. Aggregate-level encryption (NAE) is enabled with the -encrypt-with-aggr-key true parameter during aggregate creation.

1. NetApp ONTAP 9 Commands. (2023). volume create. NetApp Product Documentation. Retrieved from docs.netapp.com. The command manual lists -encrypt [true|false] as the parameter to "Specify whether the volume is encrypted."

2. NetApp ONTAP Documentation. (2023). Encrypting a new volume. NetApp Product Documentation. Retrieved from docs.netapp.com. This guide provides the exact procedure: "You can encrypt a new FlexVol volume or FlexGroup volume by using the volume create command with the -encrypt parameter set to true."