Configure and Monitor Ransomware Detection Alerts CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When a ransomware detection alert is received in a NetApp environment, what is the recommended first response to mitigate potential threats?

   • AReboot the storage controller
   • BDisable the ransomware detection feature
   • CIsolate the volume and take a snapshot
   • DImmediately delete the affected volume
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a primary purpose of monitoring ransomware detection alerts?

   • ATo identify and respond to potential ransomware attacks
   • BTo reduce storage capacity usage
   • CTo improve network performance
   • DTo automate data tiering
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A legal firm's storage administrator receives a ransomware detection alert for a volume containing case files. The alert was triggered by a high rate of file renames. The administrator checks the audit log and finds that the renames were performed by a backup application using a service account. What should the administrator do?

   • AImmediately isolate the volume by changing the export policy to deny all access.
   • BIncrease the 'likely ransomware' threshold on the volume to prevent future alerts.
   • CTreat the alert as a false positive and add the service account to the exclusion list.
   • DDelete the service account and recreate it with a different name.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which ONTAP feature must be enabled to generate ransomware detection alerts for a volume?

   • AFPolicy
   • BSnapMirror
   • CRansomware Detection
   • DSnapLock
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A manufacturing company's storage team receives a ransomware detection alert for a volume containing CAD files. The alert indicates a high rate of file modifications. The team suspects a ransomware attack but is unsure if it is a false positive due to an ongoing automated design simulation. What should they do FIRST to determine if the alert is legitimate?

   • ADisable the ransomware detection policy on the volume to stop further alerts.
   • BRestore the volume from the most recent Snapshot copy.
   • CCheck the ONTAP audit log to see which users or applications are performing the modifications.
   • DImmediately create a Snapshot copy of the volume to preserve the current state.
   Reveal Solution Discussion Select an answer first