Configure and Monitor Ransomware Detection Alerts CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A managed service provider (MSP) monitors multiple customer ONTAP clusters. They want to centralize ransomware detection alerts from all clusters into a single SIEM platform. The SIEM supports Syslog and REST API ingestion. What is the most efficient way to configure alert delivery?

   • ACreate a new ONTAP user with the 'admin' role on each cluster and share the credentials with the SIEM.
   • BManually check each cluster's event log daily and copy relevant alerts into the SIEM.
   • CConfigure each cluster's event notification to send Syslog messages to the SIEM's Syslog collector.
   • DEnable the REST API on each cluster and have the SIEM poll each cluster's alert endpoint every hour.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's storage administrator receives a ransomware detection alert for a volume. The alert severity is 'warning'. The administrator is busy with another task and decides to ignore the alert. What is the potential risk of this action?

   • AThe volume will be automatically isolated to prevent further damage.
   • BThe alert will automatically escalate to a 'critical' severity if ignored.
   • CThe ransomware detection policy will be disabled on the volume.
   • DThe ransomware attack may continue undetected, causing more data to be encrypted or deleted.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hospital's storage administrator receives a ransomware detection alert for a volume containing patient records. The alert is confirmed as a real attack. The administrator has already created a Snapshot copy. What is the NEXT appropriate action?

   • ARestore the volume from the Snapshot copy immediately.
   • BIsolate the volume by changing the export policy to deny access to all clients except the storage admin.
   • CDelete the Snapshot copy to prevent the attacker from accessing it.
   • DDisable ransomware detection on the volume to stop further alerts.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services firm receives a ransomware detection alert on a critical database volume. The alert indicates a high rate of file renames and modifications. The administrator has verified the alert is legitimate and not a false positive. What is the FIRST action the administrator should take to mitigate the threat?

   • ACreate an immediate Snapshot copy of the affected volume to preserve a known-good recovery point.
   • BDisable the ransomware detection policy on the volume to stop further alerts.
   • CDelete the affected volume and restore from the most recent Snapshot copy.
   • DChange the volume's export policy to deny all access immediately.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company's storage team is responding to a confirmed ransomware attack. They have isolated the affected volume and created a Snapshot copy. The security team wants to analyze the attack pattern to determine the entry point. What should the storage team provide to the security team?

   • AThe ONTAP audit log for the affected volume, showing file access and modification events.
   • BThe Snapshot copy of the volume for the security team to restore.
   • CThe ransomware detection alert details, including the severity and timestamp.
   • DThe volume's export policy configuration to see who had access.
   Reveal Solution Discussion Select an answer first