Configure Data-At-Rest Encryption CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A storage administrator needs to verify that data-at-rest encryption is active on a specific volume in an ONTAP cluster. They have already enabled NVE on the volume and want to confirm the encryption state and the key ID used. Which command should they use to verify this information?

   • Astorage aggregate show
   • Bsecurity key-manager show
   • Caggregate encryption show
   • Dvolume encryption show
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is planning to encrypt data at rest on their ONTAP storage. They have a mix of workloads: some require granular encryption per volume, while others need a simpler approach that covers all volumes in a storage pool. They want to use NetApp's native encryption technologies. Which combination of technologies should they use?

   • AUse NVE for all volumes, as it can also encrypt aggregates.
   • BUse NVE for the granular volumes and NAE for the aggregate-level coverage.
   • CUse NAE for all volumes, as it provides both granular and aggregate encryption.
   • DUse a third-party encryption solution for all volumes.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What does the 'volume encryption show' command display in ONTAP?

   • AThe list of users who have access to encrypted volumes
   • BThe replication status of encrypted volumes
   • CThe encryption state and key management details for volumes
   • DThe performance metrics of encrypted volumes
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a common cause of encryption key access failures in ONTAP?

   • AThe aggregate is not encrypted
   • BThe volume is too large to encrypt
   • CThe external KMS is unreachable or the key is missing
   • DThe user does not have administrative privileges
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company uses an external KMS for ONTAP encryption. They need to rotate the encryption keys for a specific volume due to a security policy. The KMS is operational. What is the correct procedure to rotate the volume's encryption key?

   • AUse the 'security key-manager rekey' command on the cluster.
   • BDisable encryption on the volume and re-enable it with a new key.
   • CUse the 'volume encryption rekey' command on the volume.
   • DDelete the volume and recreate it with a new key.
   Reveal Solution Discussion Select an answer first