Configure NAE, NVE, and NSE (SEDs) for Encryption at Rest CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of an external key management server (KMS) in NetApp encryption?

   • ATo authenticate users accessing the storage system
   • BTo perform the encryption and decryption of data
   • CTo manage and store encryption keys
   • DTo store encrypted data
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A data center is replacing failed drives in an ONTAP cluster that uses NSE with SEDs. The administrator needs to ensure that the replacement drives are properly integrated with the cluster's key management. What must the administrator do after installing the new SEDs?

   • AReboot the cluster to initialize the new SEDs
   • BThe new SEDs are automatically recognized and secured by the cluster
   • CManually configure the new SEDs with the KMIP server
   • DEnable NVE on the volumes on the new SEDs
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services firm has an ONTAP cluster with mixed workloads. Most volumes contain non-sensitive data and must remain unencrypted for performance reasons. However, a new volume will store customer PII and must be encrypted at rest. The cluster uses an external KMIP server for key management. What should the administrator do to encrypt only the new volume?

   • ACreate the volume with NVE enabled and specify the existing KMIP key management
   • BEnable NAE on the aggregate containing the volume
   • CEnable NSE on the drives and create the volume normally
   • DCreate the volume without encryption and use a filesystem-level tool
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A media company is purchasing a new ONTAP system and wants hardware-based encryption with the lowest possible CPU overhead on the storage controllers. The data is not highly sensitive, but the company wants to protect against physical theft of drives. The administrator has no preference for per-volume or per-aggregate encryption. What should the administrator choose?

   • AUse NVE on all volumes
   • BUse NSE with self-encrypting drives (SEDs)
   • CUse NAE on all aggregates
   • DUse a combination of NAE and NVE
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A research lab is deploying a new ONTAP cluster for high-performance computing (HPC). The data is not sensitive, but the lab wants to protect against physical theft of drives. The performance requirement is critical, and the lab wants to minimize any CPU overhead from encryption. What should the administrator configure?

   • AEnable NSE on the drives
   • BEnable NVE on the volumes
   • CEnable NAE on the aggregates
   • DUse a combination of NAE and NVE
   Reveal Solution Discussion Select an answer first