Configure Native File Auditing or Auditing with an External FPolicy Server CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which protocol is commonly used for communication between ONTAP and an external FPolicy server?

   • ANFS
   • BSMB
   • CHTTPS
   • DRPC
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a common method to monitor FPolicy events from an external server?

   • AChecking the SVM root volume for audit logs
   • BUsing the EMS to view events
   • CUsing the ONTAP CLI to view events
   • DReviewing the FPolicy server's event logs
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has enabled native file auditing on their ONTAP SVM to track file access. The security team wants to generate a report of all failed access attempts in the last month. What should the administrator use to generate this report?

   • AUse the ONTAP CLI to run a command that generates a report of failed access attempts from the audit log.
   • BConfigure an external FPolicy server to send events to a SIEM and query the SIEM for failed access attempts.
   • CAccess the audit log through the ONTAP System Manager and export all events to a CSV file for manual review.
   • DUse the ONTAP audit log and filter for events with a failure status.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services firm must enable auditing for file access on their ONTAP SVM. They need to track read and write events on a specific volume, but they do not want to deploy any additional servers. The compliance team requires that audit logs be searchable and retained for at least one year. What should the administrator configure?

   • AEnable native file auditing on the SVM and create an audit policy that logs reads and writes on the volume, then export the logs to a remote syslog server for retention.
   • BEnable native auditing and store the logs locally on the ONTAP cluster, relying on the default retention settings.
   • CConfigure an external FPolicy server with a policy that captures all file access events and forwards them to a SIEM for retention.
   • DCreate an FPolicy policy on the SVM that logs events to the audit log, but do not configure any export or retention.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which ONTAP command is used to enable native file auditing on a Storage Virtual Machine (SVM)?

   • Avserver audit enable
   • Bvserver audit start
   • Csecurity audit enable
   • Dvserver fpolicy enable
   Reveal Solution Discussion Select an answer first