Set up Onboard or External Key Manager CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company uses NetApp ONTAP with the onboard key manager. As part of a security audit, they are required to periodically change the encryption keys that protect their volumes. The storage admin needs to perform this task without disrupting access to the volumes. What should the admin do?

   • ADisable encryption on the volumes and then re-enable it with new keys.
   • BReinitialize the onboard key manager to generate new keys.
   • CDelete the existing volumes and recreate them with new encryption keys.
   • DUse the ONTAP key rotation feature to rotate the volume encryption keys.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational company is deploying NetApp storage in a region where data sovereignty laws require encryption keys to remain within the country. They plan to use an external key manager hosted in a public cloud. The key manager provider offers multiple regions. What should the company do to comply with the data sovereignty requirement?

   • AUse a key manager that supports customer-managed keys.
   • BSelect a key manager region located within the same country as the NetApp storage.
   • CUse the onboard key manager instead of the external one to keep keys on-premises.
   • DEncrypt the keys before sending them to the external key manager.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A hospital network uses NetApp storage with an external KMIP key manager for all encrypted volumes. The key manager is currently a single server. The hospital is planning a maintenance window for that server and wants to ensure that encrypted volumes remain accessible if the key manager becomes unavailable during the maintenance. What should the storage admin do to maintain key manager availability?

   • ATemporarily switch the NetApp cluster to the onboard key manager during the maintenance window.
   • BBack up the key manager database and restore it to a standby server before the maintenance.
   • CConfigure a second external key manager as a high-availability pair and register both with the NetApp cluster.
   • DPlace the key manager in a maintenance mode that allows read-only access to keys.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which NetApp CLI command is used to enable the onboard key manager?

   • Asecurity key-manager create
   • Bsecurity key-manager onboard enable
   • Csecurity key-manager setup
   • Dsecurity key-manager external enable
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services firm is integrating its NetApp AFF systems with an existing enterprise key management infrastructure that uses a KMIP-compliant external key manager. The firm requires that all key management operations be handled by the central key manager and that the NetApp storage systems do not store any keys locally. During the integration, the storage admin must configure the NetApp systems to communicate with the external key manager. Which configuration step is essential for this integration?

   • ACreate a new SVM and assign the external key manager as the SVM's key management service.
   • BEnable the onboard key manager on each NetApp system and then register the external key manager as a secondary key server.
   • CInstall the external key manager's client software directly on each NetApp controller to enable direct key management.
   • DConfigure the NetApp systems to use the KMIP protocol to connect to the external key manager's IP address and port, and provide the required certificates.
   Reveal Solution Discussion Select an answer first