Set up Onboard or External Key Manager CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A NetApp administrator receives an alert that the storage system cannot communicate with the external key manager. What is the most likely cause?

   • AThe encryption keys have been rotated
   • BThe KMIP port (5696) is blocked by a firewall
   • CThe storage system is using the onboard key manager
   • DThe key manager is not configured for high availability
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is using an external key manager for NetApp encrypted volumes. The security team wants to ensure that if an employee with access to the key manager is terminated, the encrypted data remains protected. What should the admin do to mitigate the risk of key compromise?

   • ADelete the employee's user account from the key manager.
   • BChange the key manager's admin password.
   • CRotate the encryption keys immediately after the employee's termination.
   • DDisable the encrypted volumes temporarily.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A NetApp admin is configuring a new external key manager and is asked to provide the key manager's certificate to the NetApp cluster. What is the purpose of this certificate?

   • ATo authenticate the NetApp cluster to the key manager.
   • BTo store the encryption keys on the NetApp cluster.
   • CTo encrypt the communication between the NetApp cluster and the key manager.
   • DTo establish a trusted connection between the NetApp cluster and the key manager.
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   A small business runs a single NetApp FAS system and wants to enable NetApp Volume Encryption (NVE) without adding any external infrastructure. They want to minimize administrative overhead and are comfortable with keys being stored on the storage system itself. Which key management approach should they use?

   • AConfigure the onboard key manager on the NetApp system.
   • BDeploy a KMIP-compliant external key manager on a separate server.
   • CUse a USB-based hardware security module (HSM) connected to the storage system.
   • DDisable encryption and rely on the storage system's built-in physical security.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is setting up a new external key manager and needs to configure the NetApp storage to communicate with it. The key manager supports KMIP 1.4. The storage admin is unsure which version of KMIP to use. What should the admin do?

   • AUse KMIP 1.4 only if the NetApp system supports it; otherwise, use a different protocol.
   • BUse the highest KMIP version supported by both the NetApp system and the key manager.
   • CUse the onboard key manager instead of the external one to avoid KMIP version issues.
   • DAlways use KMIP 1.0 for maximum compatibility.
   Reveal Solution Discussion Select an answer first