Which best practice helps ensure least privilege when designing IAM policies?

Use the same policy for all users to reduce complexity

Grant broad permissions to simplify management

Avoid using conditions to keep policies simple

Grant only the permissions required for the specific job function

A NetApp hybrid cloud administrator is writing an IAM policy to allow a backup application to create snapshots only on volumes that have a specific tag (e.g., 'Backup:Daily'). The policy must also restrict the action to a specific SVM. Which policy components are essential to achieve this requirement?

Resource, Condition, and Principal

Effect, Principal, and Resource

Action, Resource, and Condition

Statement ID, Action, and Effect

A storage administrator at a financial firm manages a NetApp hybrid cloud environment. They need to grant a DevOps team permission to create and delete ONTAP snapshots on a specific SVM, but must NOT allow them to delete the SVM itself. The administrator creates an IAM policy with two statements: one allowing 'snapshot:Create' and 'snapshot:Delete' on the SVM resource, and another explicitly denying 'svm:Delete' on the same resource. How will the policy evaluation logic treat these statements?

The deny only applies if the user is not already allowed by another policy.

The explicit deny overrides the allow, so the DevOps team cannot delete the SVM.

The allow statements take precedence because they are more specific to the snapshot actions.

The deny is ignored because it is in the same policy as the allows.

In IAM policy evaluation, what is the default result when a request is not explicitly allowed or denied?

Prompt for administrator approval

NetAppCertified Hybrid Cloud Administrator Professional (NCHC-Admin)

Domain 4Objective 1

IAM Policies CERTIFIED-HYBRID-CLOUD-ADMINISTRATOR Practice Questions (Page 4)

Part of the Secure and Protect domain, which makes up ~27% of our current practice bank. NetApp does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

6concepts

Questions 16–20

16foundation · easy
Which best practice helps ensure least privilege when designing IAM policies?
Select an answer first
17application · medium
A NetApp hybrid cloud administrator is writing an IAM policy to allow a backup application to create snapshots only on volumes that have a specific tag (e.g., 'Backup:Daily'). The policy must also restrict the action to a specific SVM. Which policy components are essential to achieve this requirement?
Select an answer first
18application · medium
A storage administrator at a financial firm manages a NetApp hybrid cloud environment. They need to grant a DevOps team permission to create and delete ONTAP snapshots on a specific SVM, but must NOT allow them to delete the SVM itself. The administrator creates an IAM policy with two statements: one allowing 'snapshot:Create' and 'snapshot:Delete' on the SVM resource, and another explicitly denying 'svm:Delete' on the same resource. How will the policy evaluation logic treat these statements?
Select an answer first
19application · medium
A NetApp hybrid cloud administrator is creating an IAM policy to allow a monitoring service to read performance metrics from all SVMs in a specific project, but only during business hours (9 AM to 5 PM). Which policy component is used to enforce the time restriction?
Select an answer first
20foundation · easy
In IAM policy evaluation, what is the default result when a request is not explicitly allowed or denied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CERTIFIED-HYBRID-CLOUD-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by NetApp. “CERTIFIED-HYBRID-CLOUD-ADMINISTRATOR” is a trademark of its owner, used for identification only.

IAM Policies CERTIFIED-HYBRID-CLOUD-ADMINISTRATOR Practice Questions (Page 4)

Questions 16–20

Which best practice helps ensure least privilege when designing IAM policies?

A NetApp hybrid cloud administrator is creating an IAM policy to allow a monitoring service to read performance metrics from all SVMs in a specific project, but only during business hours (9 AM to 5 PM). Which policy component is used to enforce the time restriction?

In IAM policy evaluation, what is the default result when a request is not explicitly allowed or denied?

Keep studying — Secure and Protect