Security Policies CERTIFIED-HYBRID-CLOUD-ADMINISTRATOR Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A company has a policy that allows NFS access to a volume from the 192.168.1.0/24 subnet, but only for read-only operations. A new application server in that subnet needs write access. The administrator wants to modify the existing policy without affecting other clients in the subnet. What should the administrator do?

   • AAdd a new rule with a higher priority that allows read-write access for the specific IP of the new server.
   • BChange the existing rule's access type to 'read-write' for the entire subnet.
   • CDelete the existing rule and create a new rule that allows read-write for the entire subnet.
   • DCreate a new export policy for the volume and assign it to the new server's SVM.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An administrator has applied a new export policy to a volume, but clients are still able to mount the volume even though the policy should deny them. What is the most likely cause?

   • AThe export policy is not yet activated because the SVM was not rebooted.
   • BThe clients are using SMB instead of NFS, so the export policy does not apply.
   • CThe export policy is disabled, so it is not being enforced.
   • DThe volume is still using the old export policy because the new policy was not assigned to the volume.
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A company runs a hybrid cloud with ONTAP clusters on-premises and Cloud Volumes ONTAP in AWS. The security team mandates that all SMB shares must be accessible only from the corporate network, while NFS exports must be accessible only from a specific subnet in the cloud VPC. You need to implement a single, centralized security policy that applies consistently across both environments. What should you do?

   • AUse ONTAP security policies with rules that specify protocols and source IP conditions, and apply them to the appropriate data SVMs.
   • BEnable SMB signing and NFSv4.1 Kerberos to secure the protocols, and assume that protocol security is sufficient for access control.
   • CConfigure network ACLs in AWS and firewall rules on-premises to control access, and rely on those for both SMB and NFS.
   • DCreate separate export policies for SMB and NFS on each ONTAP system, and manage them independently.
   Reveal Solution Discussion Select an answer first