Security Considerations for a NetApp Hybrid Cloud Environment CERTIFIED-HYBRID-CLOUD-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is concerned about potential unauthorized access to a NetApp ONTAP system that is replicated to a cloud object store. They want to detect and respond to suspicious activity, such as multiple failed login attempts or unusual data access patterns. What should they configure?

   • AConfigure the cloud object store's server-side access logging and review the logs periodically.
   • BEnable NetApp Cloud Data Sense to classify the data and identify sensitive information.
   • CSet up a NetApp SnapMirror relationship to a secondary ONTAP system and enable SnapMirror audit logs.
   • DEnable ONTAP audit logging and forward the logs to a SIEM tool that can alert on failed authentication events and abnormal access patterns.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which network security control is used to filter traffic between subnets in a cloud VPC?

   • ASecurity groups
   • BRoute tables
   • CVPN gateway
   • DNetwork Access Control Lists (NACLs)
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which protocol is commonly used to encrypt data transmitted between a web client and a cloud service?

   • ASNMP
   • BTLS
   • CICMP
   • DFTP
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which method is commonly used to encrypt data at rest in cloud object storage?

   • AServer-side encryption with customer-managed keys
   • BClient-side encryption with a shared secret
   • CTransport Layer Security (TLS) for every object
   • DNetwork segmentation to isolate storage
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has a hybrid cloud environment with on-premises NetApp storage and a cloud VPC. They recently discovered that a compromised workload in the VPC was able to access the on-premises storage via the VPN connection. The security team wants to limit the blast radius of a compromised workload. What should they implement?

   • AEnable multi-factor authentication (MFA) for all users accessing the storage system.
   • BMove the storage system to the cloud and eliminate the on-premises environment.
   • CDisable the VPN connection and use a direct internet connection for the workload to access storage.
   • DImplement network segmentation by placing the workload in a separate subnet with a security group that only allows necessary traffic to the storage system.
   Reveal Solution Discussion Select an answer first