Security Considerations for a NetApp Hybrid Cloud Environment CERTIFIED-HYBRID-CLOUD-ARCHITECT Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A company has a hybrid cloud environment with on-premises NetApp storage and a VPC in AWS. They have a web application in the VPC that needs to access an NFS volume on the ONTAP system. The security team wants to minimize the attack surface by ensuring that only the web application's security group can access the NFS volume. What should you do?

   • APlace the ONTAP system in the same VPC as the web application and use a security group to allow all traffic between them.
   • BConfigure the ONTAP export policy to allow only the IP addresses of the web application instances and restrict the AWS security group to allow outbound NFS traffic to the ONTAP system.
   • CUse AWS PrivateLink to connect the VPC to the ONTAP system and then configure the security group to allow all traffic.
   • DCreate a VPN connection between the VPC and the on-premises network and allow all traffic from the VPC CIDR to the ONTAP system.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When assessing data protection requirements for a hybrid cloud workload, which factor primarily determines the confidentiality requirement?

   • AThe cost of storage in the cloud
   • BThe number of users accessing the data
   • CThe speed of the network connection between sites
   • DThe sensitivity of the data and regulatory obligations
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company has an on-premises NetApp storage system and a cloud VPC. They need to transfer sensitive data between the two environments. The security team has two options: use a site-to-site VPN with IPsec or use a dedicated connection like AWS Direct Connect with private VIF. The company has a strict budget and wants to minimize costs while ensuring data is encrypted in transit. What should they choose?

   • AUse Direct Connect and rely on the physical security of the dedicated fiber to protect the data.
   • BUse AWS Direct Connect with private VIF, as it provides a dedicated, private connection that is inherently secure.
   • CUse a VPN but disable encryption to reduce overhead and rely on the private nature of the VPN tunnel.
   • DUse the site-to-site VPN with IPsec, as it is generally less expensive than a dedicated connection and still provides encryption in transit.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has a hybrid cloud environment with on-premises NetApp storage and a cloud VPC. They have a three-tier application (web, app, database) in the VPC. The database tier needs to access the on-premises storage for backup purposes. The security team wants to ensure that only the database tier can access the storage, and that the web and app tiers cannot. What is the most secure way to achieve this?

   • AUse a security group on the database instances that allows outbound traffic to the storage IP, and ensure the web and app tiers have no route to the storage.
   • BUse a VPN connection and allow all traffic from the VPC CIDR to the storage system.
   • CPlace the database tier in a separate subnet and use a network ACL (NACL) that only allows traffic from the database subnet to the on-premises storage IP.
   • DConfigure the on-premises storage firewall to only allow traffic from the database tier's public IP address.
   Reveal Solution Discussion Select an answer first