NS0-304 cheat sheet

A cluster consists of 2–24 nodes; each node runs a single ONTAP instance, and HA pairs provide local failover via a partner node.

Cluster LIFs handle intra-cluster traffic (replication, SnapMirror, cluster peering); they must be on the same subnet and are not used for client data access.

Cluster management LIFs and node management LIFs are separate; the cluster management LIF floats across nodes, node management LIFs are fixed.

A Vserver (SVM) is a logical data server with its own namespace, LIFs, and security style; one cluster can host many SVMs.

ONTAP 9 uses a single image across all nodes; upgrades are non-disruptive via rolling upgrade when HA pairs are configured.

Cluster peering requires network connectivity between cluster LIFs and a peering relationship authenticated with a passphrase or certificate.

The CLI command cluster show displays node health, epsilon status, and cluster eligibility; cluster ring show shows the management ring.

ONTAP Select and Cloud Volumes ONTAP are software-defined variants; they use the same CLI/GUI but have platform-specific limits (e.g., aggregate sizing).

An aggregate is a pool of physical disks (or RAID groups) from which volumes are carved; one aggregate belongs to one HA pair.

RAID-DP uses two parity disks per RAID group; RAID-TEC uses three, tolerating three simultaneous disk failures.

Spare disks are required for reconstruction; ONTAP maintains a minimum spare count based on aggregate size and disk type.

Aggregate-level features include Snapshot copies, deduplication, compression, and Flash Pool (SSD cache tier).

ADP (Advanced Drive Partitioning) root-data partitioning creates a root partition and data partition on each disk for ONTAP 9 system disks.

Aggregate relocation (ARL) moves an aggregate between HA pairs non-disruptively; it requires free space on the destination and compatible ONTAP versions.

Disk ownership is assigned to a node or HA pair; storage disk show -ownership verifies assignment and storage disk assign changes it.

FabricPool tiers cold data from an aggregate to a capacity tier (cloud object store); the performance tier must be all-flash or SSD.

A flexible volume is contained in an aggregate and has its own Snapshot policy, quota policy, and junction path.

A junction path mounts a volume into the SVM namespace; volume mount sets it and volume show -junction-path verifies.

Thin provisioning allocates space on demand; volume show -space-guarantee displays none (thin) or volume (thick).

A LUN is a block device inside a volume; LUNs require an igroup (initiator group) mapping for SAN access.

ONTAP supports LUN thin provisioning and space reclamation (UNMAP/SCSI WRITE SAME) to return freed blocks.

Volume move (volume move start) relocates a volume between aggregates non-disruptively; it requires free space and a compatible ONTAP version.

QoS policy groups limit throughput (IOPS and MB/s) per volume or LUN; a policy group is assigned with volume modify -qos-policy-group.

A volume's language and security style (NTFS, UNIX, mixed) are set at creation; security style affects permission checking for NFS and SMB.

Data LIFs are SVM-scoped and host NFS, SMB, and iSCSI traffic; they can be moved between ports and nodes with network interface migrate.

NFSv3 uses separate mountd and NFS ports; NFSv4 uses a single port 2049 and supports Kerberos (krb5, krb5i, krb5p).

SMB shares are created with vserver cifs share create; share permissions and NTFS permissions combine (most restrictive wins).

CIFS requires a CIFS server (NetBIOS name) and an SVM with the CIFS service enabled; DNS and time sync are prerequisites.

iSCSI uses TCP port 3260; FC uses FC ports and zoning; both require an igroup with the host initiator WWPN or IQN.

LIF failover policies determine which ports a LIF can move to (e.g., system-defined uses the HA partner's ports).

A broadcast domain groups ports and VLANs for LIF placement; network port broadcast-domain show lists membership.

NFS export policies are evaluated per client IP; vserver export-policy rule show displays the rules and their order.

Snapshot copies are point-in-time, space-efficient images of a volume; they consume space only for changed blocks.

A Snapshot policy defines schedule and retention count; volume snapshot policy show lists policies and snapshot policy create defines one.

SnapMirror replicates Snapshot copies to a destination volume; relationships can be async (scheduled) or sync (zero RPO with SyncMirror).

SnapVault is a SnapMirror policy type for backup retention; it creates a vault relationship with a longer retention than the source.

SnapMirror relationships require cluster peering and SVM peering; snapmirror show displays lag time and health.

A SnapMirror break (snapmirror break) makes the destination writable; resync (snapmirror resync) re-establishes the relationship.

SnapLock compliance/wORM prevents deletion of Snapshot copies and files until retention expires; it is configured per volume.

NDMP and SnapCenter provide backup orchestration; SnapCenter uses SnapMirror and Snapshot technologies for application-consistent backups.

statistics show-periodic samples counters over time; statistics show displays cumulative counters since boot.

ONTAP performance counters include read_ops, write_ops, latency, and disk_busy; latency is measured in microseconds or milliseconds depending on context.

The ONTAP performance archive (perf archive) collects data for support analysis; perf stat provides real-time cluster performance.

QoS policy groups can throttle noisy neighbors; adaptive QoS scales limits with used capacity.

Active IQ and Unified Manager provide health monitoring and alerting; ONTAP event logs are viewed with event log show.

Common NFS latency causes include network drops, high disk utilization, and insufficient QoS; check network interface show -vserver for errors.

volume show -fields performance-tier-inactive-user-data identifies FabricPool tiering candidates; storage aggregate show -fields hybrid-cache-size shows Flash Pool cache.

AutoSupport (ASUP) sends weekly and event-triggered telemetry; system node autosupport show verifies configuration.

Role-Based Access Control (RBAC) assigns roles to users; predefined roles include admin, operator, and readonly.

A security login (security login create) binds a user, authentication method (password, publickey, cert), and role.

ONTAP supports NFS Kerberos (krb5, krb5i, krb5p) and SMB signing/encryption; encryption protects data in transit.

NetApp Volume Encryption (NVE) encrypts volumes with a key manager (Onboard Key Manager or external KMIP).

SnapLock compliance mode cannot be disabled or shortened; enterprise mode allows privileged deletion with audit.

Audit logging (vserver audit) records file access events; logs can be sent to a syslog server or a designated volume.

Multi-factor authentication (MFA) can be enforced via security login with TOTP or certificate-based methods.

The security command family manages users, roles, certificates, and SSL; security certificate show lists installed certificates.

The ONTAP REST API is accessed over HTTPS; authentication uses basic auth, OAuth 2.0, or certificate-based methods.

The ONTAP PowerShell Toolkit and Python SDK wrap REST or ZAPI calls for automation; the CLI is scriptable via ssh and expect.

Ansible modules for ONTAP (netapp.ontap collection) manage volumes, LUNs, SVMs, and SnapMirror relationships idempotently.

ZAPI (legacy XML API) is still supported but REST is preferred for new automation; REST endpoints follow /api/storage/volumes patterns.

Cloud Volumes ONTAP (CVO) runs in AWS, Azure, and GCP; it uses cloud disks and supports FabricPool to cloud object storage.

Cloud Manager and BlueXP orchestrate ONTAP deployments and data services across on-premises and cloud environments.

SnapMirror Cloud extends replication to object storage (e.g., S3) for backup and archival use cases.

ONTAP automation should use service accounts with least-privilege RBAC roles and store credentials in a secrets manager.