Security, Access Control, and Compliance
This domain tests authentication, authorization, encryption, auditing, and immutable retention features.
Access control
ONTAP role-based access control maps users and groups to roles with command or API permissions. security login manages local and directory users. Active Directory, LDAP, and NIS provide external authentication. Multi-admin verification adds approval requirements for sensitive commands. Least privilege and separate automation accounts reduce risk.
Encryption and compliance
NetApp Volume Encryption encrypts at the volume level and can be enabled per volume. NetApp Storage Encryption encrypts self-encrypting drives at the hardware level. Both depend on key management, either an external KMIP server or the Onboard Key Manager; losing keys makes data unreadable. SnapLock provides WORM retention in compliance or enterprise mode; committing a file to a compliance clock is irreversible. File access auditing and FPolicy record or control client operations.
Worked example
A volume must be encrypted without reinitializing the aggregate. NVE is the correct choice: enable volume encryption on the SVM, ensure a key manager is configured and healthy, then create or convert the volume. NSE would require self-encrypting disks and protects the whole aggregate, which is broader than the requirement.
Traps
Confusing NVE with NSE; treating SnapLock compliance retention as reversible; failing to test key manager availability; and granting broad RBAC roles to service accounts.