NS0-701: Security, Authentication, and Access Control

What this domain tests

You must be able to control who logs in, with what method, and what they may run, plus how file-level access is granted for NFS and SMB.

Core rules

• Login is defined by a security login entry: user or group name, application (console, ssh, ontapi, http), authentication method (password, domain, cert, nsswitch), and role.
• Role-based access control uses command directory trees; security login role create grants access levels like none, readonly, or all at a command or subcommand path.
• ONTAP can authenticate against Active Directory, LDAP, NIS, or local accounts, and can use certificate-based authentication with imported CA certificates.
• SMB uses share permissions plus NTFS file permissions; NFS uses export policies with rules for clients, access type, and root squash. Security styles are unix, ntfs, and mixed, and mixed requires name mapping.
• Management traffic should be protected by TLS for the web services and by SSH keys or strong password policy for the CLI.

Worked example

An AD group needs read-only REST API access. Create the role first: security login role create -role api_ro -cmddirname "DEFAULT" -access readonly, then bind the group: security login create -user-or-group-name DOMAIN\\netops -application http -authentication-method domain -role api_ro. The order matters - creating the login before the role leaves the binding pointing at a nonexistent role.

Traps

Assuming an SMB share permission overrides NTFS permissions - the most restrictive combination applies. Forgetting that export policy rules are checked in order. Giving a role all access at the root of the command tree when a narrower path would do.