NS0-528 · Question #7
A ransomware attack has compromised all files on a CIFS share. The volume had a retention policy of five daily Snapshot copies, but unfortunately, no Snapshot copies were available. It was confirmed…
The correct answer is C. volume modify -snapdir-access false. Setting snapdir-access to false prevents users accessing the CIFS/NFS share from viewing or deleting Snapshot copies via the .snapshot directory. This secures the Snapshot restore mechanism from being exposed or tampered with in case of another attack through file shares.
Question
A ransomware attack has compromised all files on a CIFS share. The volume had a retention policy of five daily Snapshot copies, but unfortunately, no Snapshot copies were available. It was confirmed that the cybercriminal accessed only the share and did not gain access to the NetApp ONTAP cluster. What command should be executed to prevent the quick restore strategy from being compromised?
Options
- Avolume autosize -autogrow disable
- Bsecurity multi-admin-verify modify -enabled true
- Cvolume modify -snapdir-access false
- Dvolume snapshot -autodelete disabled
How the community answered
(27 responses)- A4% (1)
- B19% (5)
- C67% (18)
- D11% (3)
Explanation
Setting snapdir-access to false prevents users accessing the CIFS/NFS share from viewing or deleting Snapshot copies via the .snapshot directory. This secures the Snapshot restore mechanism from being exposed or tampered with in case of another attack through file shares.
Topics
Community Discussion
No community discussion yet for this question.