Exam NS0-162 All Questions

View all questions & answers for the NS0-162 exam

Exam NS0-162 topic 1 question 43 discussion

Actual exam question from Netapp's NS0-162

Question #: 43
Topic #: 1

You need to configure data-at-rest encryption for your NetApp ONTAP 9.8 cluster. Your company does not have Key Management Interoperability Protocol (KMIP) services available but must require a passphrase to be entered when a node is rebooted.
In this scenario, which two actions should be performed to satisfy these requirements? (Choose two.)

A. Enable onboard key management
B. Enable common criteria mode
C. Configure an external key management server
D. Enable cluster-wide FIPS-compliant mode

Show Suggested Answer

Suggested Answer: AB 🗳️

by khk141 at Sept. 11, 2021, 10:20 a.m.

Comments

Submit Cancel

khk141

Highly Voted 1 year, 10 months ago

I think A,B...

upvoted 6 times

SirALb

1 year, 10 months ago

I agree, Enabling onboard key management by default you are not required to enter a passphrase when the node is rebooted. To be asked the password , you need to enable the common criteria mode also. Source: Page 13 in the reference.

upvoted 2 times

...

Joocey

Highly Voted 1 year, 6 months ago

It appears the answer is AB. ONTAP 9.6 and later: ************ This article describes the procedure to configure the Onboard Key Manager (OKM) for password-protected boot. ONTAP versions 9.4 and later have the capability to require the Onboard Key Manager (OKM) passphrase during the system boot process. 1. Run the key manager setup wizard with the following command: ::> security key-manager onboard enable -cc-mode-enabled yes *********** In the above command "-CC-Mode_enabled" CC is for common criteria.

upvoted 5 times

...

AceGunner

Most Recent 3 months, 2 weeks ago

Selected Answer: AB

https://docs.netapp.com/us-en/ontap/encryption-at-rest/enable-onboard-key-management-96-later-nve-task.html "Set cc-mode-enabled=yes to require that users enter the key manager passphrase after a reboot. For NVE, if you set cc-mode-enabled=yes, volumes you create with the volume create and volume move start commands are automatically encrypted. The - cc-mode-enabled option is not supported in MetroCluster configurations. The security key-manager onboard enable command replaces the security key-manager setup command."

upvoted 1 times

...

Newboy

4 months, 1 week ago

A&D. A. Enable onboard key management and D. Enable cluster-wide FIPS-compliant mode would satisfy the requirements for data-at-rest encryption with a passphrase required at node reboot.