NS0-164 Certified Data Administrator, ONTAP Practice Questions

The network ping command is used to test reachability from a specific LIF. The syntax network ping -vserver -lif -destination allows the administrator to specify the exact source SVM and LIF for the ping test. This is crucial for verifying connectivity for a specific network path used by clients, as opposed to pinging from a node or cluster management interface.

Intercluster LIFs are specifically designed to handle traffic between different ONTAP clusters that have been peered. Their primary use case is for replication traffic, such as SnapMirror and SnapVault, allowing data to be protected across cluster boundaries. Data LIFs are for client access, and cluster management LIFs are for administration.

The 'auto' tiering policy tiers cold data blocks from the active file system to the cloud tier based on inactivity. The administrator can set the tiering minimum cooling period (e.g., 60 days) to meet the requirement. The 'snapshot-only' policy only tiers data from snapshot copies, 'all' tiers data as soon as it is written, and 'none' disables tiering.

NVMe over Fabrics (such as NVMe/FC) is a protocol designed for modern flash storage that significantly reduces latency and host CPU overhead compared to traditional SAN protocols like iSCSI and Fibre Channel. The logical storage object used with the NVMe protocol is a namespace, not a LUN. For the highest performance and lowest overhead, provisioning an NVMe namespace via NVMe/FC is the optimal choice.

By default ONTAP performs automatic giveback. When the taken-over node boots and reaches the Waiting for giveback state, the takeover partner automatically returns its aggregates (root aggregate first, then the data aggregates one at a time) once the -delay-seconds period (default 600 seconds) has elapsed. Automatic giveback can be disabled with storage failover modify -node -auto-giveback false (and -auto-giveback-after-panic false for panic-triggered takeovers) if you want to investigate before giving back manually.

Beginning with ONTAP 9.16.1, computationally intensive IPsec operations (encryption and integrity checks) can be offloaded to supported NICs, such as the X50131A/X50131B I/O modules on the AFF A90. NetApp documents a network-throughput impact of about 5% or less compared with unencrypted traffic, so this encrypts the NVMe/TCP traffic in flight with minimal latency overhead. Software-only IPsec consumes controller CPU and adds more latency. Cluster peering encryption protects only intercluster (SnapMirror) traffic between clusters, not host traffic. SMB encryption does not apply to NVMe/TCP.

Beginning with ONTAP 9.16.1, advanced capacity balancing (volume modify ... -granular-data advanced) extends the granular data functionality introduced in 9.12.1: data of very large files (larger than 10 GB), such as raw 8K video, is written across multiple FlexGroup member volumes, so large growing files no longer overload a single constituent. Adaptive QoS limits throughput, FabricPool tiers cold data, and a volume move does not redistribute data between constituents.

IPspaces give each network its own routing domain (separate routing tables, even overlapping addresses), and broadcast domains group the ports that belong to each Layer 2 network inside an IPspace. Cluster and node management LIFs remain in the Default IPspace, so data and replication LIFs are placed in their own IPspace(s) with their own broadcast domains, keeping management traffic logically separated without physical firewalls. Export policies, interface groups and static routes do not provide this isolation.

IPspaces give each network its own routing domain (separate routing tables, even overlapping addresses), and broadcast domains group the ports that belong to each Layer 2 network inside an IPspace. Cluster and node management LIFs remain in the Default IPspace, so data and replication LIFs are placed in their own IPspace(s) with their own broadcast domains, keeping management traffic logically separated without physical firewalls. Export policies, interface groups and static routes do not provide this isolation.

NetApp Volume Encryption (NVE) is software-based, per-volume encryption at rest that works on the existing non-self-encrypting drives. It can use an external KMIP key manager, which meets the mandate to use the organization's existing KMIP server. NSE would require buying self-encrypting drives. NAE with the Onboard Key Manager does not use the external KMIP server. IPsec protects data in flight, not at rest.

The vsadmin role is specifically designed for SVM-level administration. Creating a user account scoped to a particular SVM and assigning it the vsadmin role grants that user administrative privileges only within that SVM's context. They can manage resources like volumes and protocols for their SVM but cannot see or modify cluster-level settings or resources in other SVMs. This is the standard method for delegating control in a multi-tenant environment.