Which statement accurately describes NetApp data encryption at rest?

Which statement accurately describes NetApp data encryption at rest?

• A. Data encryption at rest is optional in ONTAP
• B. Encryption keys are always stored on external hardware modules
• C. NetApp supports encrypting data at rest with self-encrypting drives (SEDs) and ONTAP manages keys
• D. Encryption is only available for DAS, not SAN

Answer: (C)

NetApp data at rest encryption relies on hardware-assisted protection from self-encrypting drives (SEDs) with ONTAP handling the encryption keys. The drives perform the actual encryption, while ONTAP stores and uses the keys to unlock data as it’s read or written. You also have the option to use an external key management server (KMIP) if you want centralized key management, but it isn’t required. This capability covers data stored on both DAS and SAN. The statement that keys must always reside in external hardware modules isn’t accurate, since key management can be handled by ONTAP itself or via an external KMS, and encryption isn’t limited to DAS.

NetApp data at rest encryption relies on hardware-assisted protection from self-encrypting drives (SEDs) with ONTAP handling the encryption keys. The drives perform the actual encryption, while ONTAP stores and uses the keys to unlock data as it’s read or written. You also have the option to use an external key management server (KMIP) if you want centralized key management, but it isn’t required. This capability covers data stored on both DAS and SAN. The statement that keys must always reside in external hardware modules isn’t accurate, since key management can be handled by ONTAP itself or via an external KMS, and encryption isn’t limited to DAS.