NetApp Certified Implementation Engineer – ONTAP v5 — Question 13

You have detected a potential ransomware attack.
Which two observations led you to this conclusion? (Choose two.)

Answer options

• A. You noticed a large change in the size of the Snapshot copy.
• B. You noticed a decrease in storage efficiencies such as deduplication and compression.
• C. You noticed an increase in deduplication savings but a decrease in compression savings.
• D. You noticed an increase in storage efficiencies such as deduplication and compression.

Correct answer: A, B

Explanation

The correct answers, A and B, indicate that a significant change in the Snapshot copy size and a decrease in storage efficiencies are common signs of a ransomware attack, as ransomware typically encrypts files and can lead to abnormal storage behavior. Options C and D do not align with typical ransomware behavior; an increase in efficiencies wouldn't usually be associated with a ransomware threat.