Pass the Netapp Hybrid Cloud Administrator NS0-077 Questions and answers with ExamsMirror

The correct answer is metadata updates. StorageGRID maintains object metadata independently from object data, using the distributed Cassandra database. NetApp specifies that StorageGRID stores three copies of the metadata for every object at each site, meaning every site maintains metadata for all objects in the grid, regardless of where the object data itself is physically stored.

This distinction is critical in the scenario. Even though the new fourth site uses an ILM policy that keeps its object data local with a 2+1 protection scheme, metadata activity is still grid-wide. NetApp explicitly states that administrators must consider network bandwidth and latency between sites because metadata updates are continually replicated between sites even when all object copies remain at the site where they were ingested. Therefore, the WAN links connecting all four sites must be sized to support continuous metadata synchronization.

Load balancer endpoints handle S3 client connectivity and do not create this universal intersite requirement. NTP requires reliable time synchronization but is not the workload driving the stated bandwidth-sizing requirement. Storage pools are logical ILM constructs and do not themselves replicate metadata.

Therefore, B. metadata updates is the required component.

Reference topics: StorageGRID Expansion → Adding a Site → Cassandra Metadata Replication → Intersite Network Bandwidth and Latency → ILM Data Placement

StorageGRID load balancer endpoints can be restricted so that only selected tenant accounts are permitted to use a specific endpoint. During endpoint configuration, the administrator uses the Tenant access setting and selects Allow selected tenants, then chooses the backup tenant account. NetApp states that with this setting, only the selected tenant accounts can use the endpoint to access their buckets. This directly satisfies the requirement to dedicate one S3 load balancer endpoint to the internal-backup tenant.

Option A is incorrect because a global binding mode determines where the endpoint is available across eligible Admin and Gateway Node interfaces; it does not restrict access by tenant identity. Option D similarly limits the endpoint to interfaces associated with particular HA groups, which controls network exposure rather than tenant authorization. Option B is not a valid per-tenant isolation mechanism because HTTPS configuration applies to the endpoint connection itself and cannot be selectively disabled for unrelated tenant accounts.

Therefore, the required control is to configure the load balancer endpoint's tenant-access settings and assign access specifically to the backup tenant.

Reference topics: Grid Manager → Load Balancer Endpoints → Tenant Access → Allow Selected Tenants → S3 Client Access Control → Endpoint Binding

Before adding an SG6160 appliance to an existing StorageGRID 12.0 grid, the StorageGRID Appliance Installer firmware must be compatible with the StorageGRID software version currently running on the grid. NetApp's StorageGRID 12.0 expansion requirements explicitly state that if the Appliance Installer firmware is not compatible, it must be upgraded before the appliance is deployed as a new grid node.

Because this SG6160 still contains an older 11.8-era Appliance Installer, the administrator should obtain the appropriate StorageGRID Appliances support/firmware package from NetApp Downloads and manually upgrade the appliance through the Appliance Installer's firmware-upgrade workflow. NetApp's documented procedure uses Advanced > Upgrade Firmware, followed by uploading the appropriate support file and completing the firmware update before installation.

Option A is incorrect because a newly added appliance should not be introduced with incompatible installer firmware merely to operate temporarily at a mixed version. Option D has the same problem: compatibility must be established before joining the node. Option B is incorrect because Active IQ is not the mechanism used to upgrade StorageGRID Appliance Installer firmware.

Therefore, C is the correct procedure.

Reference topics: StorageGRID Expansion → Appliance Nodes → StorageGRID Appliance Installer → Firmware Compatibility → Upgrade Firmware → SG6160 Deployment

StorageGRID Traffic Classification Policies provide the correct quality-of-service mechanism for controlling a workload that is consuming excessive network or request resources. A traffic classification policy can match traffic by bucket, tenant, subnet, or load balancer endpoint and can impose limits such as aggregate bandwidth, per-request bandwidth, concurrent requests, or request rate. Therefore, the appropriate remediation is to identify the backup bucket and restrict the bandwidth available to that workload.

This approach prevents the backup application from monopolizing StorageGRID resources during its backup window, leaving sufficient capacity for other clients to perform object uploads. StorageGRID 12.0 documentation specifically states that bandwidth limits control the rate at which matching requests are allowed to flow and that traffic-classification policies are designed for traffic limiting and SLA-related performance management.

Option D is incorrect because StorageGRID traffic classification does not provide a mechanism to reserve or guarantee minimum bandwidth to other buckets; it limits maximum resource consumption by matching workloads. Options A and C involve ILM ingest behavior. Strict or Balanced ingest controls how object placement satisfies ILM requirements at ingest and is not a QoS mechanism for protecting competing workloads.

Therefore, throttling the backup bucket through a traffic classification policy is the correct solution.

Reference topics: Grid Manager → Configuration → Network → Traffic Classification → Bucket Matching Rules → Bandwidth Limits → QoS and Workload Management

StorageGRID HA groups use an explicit interface priority order. The first interface in that order is the Primary interface and normally hosts all virtual IP addresses assigned to the HA group. If the Primary interface becomes unavailable, StorageGRID automatically moves the VIP addresses to the highest-priority backup interface that remains operational.

Importantly, this behavior includes automatic failback. NetApp states that when the failure is resolved and a higher-priority interface becomes available again, the VIP addresses are automatically moved to the highest-priority available interface. Therefore, once the original Primary interface is restored and considered healthy, StorageGRID automatically transfers the VIP back to it. No administrator intervention or Load Balancer service restart is required.

Options A and C are incorrect because restarting the Load Balancer service is not part of the standard HA failback workflow. Option B is also incorrect because StorageGRID does not permanently leave the VIP on a lower-priority backup interface after the preferred interface has recovered. The configured priority order continues to determine which interface should host the HA group's VIPs.

Reference topics: Grid Manager → High Availability Groups → Interface Priority → Primary/Backup Interfaces → VIP Failover and Automatic Failback

The correct combination is read-after-new-write consistency with Balanced ingest. The workload contains log objects that are written once and subsequently read, so read-after-new-write provides the required behavior: StorageGRID guarantees read-after-write consistency for new objects, while maintaining high availability. NetApp recommends this consistency setting for most workloads. Because these SIEM log objects are not expected to be updated after creation, the eventual-consistency behavior for updates is not material to this use case.

The ingest requirement is decisive. The EC7+5 placement spans three sites, but clients must remain able to ingest when one site is unavailable. With Strict ingest, StorageGRID must satisfy the ILM placement instructions synchronously before acknowledging the write. If the required EC placement cannot be created because a site is down, the request fails. In contrast, Balanced attempts the specified ILM placement immediately but, when an outage prevents that placement, StorageGRID falls back to dual-commit protection and acknowledges the object. ILM subsequently creates the required EC7+5 placement when resources become available again.

all is inappropriate because it requires every metadata node to receive metadata immediately, reducing availability during failures. Therefore, D satisfies both immediate visibility of newly written logs and continued ingest during a site outage.

Reference topics: S3 Bucket Consistency → Read-after-new-write → ILM Ingest Behavior → Balanced vs Strict → Erasure Coding → Multisite Availability

To delete a specific version of an S3 object, the user must have the appropriate S3 permission, specifically s3:DeleteObjectVersion. In StorageGRID, permissions granted to tenant users are commonly defined through group policies, which control which S3 actions members of the group are authorized to perform against specified bucket and object resources. NetApp explicitly maps s3:DeleteObjectVersion to the S3 operation that deletes a specific object version.

Therefore, the user should verify the group policy associated with their tenant account and confirm that it allows s3:DeleteObjectVersion for the required bucket or object ARN. An explicit Deny for this action would override an Allow. NetApp even provides policy examples that specifically restrict users from deleting versioned objects by denying s3:DeleteObjectVersion.

Option B is incorrect because an S3 lifecycle policy automates object expiration and version-management behavior; it does not grant interactive user permissions. Option C governs where and how StorageGRID stores and protects object data, not S3 authorization. Option D refers to administrative privileges and is not the standard mechanism controlling a tenant user's object-level S3 operations.

Therefore, A. group policy is correct.

Reference topics: Tenant Manager → Groups → S3 Group Policies → s3:DeleteObjectVersion → Versioned Object Permissions → Explicit Deny/Allow Evaluation

Stored Object Encryption is the StorageGRID encryption method that is available regardless of how the grid nodes are deployed. It is configured centrally in Grid Manager rather than depending on appliance-specific hardware capabilities. When enabled, StorageGRID encrypts newly ingested S3 object data that has not already been encrypted at the bucket or object level. StorageGRID supports AES-128 or AES-256 for this function.

The other options are deployment-specific. Node Encryption is associated with StorageGRID appliance nodes and a configured external Key Management Server (KMS); it must be enabled for an eligible appliance during installation. Drive Security depends on storage appliances equipped with Full Disk Encryption or self-encrypting drives and is managed through SANtricity System Manager. Drive Encryption likewise requires StorageGRID appliances containing supported self-encrypting drives and is configured through the StorageGRID Appliance Installer. These hardware dependencies mean none of those three methods is universally available across virtual, containerized, cloud, and appliance deployment models.

Therefore, C. Stored Object Encryption is the correct answer because it operates at the StorageGRID object-ingest layer rather than relying on a particular node or disk hardware implementation.

Reference topics: Grid Manager → Security Settings → Network and Objects → Stored Object Encryption; StorageGRID Encryption Methods

For unidirectional cross-grid replication, CGR must be enabled on the bucket in the grid that acts as the source. NetApp states that when CGR is enabled on only one grid, objects added to that source bucket are replicated automatically to the corresponding destination bucket on the other grid; objects written to the destination are not replicated back. Because the required direction is Grid-1 → Grid-2, CGR must therefore be enabled on Grid-1.

The administrator then selects the appropriate grid federation connection and sets Replicate delete markers = Yes. When an S3 client deletes an object without specifying a version ID, StorageGRID creates a delete marker. With this option enabled, that marker is replicated to Grid-2 so the object appears deleted on both grids, helping maintain matching bucket state. NetApp documents this as the default behavior.

Option A would configure bidirectional replication, which violates the unidirectional requirement. Option B reverses the required replication direction. Option D is incorrect because the relevant CGR configuration control is Replicate delete markers, not “Replicate metadata.”

Reference topics: Tenant Manager → Grid Federation → Cross-Grid Replication → Source and Destination Buckets → Versioning → Replicate Delete Markers

StorageGRID High Availability (HA) groups provide resilient S3 client connectivity by grouping network interfaces from multiple Admin Nodes and Gateway Nodes. NetApp states that HA groups containing Gateway Nodes, Admin Nodes, or a combination of both can provide highly available data connections for S3 clients.

An HA group uses one or more virtual IP (VIP) addresses. One interface is designated as the primary active interface, while the remaining interfaces act as backups according to their configured priority. S3 applications connect to the VIP rather than directly to an individual node. If the active interface or its node becomes unavailable, StorageGRID transfers the VIP to another eligible interface in the HA group, allowing client workloads to continue with minimal interruption. Both Admin Nodes and Gateway Nodes run the Load Balancer service, which distributes S3 requests to Storage Nodes.

Options A and B are incorrect because Storage Node interfaces cannot be members of StorageGRID HA groups. Option C is also invalid; Archive Nodes are not supported HA-group members and are unrelated to client load-balancer HA.

Therefore, the supported node combination for highly available S3 client connections is Admin Nodes and Gateway Nodes.

Reference topics: Grid Manager → High Availability Groups → Admin Nodes → Gateway Nodes → Virtual IP Addresses → Load Balancer Service → S3 Client Connectivity