NS0-077 NetApp StorageGRID Administrator Exam Questions and Answers

Under the legacy strong-global consistency behavior represented by these answer choices, writes use a quorum of metadata replicas at every site, while reads require a quorum of metadata replicas at the local site. Consequently, B and D are the intended answers. This architecture provides read-after-write consistency across all sites while allowing a client to perform reads using the metadata replicas available locally rather than waiting for responses from every remote site. NetApp defines strong-global as guaranteeing read-after-write consistency for client requests across all sites.

There is an important StorageGRID 12.0 qualification. New StorageGRID 12.0 installations use Quorum strong-global semantics by default. In a three-site grid containing three metadata replicas per site, the write requirement becomes a grid-wide quorum of five of the nine metadata replicas, with no more than three replicas contributed by one site. This improves site-failure tolerance. Systems upgraded from StorageGRID 11.9 or earlier retain the legacy strong-global behavior unless explicitly changed.

Therefore, B and D are the certification-key answer for the semantics assumed by this question, but B should not be generalized to a newly installed StorageGRID 12.0 grid using Quorum strong-global.

Reference topics: S3 Consistency → Strong-global → Metadata Replicas → Local Read Quorum → Legacy vs Quorum Strong-global

For regulatory retention in StorageGRID, the required mechanisms are S3 Object Lock and a compliant default ILM rule. StorageGRID implements write-once-read-many protection through S3 Object Lock. NetApp states that the global S3 Object Lock setting must be enabled before tenants can create buckets with S3 Object Lock enabled. Once enabled globally, the setting cannot be disabled.

There is also a mandatory ILM dependency. NetApp explicitly requires the default rule in every active ILM policy to be compliant before global S3 Object Lock can be enabled. A compliant default rule must maintain at least two replicated copies or one erasure-coded copy on Storage Nodes, must begin protection at day 0 using Ingest time, cannot place the protected copies in a Cloud Storage Pool, and must include a placement extending forever.

Option A is incorrect because SnapLock is an ONTAP WORM technology and is not the StorageGRID compliance mechanism. Option B is also incorrect: StorageGRID regulatory retention does not require an administrator-configured “Compliance Clock.” Object retention is enforced through S3 Object Lock retain-until dates, retention modes, legal holds, and compliant ILM placement.

Reference topics: S3 Object Lock → Regulatory Compliance → Compliant ILM Rules → Default ILM Rule → Retention and Legal Hold

In StorageGRID, group policies are attached to a specific tenant group and define which S3 resources members of that group are permitted or denied access to. NetApp explicitly states that a group policy applies to only one group and can apply to multiple buckets. This makes B the correct answer.

Group policies are configured through Tenant Manager or the Tenant Management API and use AWS-compatible JSON policy syntax. A single group policy can therefore contain multiple Resource entries referencing different buckets and objects. In contrast, a bucket policy is attached to one specific bucket and can grant or deny access to multiple users or groups.

Options A and C are incorrect because StorageGRID does not assign precedence among group, bucket, and session policies. NetApp states that there is no difference in priority among these policy types. Authorization is determined by evaluating the applicable policy statements, with an explicit Deny overriding an Allow; it is not based on one policy class automatically taking precedence over another.

Option D reverses the relationship: it describes the scope of a bucket policy rather than a group policy.

Reference topics: Tenant Manager → S3 Access Management → Group Policies → Bucket Policies → Session Policies → AWS Policy Language

The required consistency level is strong-global, specifically using the Quorum strong-global semantics available in StorageGRID 12.0. NetApp defines strong-global as guaranteeing read-after-write consistency for client requests across all sites. With Quorum semantics enabled, a grid containing three or more sites can tolerate a site failure while continuing client operations, provided the required metadata replica quorum remains available.

This directly matches the scenario. NetApp's multisite resiliency guidance states that, for a three-or-more-site deployment using Quorum strong-global, a single site plus a single node failure can occur without interruption to operations or metadata consistency, assuming sufficient object-data protection remains under the ILM configuration.

Option A, all, is unsuitable because every metadata node must acknowledge the update; if a node or site is unavailable, the request fails. Option C, strong-site, only guarantees immediate consistency within one site and does not provide the required global consistency. Option D provides read-after-write consistency for new objects but only eventual consistency for updates, so it does not satisfy the requirement that data remain consistently available for all read and write activity.

Reference topics: StorageGRID 12.0 → S3 Consistency → Strong-global → Quorum Semantics → Multisite Failure Tolerance → Metadata Replication

StorageGRID Platform Services traffic, including Apache Kafka event notifications, originates from Storage Nodes that run the Administrative Domain Controller (ADC) service. NetApp explicitly requires these ADC Storage Nodes to have network connectivity to external Platform Services endpoints. For Kafka, StorageGRID normally establishes outbound TCP connectivity from ADC Storage Nodes to the Kafka cluster, using port 9092 by default unless another port is configured.

In this topology, the Storage Nodes do not have Client Network interfaces, so they cannot use a Client Network default route to reach the Kafka endpoint. NetApp's supported alternative is to configure the Storage Nodes with Admin Networks containing appropriate Admin External Subnet List (AESL) entries that provide routes to the external endpoint network. Without the required AESL route on the ADC nodes, StorageGRID cannot validate connectivity to the Kafka endpoint.

Option B incorrectly identifies LDR as the service responsible for sending Platform Services messages. Option D is irrelevant because Gateway Nodes do not originate these Kafka Platform Services notifications. Although Platform Services must be enabled for the tenant, the networking details in the scenario specifically identify missing ADC-node endpoint routing as the intended failure.

Reference topics: Platform Services → Kafka Event Notifications → ADC Service → Admin Network → AESL → External Endpoint Connectivity

StorageGRID HA groups use an explicit interface priority order. The first interface in that order is the Primary interface and normally hosts all virtual IP addresses assigned to the HA group. If the Primary interface becomes unavailable, StorageGRID automatically moves the VIP addresses to the highest-priority backup interface that remains operational.

Importantly, this behavior includes automatic failback. NetApp states that when the failure is resolved and a higher-priority interface becomes available again, the VIP addresses are automatically moved to the highest-priority available interface. Therefore, once the original Primary interface is restored and considered healthy, StorageGRID automatically transfers the VIP back to it. No administrator intervention or Load Balancer service restart is required.

Options A and C are incorrect because restarting the Load Balancer service is not part of the standard HA failback workflow. Option B is also incorrect because StorageGRID does not permanently leave the VIP on a lower-priority backup interface after the preferred interface has recovered. The configured priority order continues to determine which interface should host the HA group's VIPs.

Reference topics: Grid Manager → High Availability Groups → Interface Priority → Primary/Backup Interfaces → VIP Failover and Automatic Failback

The two valid additional workloads are file/data tiering and backup solutions. StorageGRID is an S3-compatible object-storage platform, and NetApp explicitly positions it for workloads such as data tiering, backup and disaster recovery, archive, analytics, and application object storage. NetApp FabricPool can automatically tier inactive data from ONTAP performance tiers to StorageGRID, which directly supports the file/data-tiering use case.

StorageGRID is also a well-established target for enterprise backup applications. NetApp documents integrations in which backup products use StorageGRID either as a primary object-storage backup destination or as a secondary/long-term retention tier. Its scalability, S3 interface, ILM capabilities, and high-throughput architecture make unused capacity and performance resources suitable for additional backup workloads.

Options A and D are not appropriate as stated. Production databases generally require transactional block or file storage characteristics, while virtualization datastores normally depend on block or NAS protocols such as SAN, NFS, or VMFS. StorageGRID instead exposes object storage through the S3 API and is not intended to act as a conventional database volume or hypervisor datastore.

Therefore, the correct choices are B and C.

Reference topics: StorageGRID Use Cases → FabricPool/Data Tiering → Backup and Recovery → S3 Object Storage → NetApp Solutions Integration

Adding another SG1100 services appliance increases aggregate client throughput because each SG1100 can operate as a Gateway Node running the StorageGRID Load Balancer service. With DNS Round Robin, client connections are distributed across the available services appliances, allowing the aggregate load-balancing capacity to scale horizontally. NetApp explicitly identifies increased aggregate throughput and no idle hosts as advantages of the DNS Round Robin load-balancing model.

The SG1100 is specifically designed to provide high-performance Gateway Node and Admin Node services and supports high-speed network connectivity up to 100 GbE. Adding another equivalent SG1100 therefore provides additional processing and network capacity while preserving consistent performance characteristics across the load-balancer pool. NetApp cautions against mixing services appliances with substantially different performance levels when balancing client traffic.

Option B is incorrect because the SGF6112 is a Storage Node appliance, while StorageGRID load-balancer caching is available only on Gateway Nodes. Option C does not provide the same intended horizontal client-throughput expansion. Option D would substitute an SG110, a lower-performance services appliance, and could create inconsistent load-balancing performance.

Therefore, A is the correct answer.

Reference topics: StorageGRID Load Balancing → DNS Round Robin → SG1100 Services Appliances → Gateway Nodes → Aggregate Client Throughput

The correct configuration is to route StorageGRID AutoSupport traffic through an Admin proxy server. NetApp states that when AutoSupport packages are transmitted using HTTPS, the primary Admin Node requires outbound access to NetApp Technical Support either directly or through a proxy server. This is specifically intended for secure environments where StorageGRID nodes cannot establish unrestricted direct internet connections.

The administrator configures this under Configuration > Security > Proxy settings > Admin, enables the Admin proxy, and specifies the proxy server hostname or IP address and port. Authentication credentials can also be supplied when required. Once configured, AutoSupport traffic from Admin Nodes to NetApp Technical Support is routed through this controlled proxy path.

This preserves normal AutoSupport functionality, including periodic and event-triggered AutoSupport packages, which support proactive monitoring and automatic support-case workflows. Manually uploading bundles, as in A, would not provide the desired automated behavior. Option B does not solve the connectivity restriction. Option C is also incorrect because AutoSupport On Demand is intended primarily for active troubleshooting and itself requires HTTPS connectivity; it does not replace normal automated AutoSupport delivery.

Therefore, D provides the required secure outbound connectivity while retaining automated NetApp support capabilities.

Reference topics: Grid Manager → AutoSupport → Admin Proxy → HTTPS AutoSupport → Event-Triggered AutoSupport → NetApp Technical Support Connectivity

A Global Server Load Balancer (GSLB) is the appropriate solution when StorageGRID client traffic must be intelligently directed among multiple geographically distributed sites. NetApp states that global load balancing integrates with DNS to provide intelligent routing across StorageGRID sites and can direct clients to the closest destination site, while also detecting site outages and redirecting requests to another available site. This global routing functionality is provided through a supported third-party load-balancing or DNS traffic-management solution.

A typical architecture combines GSLB at the global layer with site-local load balancers or StorageGRID Gateway Node HA groups. When an S3 client resolves the StorageGRID endpoint FQDN, the GSLB selects the appropriate site's virtual IP based on factors such as availability and network latency, thereby providing proximity-based client access.

Option B provides effective local site load balancing, but by itself does not choose the geographically closest site. Option A provides HA for interfaces within an HA group and is not a geographic traffic-management mechanism. Option C provides link-level redundancy and bandwidth aggregation rather than application-level site selection.

Therefore, D is the correct answer.

Reference topics: StorageGRID Load Balancing → Third-Party Load Balancers → Global Server Load Balancing (GSLB) → DNS-Based Site Selection → Geo-Distributed Client Access

When an existing StorageGRID deployment is expanded with nodes whose Grid Network IP addresses are on a subnet that has not previously been used, that subnet must be added to the Grid Network subnet list before the expansion is started. StorageGRID maintains this list so that every grid node can correctly route internal Grid Network traffic to the other participating subnets. NetApp StorageGRID 12.0 documentation explicitly states that if any new node uses a new Grid Network subnet, the administrator must add that subnet first; otherwise, the expansion must be cancelled, the subnet added, and the expansion restarted.

The configuration is performed in Grid Manager → Maintenance → Network → Grid Network, where the administrator selects Add another subnet and enters the network in CIDR notation. StorageGRID then distributes the routing configuration throughout the grid.

Option A is incorrect because routes do not need to be configured manually on every node. Option B is incorrect because a StorageGRID Gateway Node provides client load-balancing functions and is not an IP router between Grid Network subnets. Option D is also incorrect; StorageGRID explicitly supports multiple Grid Network subnets, provided they are routable through the configured Grid Network gateway.

Reference topics: StorageGRID Expansion → Grid Network → Grid Network Subnet List → Adding Nodes on New Subnets → Grid Network Routing

StorageGRID provides S3 bucket event notifications as a platform service that can inform external applications when specified object-level events occur. NetApp documentation confirms that event-notification destinations can be an Amazon SNS topic, Kafka topic, or webhook endpoint. Therefore, both the webhook endpoint in option B and the Apache Kafka endpoint in option C can notify the application when an s3:ObjectCreated event occurs.

A webhook endpoint receives notification messages through HTTP POST requests and is appropriate when the application exposes an HTTP/HTTPS listener. A Kafka endpoint publishes the event to a configured Kafka topic, allowing an application or processing service to consume the event and immediately initiate object conversion. StorageGRID explicitly identifies sns, kafka, and webhook as supported notification endpoint types.

Option A is incorrect because a StorageGRID load balancer endpoint provides S3 client connectivity rather than bucket-event notification. Option D is also incorrect because CloudMirror replication copies objects to another S3 bucket; it is a replication service, not an application-notification mechanism.

Reference topics: Tenant Manager → Platform Services → Event Notifications → Kafka/Webhook Endpoints; S3 Bucket Notification Configuration

The backup workload requires time-based immutability, so the tenant must be permitted to use S3 Object Lock. StorageGRID S3 Object Lock protects individual object versions from deletion or overwrite until their configured retain-until date. When an Object Lock-enabled bucket is created, StorageGRID automatically enables bucket versioning. A backup application can then assign its seven-year retention period to each object as it is written.

For the new tenant, the grid administrator should also configure the maximum retention period as seven years. StorageGRID allows administrators to define a tenant-level maximum retention period, and any bucket default retention or object-level retain-until date must remain within that limit. The current StorageGRID tenant-creation workflow specifically provides S3 Object Lock advanced permissions for configuring this maximum retention period.

After an object's retain-until date expires, S3 Object Lock no longer prevents its deletion, allowing the backup software to perform normal expiration or cleanup operations. Platform Services are unrelated; they provide functions such as CloudMirror and event notifications. A 7-TB quota controls capacity, not retention duration or immutability.

Reference topics: Tenant Accounts → S3 Object Lock → Maximum Retention Period → Object-Level Retention → Immutable Backup Data

The ILM placement unachievable alert means that StorageGRID is unable to satisfy one or more placement instructions defined by an active ILM rule for certain objects. NetApp defines this alert as indicating that an ILM placement instruction cannot be achieved for certain objects, commonly because a required Storage Node or storage location is temporarily unavailable or because the ILM rule specifies a placement that the current topology cannot satisfy.

Therefore, D is the most accurate answer. The alert does not inherently mean that every S3 PUT operation failed. Whether a client PUT fails depends on the ILM rule's ingest behavior. With Strict ingest, StorageGRID must create all placements specified by the ILM rule immediately, so a placement failure can cause the client PUT to fail. With Balanced ingest, StorageGRID can temporarily use alternate protection and complete the required ILM placement later.

This distinction makes option C too absolute. Options A and B are unrelated to the meaning of the alert. NetApp also notes that ILM placement unachievable can occur while Storage Nodes are stopped during an upgrade and can persist for up to one day afterward, which is directly relevant to this post-update scenario.

Reference topics: Grid Manager → Alerts → ILM Placement Unachievable → ILM Placement Instructions → Balanced and Strict Ingest Behavior → Upgrade/Hotfix Monitoring

For a capacity-focused FabricPool repository containing predominantly cold object data, the most efficient expansion method is to add a data-only Storage Node. StorageGRID 12.0 supports combined, metadata-only, and data-only Storage Nodes. A data-only node is dedicated to object-data storage and does not participate in Cassandra metadata storage, making it particularly appropriate when the primary objective is to maximize usable object capacity rather than increase metadata capacity. NetApp specifically describes data-only, high-capacity Storage Nodes as appropriate when dedicated capacity is required.

After the node is added, erasure-coded data can be rebalanced so that existing EC fragments are redistributed across the original and newly added Storage Nodes. NetApp states that EC rebalancing redistributes erasure-coded fragments among Storage Nodes at the site, allowing newly added capacity to be utilized by an existing EC protection scheme.

Option D adds usable capacity, but a combined node also provides metadata/Cassandra functionality that is unnecessary when the goal is specifically to maximize object-data capacity for a cold FabricPool workload. Options B and C are not supported StorageGRID capacity-expansion strategies; appliance RAID/DDP configuration and SANtricity LUN sizing must not be arbitrarily changed to enlarge StorageGRID object storage.

Reference topics: StorageGRID Expansion → Data-only Storage Nodes → Object Capacity → Erasure Coding → EC Rebalancing → FabricPool Capacity Planning