Exam : NS0-594
Title : NetApp Support Engineer,
ONTAP Exam
https://www.passcert.com/NS0-594.html
1/7
, 1.A volume uses mixed security style. A directory in the volume previously had NTFS effective security
after an SMB administrator applied an NTFS ACL. An NFSv3 administrator then changed the mode bits
on that same directory. SMB users who had access through the NTFS ACL can no longer open files in
the directory.
What explains the change in access?
A. The export policy superseded the SMB share and file ACLs.
B. The directory now uses UNIX effective security.
C. ONTAP converted the entire volume from mixed security style to UNIX security style.
D. The SMB server stopped applying file-level authorization checks to that directory.
Answer: B
Explanation:
On a mixed-security-style volume, the effective security style is determined at the file or directory level.
When an NFSv3 client modifies permissions, the affected object uses UNIX mode bits and therefore has
UNIX effective security. The volume itself remains mixed, so option C is incorrect. Export policy
evaluation does not replace SMB share or file-level authorization, which eliminates option A. SMB clients
can access data with UNIX effective security when authentication, name mapping, and UNIX
permissions allow it; ONTAP does not stop performing file-level authorization as described in option D.
Reference: Learn about ONTAP NAS security styles
2.An NFS client mounted a volume successfully while its export policy rule used the client's IP address in
-clientmatch. After the rule was changed to use the client's hostname, new mount attempts are
denied. Restoring the IP address immediately restores access. A DNS query initiated from the data SVM
cannot resolve the client hostname.
What should the support engineer do first?
A. Restore DNS service for the data SVM and verify resolution of the client hostname.
B. Replace the rule with a netgroup and configure an NIS domain on the data SVM.
C. Move the NFS data LIF to a port on the node that owns the volume's aggregate.
D. Add a local UNIX user with a UID matching the account presented by the NFS client.
Answer: A
Explanation:
ONTAP uses the DNS configuration of the data SVM when it must resolve certain hostname-based client
matches. The IP-based rule works, the hostname-based rule fails, and name resolution from the SVM is
unsuccessful, so DNS service for the SVM is the first issue to correct. A netgroup would change the
matching design without resolving the demonstrated DNS failure. Data LIF placement relative to the
aggregate owner does not determine whether a hostname matches an export rule. UNIX user lookup
occurs after the client has matched the rule and does not explain why changing only -clientmatch
caused the failure.
Reference: Add a rule to an ONTAP NFS export policy
3.An NFS user named analytics is denied access to a directory in a mixed-security-style volume. The
client matches an export policy rule that permits read-write access, and the directory's UNIX mode bits
permit the requested operation. Storage-Level Access Guard is also applied to the volume and grants
access to CORP\analytics. A name-mapping check shows that the UNIX user analytics does not
map to a Windows identity.
2/7
Title : NetApp Support Engineer,
ONTAP Exam
https://www.passcert.com/NS0-594.html
1/7
, 1.A volume uses mixed security style. A directory in the volume previously had NTFS effective security
after an SMB administrator applied an NTFS ACL. An NFSv3 administrator then changed the mode bits
on that same directory. SMB users who had access through the NTFS ACL can no longer open files in
the directory.
What explains the change in access?
A. The export policy superseded the SMB share and file ACLs.
B. The directory now uses UNIX effective security.
C. ONTAP converted the entire volume from mixed security style to UNIX security style.
D. The SMB server stopped applying file-level authorization checks to that directory.
Answer: B
Explanation:
On a mixed-security-style volume, the effective security style is determined at the file or directory level.
When an NFSv3 client modifies permissions, the affected object uses UNIX mode bits and therefore has
UNIX effective security. The volume itself remains mixed, so option C is incorrect. Export policy
evaluation does not replace SMB share or file-level authorization, which eliminates option A. SMB clients
can access data with UNIX effective security when authentication, name mapping, and UNIX
permissions allow it; ONTAP does not stop performing file-level authorization as described in option D.
Reference: Learn about ONTAP NAS security styles
2.An NFS client mounted a volume successfully while its export policy rule used the client's IP address in
-clientmatch. After the rule was changed to use the client's hostname, new mount attempts are
denied. Restoring the IP address immediately restores access. A DNS query initiated from the data SVM
cannot resolve the client hostname.
What should the support engineer do first?
A. Restore DNS service for the data SVM and verify resolution of the client hostname.
B. Replace the rule with a netgroup and configure an NIS domain on the data SVM.
C. Move the NFS data LIF to a port on the node that owns the volume's aggregate.
D. Add a local UNIX user with a UID matching the account presented by the NFS client.
Answer: A
Explanation:
ONTAP uses the DNS configuration of the data SVM when it must resolve certain hostname-based client
matches. The IP-based rule works, the hostname-based rule fails, and name resolution from the SVM is
unsuccessful, so DNS service for the SVM is the first issue to correct. A netgroup would change the
matching design without resolving the demonstrated DNS failure. Data LIF placement relative to the
aggregate owner does not determine whether a hostname matches an export rule. UNIX user lookup
occurs after the client has matched the rule and does not explain why changing only -clientmatch
caused the failure.
Reference: Add a rule to an ONTAP NFS export policy
3.An NFS user named analytics is denied access to a directory in a mixed-security-style volume. The
client matches an export policy rule that permits read-write access, and the directory's UNIX mode bits
permit the requested operation. Storage-Level Access Guard is also applied to the volume and grants
access to CORP\analytics. A name-mapping check shows that the UNIX user analytics does not
map to a Windows identity.
2/7
