Netapp NS0-077 - NetApp StorageGRID Administrator Exam

To delete a specific version of an S3 object, the user must have the appropriate S3 permission, specifically s3:DeleteObjectVersion. In StorageGRID, permissions granted to tenant users are commonly defined through group policies, which control which S3 actions members of the group are authorized to perform against specified bucket and object resources. NetApp explicitly maps s3:DeleteObjectVersion to the S3 operation that deletes a specific object version.

Therefore, the user should verify the group policy associated with their tenant account and confirm that it allows s3:DeleteObjectVersion for the required bucket or object ARN. An explicit Deny for this action would override an Allow. NetApp even provides policy examples that specifically restrict users from deleting versioned objects by denying s3:DeleteObjectVersion.

Option B is incorrect because an S3 lifecycle policy automates object expiration and version-management behavior; it does not grant interactive user permissions. Option C governs where and how StorageGRID stores and protects object data, not S3 authorization. Option D refers to administrative privileges and is not the standard mechanism controlling a tenant user's object-level S3 operations.

Therefore, A. group policy is correct.

Reference topics: Tenant Manager → Groups → S3 Group Policies → s3:DeleteObjectVersion → Versioned Object Permissions → Explicit Deny/Allow Evaluation

When an object stored in a Cloud Storage Pool has transitioned to Amazon S3 Glacier Deep Archive, it is in a non-retrievable state. StorageGRID therefore cannot satisfy a normal GetObject request until a retrievable copy has first been restored. NetApp specifies that the client application must issue an S3 RestoreObject request to restore the object temporarily within the Cloud Storage Pool. After the restoration completes, the client can issue GetObject through StorageGRID to retrieve the data.

For a restored object, RestoreObject specifies how long the retrievable copy remains available. StorageGRID supports restoration from Glacier Deep Archive, but Deep Archive does not support the Expedited retrieval tier; only Standard or Bulk retrieval can be used. Thus, “immediate” access means initiating the restore process immediately, not instantaneous retrieval from the Deep Archive tier.

Option A is incorrect because GetObject does not automatically restore a non-retrievable Glacier object. Option B is incorrect because restoration is performed through StorageGRID's S3 API; direct Amazon-console intervention is unnecessary. Option C is incorrect because StorageGRID explicitly supports RestoreObject for Cloud Storage Pool objects transitioned to Glacier Deep Archive.

Reference topics: ILM → Cloud Storage Pools → S3 Glacier Deep Archive → RestoreObject → GetObject → Retrieval Tiers

A Global Server Load Balancer (GSLB) is the appropriate solution when StorageGRID client traffic must be intelligently directed among multiple geographically distributed sites. NetApp states that global load balancing integrates with DNS to provide intelligent routing across StorageGRID sites and can direct clients to the closest destination site, while also detecting site outages and redirecting requests to another available site. This global routing functionality is provided through a supported third-party load-balancing or DNS traffic-management solution.

A typical architecture combines GSLB at the global layer with site-local load balancers or StorageGRID Gateway Node HA groups. When an S3 client resolves the StorageGRID endpoint FQDN, the GSLB selects the appropriate site's virtual IP based on factors such as availability and network latency, thereby providing proximity-based client access.

Option B provides effective local site load balancing, but by itself does not choose the geographically closest site. Option A provides HA for interfaces within an HA group and is not a geographic traffic-management mechanism. Option C provides link-level redundancy and bandwidth aggregation rather than application-level site selection.

Therefore, D is the correct answer.

Reference topics: StorageGRID Load Balancing → Third-Party Load Balancers → Global Server Load Balancing (GSLB) → DNS-Based Site Selection → Geo-Distributed Client Access

For a StorageGRID node running as a VMware virtual machine, NetApp requires the node to be gracefully shut down before hypervisor migration or maintenance. The supported migration approach is therefore a cold migration, in which the StorageGRID node is stopped before it is moved to another ESXi host. NetApp documentation explicitly states that cold migration is supported.

Option A is specifically unsupported. NetApp warns that VMware live vMotion can cause the virtual machine clock to jump. StorageGRID depends heavily on synchronized time for distributed database operations, object metadata, configuration updates, and inter-node coordination. A time discontinuity can therefore lead to data or configuration integrity problems, which is why live vMotion must not be used for StorageGRID grid nodes.

Option B is incorrect because StorageGRID appliance maintenance mode is intended for specific appliance maintenance procedures; it is not the prescribed migration workflow for a VMware-hosted software Storage Node. Option C is also not the required host-maintenance procedure and unnecessarily introduces datastore-level movement considerations.

Thus, the correct sequence is to gracefully shut down the StorageGRID VM and perform a cold migration to another ESXi host, preserving grid integrity while host maintenance is performed.

Reference topics: VMware Deployment → Hypervisor Maintenance → StorageGRID Node Shutdown → VMware Migration Restrictions → Cold Migration

The SGF6112 is specifically suited to this requirement because StorageGRID supports configuring this appliance to operate as a Gateway Node with caching. NetApp documents the SGF6112 as a compact 1U all-flash appliance containing 12 NVMe SSDs, and explicitly lists its ability to operate as a Gateway Node with caching. This enables frequently accessed S3 objects to be cached close to the application without deploying a complete StorageGRID site containing multiple Storage Nodes.

This architecture is particularly appropriate for a small office with restricted rack space and power. The caching Gateway serves repeatedly accessed objects locally, reducing retrieval latency and WAN traffic while the authoritative object data continues to reside on the existing StorageGRID Storage Nodes.

Options A and C create entirely new StorageGRID sites. A production site requires at least three Storage Nodes, which significantly increases equipment, power, cooling, and rack requirements. C additionally deploys multiple high-performance appliances when only local read acceleration is required.

Option B is invalid because the SG5812 is a Storage Node appliance and does not provide the SGF6112's supported caching-Gateway operating mode.

Therefore, D provides the required local-read performance with the smallest practical physical footprint.

Reference topics: StorageGRID 12.0 → Load Balancer Caching → SGF6112 → Gateway Node with Caching → Edge/Remote-Site Read Acceleration

Stored Object Encryption is the StorageGRID encryption method that is available regardless of how the grid nodes are deployed. It is configured centrally in Grid Manager rather than depending on appliance-specific hardware capabilities. When enabled, StorageGRID encrypts newly ingested S3 object data that has not already been encrypted at the bucket or object level. StorageGRID supports AES-128 or AES-256 for this function.

The other options are deployment-specific. Node Encryption is associated with StorageGRID appliance nodes and a configured external Key Management Server (KMS); it must be enabled for an eligible appliance during installation. Drive Security depends on storage appliances equipped with Full Disk Encryption or self-encrypting drives and is managed through SANtricity System Manager. Drive Encryption likewise requires StorageGRID appliances containing supported self-encrypting drives and is configured through the StorageGRID Appliance Installer. These hardware dependencies mean none of those three methods is universally available across virtual, containerized, cloud, and appliance deployment models.

Therefore, C. Stored Object Encryption is the correct answer because it operates at the StorageGRID object-ingest layer rather than relying on a particular node or disk hardware implementation.

Reference topics: Grid Manager → Security Settings → Network and Objects → Stored Object Encryption; StorageGRID Encryption Methods

The correct solution is the CloudMirror service. CloudMirror is a StorageGRID Platform Service that automatically replicates selected objects from a StorageGRID S3 bucket to an external S3-compatible destination, including Amazon S3. NetApp specifically identifies the use case of mirroring newly ingested customer data into Amazon S3 so that AWS services can perform analytics or other processing on that data.

CloudMirror operates independently of the grid's active ILM policies. After object ingest succeeds, StorageGRID attempts to deliver the replicated object to the configured destination as soon as possible. The tenant configures a Platform Services endpoint containing the destination Amazon S3 bucket information and credentials, then applies a CloudMirror replication configuration to the source bucket.

Option B is incorrect because cross-grid replication is designed for replication between StorageGRID systems connected through grid federation, rather than for using Amazon S3 as an external analytics destination. NetApp XCP and Robocopy are file migration/copy utilities and are not StorageGRID's native event-driven S3 replication mechanism.

Therefore, D. CloudMirror service directly satisfies the requirement to replicate newly ingested StorageGRID objects into Amazon S3 for downstream AWS processing.

Reference topics: Tenant Manager → Platform Services → CloudMirror Replication → Amazon S3 Endpoint → Hybrid Cloud Data Pipelines

StorageGRID provides S3 bucket event notifications as a platform service that can inform external applications when specified object-level events occur. NetApp documentation confirms that event-notification destinations can be an Amazon SNS topic, Kafka topic, or webhook endpoint. Therefore, both the webhook endpoint in option B and the Apache Kafka endpoint in option C can notify the application when an s3:ObjectCreated event occurs.

A webhook endpoint receives notification messages through HTTP POST requests and is appropriate when the application exposes an HTTP/HTTPS listener. A Kafka endpoint publishes the event to a configured Kafka topic, allowing an application or processing service to consume the event and immediately initiate object conversion. StorageGRID explicitly identifies sns, kafka, and webhook as supported notification endpoint types.

Option A is incorrect because a StorageGRID load balancer endpoint provides S3 client connectivity rather than bucket-event notification. Option D is also incorrect because CloudMirror replication copies objects to another S3 bucket; it is a replication service, not an application-notification mechanism.

Reference topics: Tenant Manager → Platform Services → Event Notifications → Kafka/Webhook Endpoints; S3 Bucket Notification Configuration

The correct configuration is to route StorageGRID AutoSupport traffic through an Admin proxy server. NetApp states that when AutoSupport packages are transmitted using HTTPS, the primary Admin Node requires outbound access to NetApp Technical Support either directly or through a proxy server. This is specifically intended for secure environments where StorageGRID nodes cannot establish unrestricted direct internet connections.

The administrator configures this under Configuration > Security > Proxy settings > Admin, enables the Admin proxy, and specifies the proxy server hostname or IP address and port. Authentication credentials can also be supplied when required. Once configured, AutoSupport traffic from Admin Nodes to NetApp Technical Support is routed through this controlled proxy path.

This preserves normal AutoSupport functionality, including periodic and event-triggered AutoSupport packages, which support proactive monitoring and automatic support-case workflows. Manually uploading bundles, as in A, would not provide the desired automated behavior. Option B does not solve the connectivity restriction. Option C is also incorrect because AutoSupport On Demand is intended primarily for active troubleshooting and itself requires HTTPS connectivity; it does not replace normal automated AutoSupport delivery.

Therefore, D provides the required secure outbound connectivity while retaining automated NetApp support capabilities.

Reference topics: Grid Manager → AutoSupport → Admin Proxy → HTTPS AutoSupport → Event-Triggered AutoSupport → NetApp Technical Support Connectivity