A Storage Solutions Architect is integrating a new snapshot retention policy with an organization's ransomware defense strategy on an HPE Alletra Storage MP platform. The goal is to provide rapid recovery from malicious encryption events while preventing attackers from destroying the backups.
[Security & Snapshot Policy Draft]
Volume: Corporate_File_Shares
Snapshot Schedule: Hourly
Retention: 7 Days
Security Flag: WORM (Write Once Read Many) / Immutable enabled on all hourly snapshots
Admin Access: Domain Admins have full access to array management
Which THREE architectural conclusions evaluate the effectiveness and risks of this fused snapshot and security configuration? (Select all that apply.)
A. The immutable flag guarantees that if the base volume is encrypted by ransomware, the array will automatically detect the anomaly and instantly revert to the last clean snapshot without manual intervention
B. Retaining hourly immutable snapshots for 7 days on highly active file shares requires careful capacity right-sizing, as the storage administrator cannot manually delete these snapshots to free up space if the array reaches 100% capacity
C. Enabling the immutable (WORM) flag on the hourly snapshots successfully prevents both malicious ransomware scripts and compromised administrator accounts from deleting the snapshots before the 7-day retention period expires
D. Enabling WORM on snapshots automatically disables inline deduplication for those specific blocks to guarantee a cryptographically secure chain-of-custody for forensic analysis
E. The snapshot schedule must be completely redesigned to use asynchronous replication, as local immutable snapshots cannot cryptographically protect against file-level ransomware encryption
F. Because Domain Admins have full array management access, a compromised host-level admin account could theoretically alter the system NTP clock, potentially tricking the array into expiring the immutable snapshots prematurely
