NetApp Storage Encryption (NSE) uses Self-Encrypting Drives (SEDs) and the drive’s built-in hardware encryption engine. This provides FIPS 140-2 compliant encryption at rest. Crucially, the encryption key is tied to the drive’s physical hardware and the storage system’s controller, meaning the data is inaccessible if the drive is removed and placed in another system, meeting the requirement for protection against physical theft.

The core distinction is in the state and purpose of the destination. SnapMirror (typically Async or Sync) creates a mirrored, online, and writable (after break) copy of a volume for disaster recovery or data mobility. SnapVault creates a space-efficient, read-only backup copy on the destination, intended for long-term retention and point-in-time recovery. The destination volume in SnapVault is not meant for immediate production failover.

ONTAP’s support for VMware’s VAAI (vStorage APIs for Array Integration) includes the Atomic Test & Set (ATS) primitive. ATS allows VMware ESXi hosts to perform locking operations at a granular block level rather than placing a SCSI reservation on the entire LUN. This dramatically reduces contention and improves performance in multi-host VMware clusters accessing shared datastores.

When the Snapshot reserve is 0%, Snapshot copies consume space from the active file system (the volume’s user-accessible space). If the volume fills to 100% capacity due to a combination of active data and Snapshot blocks, the file system will become read-only, and write operations from hosts will fail. This is a critical situation that requires administrative intervention to free space, such as deleting unnecessary files or older Snapshot copies.

Trident is NetApp’s dynamic storage orchestrator for Kubernetes. Its CSI (Container Storage Interface) driver is the core component that integrates the Kubernetes control plane with the ONTAP storage system. It interprets PersistentVolumeClaim requests, communicates with the ONTAP backend via the SVM management LIF, and automatically provisions the requested storage (like FlexVol volumes), enabling the dynamic, self-service model required by containerized environments.

Cluster Failover (CFO) is a high-availability feature in two-node clusters. When enabled, if one node goes down (e.g., for a planned upgrade or due to a failure), its partner node can temporarily take over the storage and data serving responsibilities of the failed node’s aggregates. This allows client I/O to continue with minimal disruption, making the controller upgrade non-disruptive to the hosts.

FlexClone creates a writable, point-in-time copy of a volume or LUN almost instantly, with minimal initial storage overhead. It uses ONTAP’s space-efficient pointer-based technology, sharing blocks with the parent volume’s Snapshot. This allows the application owner to begin using the 50 TB clone immediately for testing, while actual physical storage is only consumed as the clone’s data diverges from the parent.

An IPspace is a logical container for network configuration (broadcast domains, subnets, and LIFs) that provides complete network isolation. Each SVM is associated with one IPspace. By assigning data LIFs to subnets within that IPspace, you define how the SVM is reachable on the network. Multiple SVMs can share an IPspace, or they can have separate IPspaces for full network segmentation.

Both MetroCluster IP and FC configurations can achieve zero RPO, but the question asks about the mode. The key feature for zero RPO is synchronous mirroring (SyncMirror) of writes between the two sites. MetroCluster IP is a specific implementation that uses IP networks for the mirroring and replication links. In this mode, every write is committed to NVRAM at both sites before being acknowledged to the host, ensuring no data is lost during a site failure.

NetApp Storage Encryption (NSE) uses Self-Encrypting Drives (SEDs) and the drive’s built-in hardware encryption engine. This provides FIPS 140-2 compliant encryption at rest. Crucially, the encryption key is tied to the drive’s physical hardware and the storage system’s controller, meaning the data is inaccessible if the drive is removed and placed in another system, meeting the requirement for protection against physical theft.0