NS0-162 Exam Dumps : NetApp Certified Data Administrator (ONTAP)

 To increase access security in both NFS and iSCSI environments, you can use Kerberos and CHAP as authentication methods. Kerberos is a network authentication protocol that uses tickets to provide mutual authentication between clients and servers. CHAP is a challenge-response protocol that verifies the identity of a peer by using a shared secret. ONTAP supports Kerberos for NFS exports, which allows you to secure NFS traffic with encryption and integrity checking. ONTAP also supports CHAP for iSCSI LUN access, which prevents unauthorized access to iSCSI targets and initiators. References :- NFS security overview, iSCSI Security Configuration

The security method that would be used to authenticate targets and initiators in an ISCSI environment is CHAP. CHAP stands for Challenge Handshake Authentication Protocol, and it is a method that validates the identity of targets and initiators during the initial link. CHAP uses a shared secret (a password) that is exchanged between the target and the initiator in a challenge-response manner. CHAP can be used in both one-way and mutual modes, depending on whether both parties need to authenticate each other or not. The other options are not valid for this scenario because:

• NIS is a network information service that provides centralized management of user accounts and host names, but it does not provide authentication for ISCSI devices.
• LDAP is a protocol for accessing and managing directory services, such as user and group information, but it does not provide authentication for ISCSI devices.
• /etc/hosts is a file that maps host names to IP addresses, but it does not provide authentication for ISCSI devices. References :- How iSCSI authentication works, Securing iSCSI Devices, Configure iSCSI authentication

The igroup is a logical grouping of initiators that can access a set of LUNs. The igroup must contain the IQNs (iSCSI Qualified Names) or WWPNs (World Wide Port Names) of the initiators that need to access the LUNs. In this scenario, the igroup named “ESX” has the iSCSI protocol and the VMware OS type, but it does not have any initiators listed. This means that the VMware hosts cannot authenticate and connect to the LUNs in the SVM. To resolve this issue, the igroup must be populated with the correct initiators that match the VMware hosts. This can be done by using the igroup add command or the System Manager GUI12. References :- Create an igroup, Add initiators to an igroup