What happens when ONTAP ARP detects ransomware-like behavior?

• A. It shuts down the SVM
• B. It auto-reverts to the last known good Snapshot
• C. It alerts administrators and increases monitoring sensitivity
• D. It deletes infected files

Answer: (C)

Anti-Ransomware Protection in ONTAP is designed to detect suspicious, ransomware-like activity and respond in a cautious, audit-friendly way. When such activity is detected, the system raises alerts to administrators and increases monitoring sensitivity so the security team can quickly assess the situation, review logs, and take appropriate remediation steps. It avoids automatic destructive actions, such as shutting down the SVM, reverting automatically to a previous snapshot, or deleting files, because those could cause unintended data loss or service disruption. The goal is rapid detection and informed human response, not automatic data loss.