ONTAP ships with several built-in security roles that control the commands a login account may issue. For cluster-level administration the predefined roles are admin, autosupport, backup, readonly and diag. Of the answer choices, only “backup” corresponds to one of these predefined roles; it allows execution of commands required for tape and NDMP backup operations but denies most configuration changes. The other listed strings (“provision”, “support”, “recovery”) are not delivered as predefined roles in any ONTAP 9 release, and would have to be created manually if required.

A. provision – No predefined role named “provision” exists; storage provisioning tasks are covered by the admin role.

B. support – The predefined role is called “autosupport,” not “support.”

D. recovery – No role called “recovery” is delivered with ONTAP; disaster-recovery tasks are performed under admin or custom roles.

1. NetApp, ONTAP 9 Security Hardening Guide, “Predefined roles for cluster administrators,” Table 2-1, p. 11.

2. NetApp, ONTAP 9 Command Reference, security login role show (Example output lists admin, autosupport, backup, readonly, diag).

3. NetApp, ONTAP 9 System Administration Guide, sec. “Cluster administrator accounts and roles,” p. 101-102.