On an AFF A400 system running ONTAP 9.7, NetApp Aggregate Encryption (NAE) is enabled by default for all newly created aggregates. To ensure this security feature is active before migrating production data, a prudent administrator would first verify the prerequisites and then validate the outcome.

First, it is necessary to ensure the software encryption capabilities are licensed on the cluster. As of ONTAP 9.6 and later, NetApp Volume Encryption (NVE) and NAE are included in the base license bundle, but verifying this license is installed is a required prerequisite (B). Second, after creating a new data aggregate, a verification step is essential to confirm that the default encryption setting was applied correctly (D). This "trust but verify" approach ensures the security posture is as expected.

A. Aggregates cannot be "converted" to NAE in-place. Encryption must be enabled at the time of aggregate creation.

C. NetApp Aggregate Encryption (NAE) is a software-based feature and does not depend on or require hardware-based self-encrypting drives (SEDs/NSE).

1. NetApp ONTAP 9.7 Documentation, "Overview of NetApp encryption solutions": This official documentation states, "Beginning with ONTAP 9.6, NetApp Volume Encryption (NVE) and NetApp Aggregate Encryption (NAE) are included in the ONTAP software base license. You do not need to purchase a separate license." This supports the need to ensure the base license, which includes the encryption features (B), is properly installed. It also states, "On AFF systems...NAE is enabled by default on new aggregates," which necessitates the verification step in (D).

2. NetApp Technical Report 4567, "NetApp Volume Encryption and NetApp Aggregate Encryption": Section "NetApp Aggregate Encryption" on page 7 clarifies, "NAE is a software-based technology for encrypting data at rest... NAE is supported on any type of disk drive (SSD, HDD, or a mix) and does not require special self-encrypting drives." This directly refutes option C. The report also details using the storage aggregate show -fields encryption command to verify an aggregate's encryption state, which is the action described in option D.

3. NetApp ONTAP 9.7 Documentation, "Encrypting aggregates with NAE": This document describes the process for creating encrypted aggregates. It confirms that for AFF systems, NAE is enabled by default and does not mention any "conversion" process for existing aggregates, making option A incorrect. The process is to create a new NAE aggregate and, if necessary, move data to it.