To recover from a ransomware event that has encrypted a file share, you need two key components: a clean, unencrypted copy of the data from before the attack, and a mechanism to restore that data.

Snapshot (D) technology creates point-in-time, read-only copies of a volume. These copies, taken before the ransomware attack, contain the unencrypted, original files. They serve as the essential source for any recovery operation.

SnapRestore (C) is the feature used to revert an entire volume to a previous Snapshot copy. This process is nearly instantaneous and is the most efficient method for recovering a complete file share after it has been compromised by ransomware, effectively undoing the encryption damage.

A. SnapLock: This is a Write-Once, Read-Many (WORM) feature for compliance and data immutability. It protects data, including Snapshot copies, from deletion or modification but is not a recovery tool itself.

B. SnapMirror: This is a disaster recovery feature that replicates Snapshot copies to a secondary system. While it provides a crucial off-site source for recovery, SnapRestore is the more direct feature for recovering the primary volume.

1. NetApp, Inc. (2023). TR-4574: Ransomware Prevention and Recovery with NetApp ONTAP.

Page 13, Section "Recover": "NetApp Snapshot copies provide the primary mechanism for data recovery. Because Snapshot copies are read-only, online, and stored within the volume, they offer a simple, secure, and efficient solution for recovering from a ransomware attack." (Supports answer D)

Page 14, Section "Volume recovery": "NetApp SnapRestore technology enables you to revert the contents of an entire volume to a previous Snapshot copy almost instantaneously, regardless of the volume size or the number of files." (Supports answer C)

2. NetApp, Inc. (2023). TR-4015: SnapRestore: Best Practices Guide.

Page 5, Section "Introduction": "NetApp SnapRestore® technology uses a saved Snapshot copy to restore a file, a LUN, or, most commonly, an entire volume to a previous point in time. This restoration is accomplished without the need for an extended copy process from a backup device." (Defines SnapRestore's function for volume-level recovery).