Disk encryption is the specific technology designed to protect data at rest. NetApp offers two primary forms: NetApp Storage Encryption (NSE) using self-encrypting drives (SEDs) and NetApp Volume Encryption (NVE), a software-based solution. In both cases, the data on the physical disks is encrypted. The encryption keys are managed by the ONTAP controllers or an external key manager, not stored on the disk shelf itself. If a disk shelf is physically stolen, the data on the drives remains encrypted and is unreadable without access to the original storage system and its keys, thereby ensuring the data cannot be accessed.

A. snapshot volume: A Snapshot copy is a point-in-time image for logical data recovery (e.g., accidental deletion); it does not encrypt the data at rest to protect against physical theft.

B. IPsec: IPsec secures data in transit over a network by encrypting IP packets. It provides no protection for data at rest on a stolen disk shelf.

D. SnapLock volume: SnapLock provides Write-Once, Read-Many (WORM) data immutability to prevent alteration or deletion. It does not inherently encrypt data to ensure confidentiality if the media is stolen.

1. NetApp ONTAP 9 Documentation Center, "Overview of NetApp encryption solutions": "NetApp offers several encryption solutions to help you secure your data, both at rest and in flight... NetApp Storage Encryption (NSE) provides protection for data at rest at the disk level. It can help you secure data against theft, loss, or improper decommissioning of drives."

2. NetApp Technical Report 4570, "NetApp ONTAP Security Hardening Guide": Section 5.1, "Data-at-Rest Encryption," states, "Both NVE and NSE protect against many security threats, including media theft (the physical removal of storage media from a data center)."

3. NetApp ONTAP 9 Documentation Center, "IPsec encryption over the wire": "You can use IPsec to secure IP traffic over the wire between ONTAP systems and their clients or between nodes in a cluster." This confirms IPsec is for data-in-transit, not data-at-rest.

4. NetApp ONTAP 9 Documentation Center, "SnapLock overview": "SnapLock is a high-performance compliance solution for organizations that use a write-once, read-many (WORM) model for data retention." This defines its purpose as data immutability, not confidentiality.