What is the function of the Trusted Platform Module (TPM) built into NetApp FAS and AFF systems?

• A. Communicate to a KMIP server
• B. Generate the node encryption key
• C. Encrypt data in flight between on premises and cloud
• D. Encrypt data in flight between two NetApp ONTAP systems

Answer: (B)

The TPM provides a hardware-backed key that ONTAP uses for data at rest security. It generates and securely stores the node encryption key, which is the key ONTAP uses to encrypt and decrypt the disk blocks on the NetApp system. Because the key is created and protected by the TPM, it is not exposed to software or easily extracted, which helps ensure that data at rest remains encrypted even if the drives are accessed outside the system. This is distinct from encryption in flight (which uses TLS/IPsec) or external key management, which are not the roles of the TPM in this context.