How does ONTAP achieve multi-tenant isolation?

• A. Through SVMs, IPspaces, quotas, and separate LIFs per protocol.
• B. By using a single global namespace with access lists.
• C. By installing separate operating systems for each tenant.
• D. By duplicating data across multiple volumes with no isolation.

Answer: (A)

Multi-tenant isolation in ONTAP comes from creating separate, self-contained environments called Storage Virtual Machines (SVMs). Each tenant gets its own SVM, which provides an independent namespace, separate admin access, and isolated data access rules. To keep network traffic from crossing tenants, IPspaces divide the network so each SVM’s LIFs (logical interfaces) operate within its own IP space. Quotas enforce per-tenant storage limits so one tenant can’t exhaust resources. Having separate LIFs per protocol ensures that protocol traffic (NFS, SMB, iSCSI, etc.) for each tenant stays on its own paths, boosting security and performance isolation.

The other approaches don’t fit: a single global namespace with access lists doesn’t provide true isolation across tenants; installing a separate OS per tenant isn’t how ONTAP provides isolation; duplicating data across volumes with no isolation defeats the purpose of segmentation.