Pure Storage FlashArray-Storage-Professional Exam Questions

Remote Assist (RA) Overview: Remote Assist is a secure, customer-initiated tunnel that allows Pure Storage Technical Support Engineers (TSEs) to log into a FlashArray to perform diagnostics and maintenance. It is disabled by default and must be explicitly opened by the customer.

Access Modes in Purity: In modern Purity versions (like 6.8.4), Pure Storage has introduced granular access controls for these support sessions to satisfy enterprise security and compliance requirements (such as SOC2 or HIPAA).

Restricted Access: This mode is specifically designed for high-security environments. When RA is enabled with the Restricted flag, the Support Engineer is limited to a pre-defined subset of non-destructive, read-only, or diagnostic commands. They cannot perform major configuration changes, delete data, or access sensitive metadata without further authorization.

Elevated vs. Secured: * Elevated access (often used during emergency recovery) provides the TSE with broader permissions, including the ability to run system-level scripts and configuration commands that go beyond standard diagnostics.

Secured is often a baseline state but does not imply the specific command-level filtering that 'Restricted' does.

Security Best Practice: If a security team mandates that 'only certain commands can be executed,' Restricted is the correct administrative choice. This ensures that the principle of least privilege is applied even to the vendor's support staff.

When new DirectFlash Modules (DFMs) or data packs are physically inserted into a Pure Storage FlashArray, the Purity operating environment detects the new hardware but places the drives in an 'unadmitted' state. This safety mechanism prevents the accidental incorporation of drives and allows the system to verify the firmware and health of the modules before they are actively used to store data.

To formally accept these drives into the system's storage pool so their capacity can be utilized, the administrator must execute the CLI command puredrive admit. Once this command is run, the drive status transitions from 'unadmitted' to 'healthy,' and the array's usable capacity expands accordingly.

Here is why the other options are incorrect:

pureadmin -- admit-drive (A): This is syntactically incorrect. The pureadmin command suite is used for managing administrator accounts, API tokens, and directory services, not for hardware or drive management.

purearray admit drive (B): This is also incorrect syntax. While purearray is used for array-wide settings and status (like renaming the array or checking space), specific drive-level operations are exclusively handled by the puredrive command structure.

Similar to the previous question regarding directory services, Pure Storage Purity OS handles Role-Based Access Control (RBAC) overlaps by granting the most permissive role available to the user.

When configuring LDAP or Active Directory authentication on a FlashArray, administrators map directory groups to specific FlashArray roles (Array Admin, Storage Admin, Ops Admin, Read Only). If a user happens to be a member of multiple LDAP groups that are mapped to different roles on the array, Purity evaluates all mapped roles and automatically assigns the user the highest level of privilege during their session.

Since 'Array Admin' has full administrative rights over the entire array (including hardware management, directory services configuration, and firmware upgrades) and sits higher in the hierarchy than 'Storage Admin' (which is restricted to provisioning and managing storage objects like volumes and hosts), the system will seamlessly grant the user Array Admin permissions.

Here is why the other options are incorrect:

User will not be able to login (B): Purity is designed to handle this exact scenario smoothly. It resolves the conflict by defaulting to the higher privilege, rather than throwing an error or denying access.

User will have Storage Admin permissions (C): The system does not default to the lowest privilege or restrict access when a higher-level group membership is present and valid.

ActiveDR Bandwidth Sizing: ActiveDR is a continuous, asynchronous replication technology designed to provide near-zero RPO. Because it streams data continuously rather than in discrete snapshot intervals, the bandwidth between the source and target arrays must be able to handle the application's write workload.

Handling Write Bursts: Application workloads are rarely flat; they have peaks and valleys. If you size the bandwidth exactly to the average change rate, any burst in write activity will cause the replication lag to increase, thereby increasing your RPO.

The 30% Rule: Pure Storage best practices and sizing guides recommend providing a 30% buffer (headroom) above the measured average write rate. This extra capacity ensures that during a high-IO period, the replication engine has enough 'pipe' to catch up quickly and return to a near-sync state.

Calculation Example: If a workload generates an average of 100 MB/s of new unique data, the administrator should ensure at least 130 MB/s of usable, dedicated bandwidth is available between the sites.

Consequences of Under-sizing: If only 10% (Option A) is used, the array may struggle to recover from even minor bursts, leading to a consistently climbing RPO. 50% (Option B) is often considered safe but can be cost-prohibitive or overkill for standard networking budgets unless the workload is exceptionally volatile.

Understanding Alert 51: On a Pure Storage FlashArray, Alert 51 signifies that a Protection Group's replication is lagging behind its scheduled completion time. This does not necessarily mean the connection is 'down,' but rather that the volume of data being sent is exceeding the available throughput or is being queued behind other tasks.

The Triage Process:

Open Alerts: You must check for related alerts (like Alert 20 for 'Replication Connection Down') to determine if the delay is caused by a total link failure or just congestion.

Replication Jobs in Progress: Because FlashArray uses a specialized engine to manage replication, having multiple large snapshots from different Protection Groups replicating simultaneously can saturate the 'replication pipe.' Checking active jobs helps determine if there is a scheduling 'traffic jam.'

Replication Bandwidth: Comparing the current outgoing replication throughput against the historical average or the physical limit of the replication ports helps identify if the delay is due to a sudden increase in Data Change Rate (churn) or a reduction in network performance.

Why Option B is incorrect: If a Protection Group were disabled, replication wouldn't be 'delayed'---it would be stopped, which triggers a different alert state. Cabling issues usually result in 'Connection Down' alerts rather than just 'Delayed' alerts.

Why Option C is incorrect: Disconnecting replication is a destructive troubleshooting step that will only increase the lag and RPO. You should always analyze the existing data flow before breaking the connection.