FlashArray-Storage-Professional Pure Certified FlashArray Storage Professional Question and Answers

Interface Separation: Pure Storage FlashArrays distinguish between Management traffic (used for the GUI, CLI, and Pure1 connectivity) and Data traffic (used for host connectivity). Within the data path, File Service Interfaces are the logical interfaces assigned to handle NFS and SMB traffic.

Directory Service Communication: For FA File to function, it must communicate with external identity providers (like Microsoft Active Directory or OpenLDAP) to authenticate users and resolve permissions.

The Default Path: By design, Purity prioritizes the File Service Interfaces for these lookups. This is because the directory servers (Domain Controllers) are typically located on the same production/data network as the clients accessing the files. Using the File Service Interface ensures that authentication traffic follows the same network path and security rules as the data traffic itself.

Why Option B is incorrect: While the array management plane can use the management interfaces for its own administrative LDAP/SAML logins, the File Services component defaults to the data-path (File) interfaces to avoid " crossing the streams " between management and production data networks.

Why Option C is incorrect: Purity is very specific about its routing tables. It does not blindly use " all " interfaces for DNS/Directory services. If a File Service interface is configured and active, it becomes the primary egress point for file-related metadata and authentication requests.

Modern Monitoring Standards: Pure Storage has built its management ecosystem around the REST API . While traditional methods like SNMP and Syslog are supported for basic health alerts, the REST API provides the depth of data (granularity) and the performance required for modern observability platforms like Prometheus , SolarWinds , and Grafana .

The Pure Storage Exporter: For tools like Prometheus, Pure Storage provides an official " Pure Exporter. " This exporter acts as a bridge; it queries the FlashArray via the REST API to gather real-time metrics (latency, bandwidth, IOPS, capacity) and converts them into the format Prometheus understands.

SolarWinds Integration: SolarWinds utilizes the Pure Storage REST API to pull performance and health data into its storage monitoring modules. This allows for deep-dive historical analysis that exceeds the capabilities of simple SNMP traps.

Why SMI-S (Option B) is incorrect: SMI-S (Storage Management Initiative Specification) is a legacy industry standard that is largely deprecated in favor of RESTful interfaces. Pure Storage does not focus on SMI-S for modern third-party tool integration.

Why SYSLOG (Option C) is incorrect: Syslog is excellent for Event Logging (e.g., " User Logged In, " " Volume Deleted " ), but it is a poor choice for Performance Monitoring . You cannot effectively graph IOPS or bandwidth trends using Syslog streams alone.

Pure Storage strongly recommends an MTU size of 9000 (Jumbo Frames) for replication networks—such as those used for Asynchronous Replication, ActiveCluster, and ActiveDR—as well as for iSCSI and NVMe/TCP data networks.

A 9000-byte MTU significantly reduces protocol overhead and CPU processing load on the storage controllers by allowing a much larger payload of data to be transmitted inside a single network packet. During heavy replication, this drastically increases throughput and maximizes bandwidth efficiency.

Here is why the other options are incorrect:

1500 (B): While 1500 bytes is the standard default MTU for Ethernet and is exactly what Pure Storage recommends for the management ports (vir0), it is not the recommended optimization for high-throughput replication traffic. (Note: If your network cannot support 9000 end-to-end, 1500 must be used to prevent packet fragmentation, but 9000 remains the best-practice recommendation).

4200 (A): This is an arbitrary number and is not a standard network MTU size used in Pure Storage environments.

Policy-Driven Automation: Pure Protect //DRaaS (Disaster Recovery as a Service) is built on a declarative policy engine. When you define a business policy (Protection Group or similar policy-based management), the system ' s primary goal is to bring the environment into compliance with the " Desired State " defined by that policy.

Retention Enforcement: When the retention period is reduced (e.g., from 7 days down to 3 days), the Purity/Pure Protect engine identifies that any existing snapshots or backups older than the new 3-day threshold are now " out of policy. "

Immediate Reclamation: Unlike some legacy backup systems that only apply new retention settings to future backups, Pure Storage ' s policy-driven architecture typically triggers an immediate cleanup of the now-obsolete data to reclaim space on the target. This ensures the environment matches the modified policy requirements immediately upon the policy update.

SafeMode Considerations: If SafeMode is enabled on the target, these " erased " backups will actually move into the " Destroyed " (but not yet eradicated) bucket for the duration of the SafeMode timer, providing a safety net against accidental policy changes or malicious deletions. However, from the perspective of the active DR policy, they are removed.

API Evolution: Pure Storage introduced REST API 2.x to provide a more scalable, standardized, and performant way to automate FlashArray management. It uses a different authentication method (OAuth2 with API Clients) compared to the API Token-based method in 1.x.

Feature Freeze on 1.x: As of Purity 6.x and beyond, Pure Storage has designated REST API 1.x as " Legacy. " While 1.x is still supported for backward compatibility to ensure older scripts don ' t break, all new Purity features (such as specialized ActiveDR commands, advanced File Services, or new hardware capabilities) are only developed and exposed via REST API 2.x .

Side-by-Side Support: Contrary to option C, both versions are supported side-by-side on the same array. An administrator can run a script using 1.x for volume creation and another script using 2.x for performance monitoring simultaneously without contacting support.

Feature Parity: REST API 2.x has long since reached and exceeded the capabilities of 1.x. It offers improved filtering, pagination, and a more consistent object model (e.g., /volumes instead of multiple nested endpoints).

Best Practice: Pure Storage strongly recommends that all new automation projects use REST API 2.x to ensure access to the full suite of Purity features and to future-proof infrastructure-as-code (IaC) workflows.

Remote Assist (RA) Overview: Remote Assist is a secure, customer-initiated tunnel that allows Pure Storage Technical Support Engineers (TSEs) to log into a FlashArray to perform diagnostics and maintenance. It is disabled by default and must be explicitly opened by the customer.

Access Modes in Purity: In modern Purity versions (like 6.8.4), Pure Storage has introduced granular access controls for these support sessions to satisfy enterprise security and compliance requirements (such as SOC2 or HIPAA).

Restricted Access: This mode is specifically designed for high-security environments. When RA is enabled with the Restricted flag, the Support Engineer is limited to a pre-defined subset of non-destructive, read-only, or diagnostic commands. They cannot perform major configuration changes, delete data, or access sensitive metadata without further authorization.

Elevated vs. Secured: * Elevated access (often used during emergency recovery) provides the TSE with broader permissions, including the ability to run system-level scripts and configuration commands that go beyond standard diagnostics.

Secured is often a baseline state but does not imply the specific command-level filtering that " Restricted " does.

Security Best Practice: If a security team mandates that " only certain commands can be executed, " Restricted is the correct administrative choice. This ensures that the principle of least privilege is applied even to the vendor’s support staff.

To provide true real-time data and alerts directly to a Network Operations Center (NOC) dashboard, the information must be sourced directly from the FlashArray . The FlashArray ' s Purity operating environment natively supports real-time data streaming and alerting integrations via protocols like Syslog, SNMP traps, and the local REST API. Polling the array directly or configuring it to push alerts guarantees that the NOC receives instantaneous, up-to-the-second notifications regarding array health, hardware faults, and performance metrics.

Here is why the other options are incorrect:

Pure1 (B): While Pure1 is Pure Storage ' s powerful, cloud-based monitoring and predictive analytics platform, it relies on phone-home telemetry data. This telemetry is batched and transmitted from the array to the Pure1 cloud on a short polling interval (typically a few minutes). Because of this transmission and processing interval, Pure1 provides near-real-time (lagging by a few minutes) and historical data. It is excellent for global fleet management and predictive support, but not for instantaneous, zero-latency NOC alerting.

Pure Performance Monitoring (A): This is a distractor. There is no standalone product or specific protocol in the Pure Storage ecosystem officially named " Pure Performance Monitoring. " Performance monitoring is simply a feature accessed via the FlashArray GUI/CLI or the Pure1 platform.

In Pure1, the ability to simulate snapshot policies—particularly when assessing the capacity requirements and impact of enabling SafeMode—heavily relies on historical telemetry data. Pure1 uses the data from existing snapshots on the FlashArray to calculate the environment ' s daily data change rate, as well as the deduplication and compression ratios specific to those workloads.

By analyzing the footprint of existing snapshots, Pure1 ' s analytics engine can accurately project the future storage capacity required if you were to change your snapshot frequency or extend the retention period (for example, locking them down for 7 to 30 days under a SafeMode policy). If a FlashArray does not have any existing snapshots, Pure1 lacks the foundational baseline metrics needed to simulate and forecast the capacity impact of a proposed snapshot policy.

For FlashArray File Services (FA File), user authentication and mapping depend on the storage protocol being used. In an NFS-only environment, remote user authentication (resolving UNIX UIDs and GIDs to actual usernames and managing access) is typically handled via LDAP or NIS.

To configure this integration in the Purity GUI, the storage administrator must navigate to Settings > Access > Directory Services . This specific section allows the FlashArray to connect to a centralized directory server (such as OpenLDAP or even Active Directory providing LDAP services) to pull the necessary UNIX user and group attributes required for NFS file permissions to function properly.

Here is why the other options are incorrect:

Settings > Access > Create Active Directory Account (A): This specific menu path is used strictly for configuring native Active Directory (AD) computer accounts and joining the domain to support the SMB (Server Message Block) protocol. Since the scenario explicitly states the company is an " NFS only shop, " configuring an SMB AD account is not the correct step.

Settings > Access > File System (C): While you manage file-level exports and policies within the Purity file interface, the global configuration for remote user authentication and directory server integration lives under the dedicated Directory Services pane.

User Mapping in FA File: On a Pure Storage FlashArray, User Mapping is the mechanism that translates identities between different protocols (like mapping a Windows SID to a Unix UID/GID) or between an external directory service (like Active Directory or LDAP) and the local file system permissions.

The Impact of Disabling Mapping: When User Mapping is disabled on an active NFS export, the FlashArray can no longer resolve the identity of the user attempting to access existing files. Because NFS (specifically NFSv3 and NFSv4.1 supported by Pure) relies on these identifiers to verify file ownership and ACLs, existing files—which are tagged with specific owner IDs—become effectively " orphaned " from the perspective of the incoming request.

Access vs. Creation: * Existing Files: Accessibility is lost because the system cannot verify that the user has the rights to read or modify the file without the mapping logic.

New Files: Interestingly, in many " No Mapping " configurations, a user may still be able to create new files (often defaulting to a ' nobody ' or ' anonymous ' UID depending on the export rules), but they will immediately lose the ability to manage or access them once created because the mapping link is broken.

Real-time Application: Unlike some legacy storage systems that require a service restart, Purity applies export policy changes dynamically . As soon as the " User Mapping " toggle is disabled, the logic is removed from the data path, impacting active sessions immediately.

The ActiveCluster Mediator (whether it is the Pure1 Cloud Mediator or the On-Premises VM) is a lightweight tie-breaker that communicates continuously with the management interfaces of both FlashArrays. If it was previously online and suddenly reports as " unreachable " from both arrays simultaneously, the issue is almost always caused by a network interruption or firewall rule change blocking the required communication ports between the arrays ' management IP addresses and the Mediator VM.

If a network firewall is suddenly configured to drop or deny outbound TCP traffic (such as port 80/443 depending on the specific HTTP/HTTPS discovery and heartbeat configuration) from the FlashArrays to the ESXi-hosted Mediator, the arrays will fail to send their heartbeats, causing the mediator status to drop to " unreachable. "

Here is why the other options are incorrect:

Fibre Channel (FC) zoning or network access has not been created properly for the host (A): The Mediator is completely independent of the front-end host storage fabric (Fibre Channel or iSCSI). Host zoning issues would prevent the ESXi server from seeing its volumes, but it would not cause the FlashArrays to lose management network connectivity to the Mediator.

The mediator does not reside within a Pure datastore (B): This is actually a strict best practice and requirement . Pure Storage explicitly states that the On-Premises Mediator VM must be deployed in a separate (third) failure domain. It should not reside on the ActiveCluster mirrored datastore, because a site-wide SAN failure would take the mediator offline exactly when it is needed most. Therefore, not residing on a Pure datastore is the correct setup, not a cause for an outage.

In policy-driven data protection and disaster recovery architectures like Pure Protect //DRaaS, a " Business Policy " dictates the critical Service Level Agreements (SLAs) for your environment, such as your Recovery Point Objective (RPO), replication frequency, and retention schedules. These policies are then assigned to " Application Groups, " which act as logical containers for the specific virtual machines being protected and replicated to AWS.

As a fundamental safety mechanism built into the platform to prevent accidental exposure and SLA breaches, the system places a hard dependency lock on actively used policies. An administrator cannot delete a Business Policy if there are still Application Groups actively relying on it for their DR scheduling. To successfully delete the policy, the administrator must first modify all associated Application Groups and assign them to a different Business Policy, or completely remove the protection from those groups.

Here is why the other options are incorrect:

The administrator also needs DRaaS Cloud Admin access (C): The scenario explicitly states the user already has " DRaaS Global Admin access. " In the Pure Protect //DRaaS Role-Based Access Control (RBAC) model, Global Admin is the highest tier of privilege and has full rights to manage and delete policies. A lack of permissions is not the issue here.

The Business Policy is marked as the Primary Policy (B): While a policy might be a default or primary template, the actual hard restriction that prevents deletion in the software is active resource assignment (the Application Groups), not just a " Primary " label.

Understanding Total Latency: In a FlashArray environment, total latency as seen by the host application is the sum of several components. Pure Storage breaks this down into Array Time and SAN Time to help administrators pinpoint where performance bottlenecks exist.

SAN Time Definition: SAN Time represents the latency introduced by the network infrastructure between the host (initiator) and the FlashArray (target). This includes the time spent traveling across Fibre Channel or Ethernet switches, cables, and host bus adapters (HBAs). It is calculated by taking the total round-trip time measured by the host and subtracting the time the FlashArray spent processing the I/O.

Metric Breakdown: * Array Time: The time the FlashArray takes to process the I/O once it hits the front-end ports (Option C describes internal array time).

SAN Time: The transit time for the request to reach the array and the response to return to the host (Option A).

Wait Time: In ActiveCluster environments, there is also " Mirror Latency, " which is the time spent synchronizing data to a peer array (Option B).

Troubleshooting Value: If a user reports high latency but the FlashArray GUI shows very low Array Time , the administrator can look at the SAN Time metric. A high SAN Time indicates an issue with the fabric, such as a failing SFP, a congested switch port, or oversubscribed ISLs (Inter-Switch Links).

Understanding the Load Meter: The Load Meter in Pure1 and Purity represents the percentage of the array ' s performance capacity currently being utilized. It takes into account CPU cycles, back-end metadata processing, and front-end I/O. A 90% load means the controllers are nearly saturated.

The Impact of Capacity on Load: As a FlashArray fills up (specifically beyond 80% ), the Purity Operating Environment must work harder to find and organize free space. This " Garbage Collection " (GC) process becomes more intensive, which consumes more controller resources and contributes to a higher Load Meter reading.

Internal System QoS: To ensure the stability and integrity of the storage, Pure Storage uses Internal Quality of Service (QoS) . This is an " always-on " feature that prioritizes critical system processes (like metadata updates, internal health checks, and data protection) over incoming host I/O during periods of extreme resource contention.

Graceful Performance Pacing: When the load is consistently high (like the 90% described), Purity may introduce small amounts of latency to the host I/O (often seen as " Wait " or " Queue " time) to " pace " the workload. This prevents the controllers from reaching a 100% " locked " state, ensuring the array remains responsive and healthy even under heavy pressure.

Why Option C is incorrect: While the array needs to reclaim space, prioritizing Space Reclamation (a background task) during a 90% performance load would likely push the controllers to 100% load, causing significant latency spikes or instability for the host. The system must balance reclamation with active production I/O.

As Pure Storage has iterated through FlashArray generations (moving from //X R2 to R3, R4, and beyond), the power density and performance capabilities of the controllers have increased significantly. Modern high-performance controllers, such as those found in the //X R4 or //XL series, have strict power requirements that often exceed what a standard 110V/120V (Low-Line) circuit can provide.

To support the higher wattage and current draw of modern CPUs and NVRAM modules, Pure Storage requires 200-240V (High-Line) power for its latest generation controllers. If an existing array is currently running on 110V power, it must be migrated to 220V power outlets before the upgrade can proceed. Attempting to run newer, high-spec controllers on 110V power could lead to power supply instability, insufficient cooling performance, or the controllers failing to boot entirely.

Here is why the other options are incorrect:

Call support to schedule a power supply replacement (A): The issue is not a faulty power supply; it is the external electrical infrastructure ' s inability to provide the necessary voltage/wattage for the new hardware. Replacing the power supply with the same model would not solve the voltage limitation.

Transition the array to DC power (B): While Pure Storage does offer DC power options for specific telco environments, this is not a standard requirement for a typical controller upgrade. Moving to standard high-line AC power (220V) is the standard prerequisite for data center environments.

Ratcheted Protection Groups: A " ratcheted " protection group is a security feature used to enforce data retention and prevent the accidental or malicious removal of volumes from a protection policy. Once a protection group is ratcheted, the configuration is essentially " locked. "

The " Ratchet " Mechanism: When a protection group is ratcheted, Purity prevents any modifications that would decrease the level of protection. This includes preventing the removal of volumes from the group, as removing a volume would stop its scheduled snapshots and replication, thus violating the established security posture.

Security and Compliance: Because ratcheting is often used for compliance (such as SEC Rule 17a-4 or HIPAA) or as a defense against ransomware, it is designed to be difficult to reverse. Neither the standard GUI (Option C) nor the standard CLI (Option B) provides a self-service " unlock " button for a ratcheted group.

The Recovery Path: To remove a volume or change the settings of a ratcheted protection group, a FlashArray administrator must Contact Pure Storage Support . Support engineers have specific, high-level challenge-response procedures to verify the administrator ' s identity and intent before performing the back-end operations required to " un-ratchet " or modify the group.

When an NFS client successfully mounts an export using the target ' s IP address, it proves that the fundamental network connectivity (routing, firewalls) and the storage protocol layer (NFS export policies, host access permissions) are functioning correctly.

However, if the exact same mount attempt fails when using the Fully Qualified Domain Name (FQDN) of the FlashArray file service, the issue lies entirely with name resolution. The Domain Name System (DNS) is responsible for translating human-readable FQDNs into the IP addresses required for network communication. If the client cannot reach the DNS server, or if the DNS server lacks the correct A or AAAA records for the FlashArray ' s file Virtual IP (VIP) addresses, the client won ' t be able to resolve the name to the IP, causing the mount command to fail.

Here is why the other options are incorrect:

Issue with the Active Directory (AD) controller (A): Active Directory is primarily used for directory services, user authentication, and authorization (such as mapping permissions for SMB or NFSv4). While AD environments usually include DNS, an " AD controller issue " in the context of storage protocols usually points to permission denials, not host name resolution failures. Furthermore, since the mount works via IP, basic access is already validated.

Issue with the OpenLDAP (C): Similar to AD, OpenLDAP provides directory services for user mappings (UID/GID) and authentication. It does not perform FQDN-to-IP resolution.

Understanding RFC2307: RFC2307 is an extension to the LDAP (Lightweight Directory Access Protocol) schema that allows for the storage of Unix-style information (POSIX attributes) within a directory service, most commonly Microsoft Active Directory . These attributes include things like uidNumber (User ID), gidNumber (Group ID), and login shells.

The Cross-Protocol Challenge: In a Unified Storage environment where the same data needs to be accessed by both Windows clients (using the SMB protocol) and Linux/Unix clients (using the NFS protocol), the storage array must be able to map a Windows Security Identifier (SID) to a Unix UID/GID.

How Pure Uses It: When an administrator enables RFC2307 support in Purity//FA File Services, the FlashArray can query Active Directory to retrieve these POSIX attributes. This creates a 1:1 mapping between the Windows user and the Unix identity.

The Benefit: This mapping ensures that a user can create a file via SMB and another user (or the same user on a different system) can access or modify that same file via NFS while maintaining consistent permission enforcement and ownership records. Without this (or a similar mapping service like NIS or local files), cross-protocol access often results in permission " Mapping " errors or files being owned by " nobody. "

Understanding Space Reporting: To understand this behavior, you have to look at how Purity calculates capacity. Pure Storage uses a data reduction engine where data is deduplicated and compressed.

Volume Space vs. Shared Space:

Volume Space: This represents the unique data belonging to a specific volume that is not shared with any other volume via deduplication or snapshots.

Shared Space: This represents the data that is common across multiple volumes or snapshots. If you have two volumes that are clones of each other, most of that data is " Shared. "

The " Shift " Mechanism: When a volume is deleted (and potentially eradicated), the data it once shared with other volumes no longer needs to be " shared. "

Imagine Volume A and Volume B share 100GB of data. That 100GB is accounted for in Shared Space .

If you delete Volume B, that 100GB of data is now only referenced by Volume A.

Consequently, that 100GB is moved from the Shared Space bucket into Volume A ' s Volume Space bucket.

Net Result: The total physical space used on the array remains the same initially, but the accounting shifts. You see a decrease in Shared Space and an identical increase in the Volume Space of the remaining volumes that held those deduplication references.