Nutanix File Analytics, part of Nutanix Unified Storage (NUS), is a tool for monitoring and analyzing file data within Nutanix Files deployments. It includes anomaly detection capabilities to identify unusual activities, such as mass file deletions, which could indicate ransomware or other threats. Anomaly alerts are triggered based on configurable thresholds, defined as either a percentage of files affected or an absolute number of files affected within a specific time window.
The exhibit provides the anomaly detection settings for File Analytics:
Events: Delete
Minimum Operation %: 100
Minimum Operation Count: 10
User: Individual
Type: Hourly
Interval: 1
Actions: (Not relevant for calculation, typically notification settings)
Interpretation of Settings:
Minimum Operation %: 100% means the alert will trigger if 100% of the specified minimum count is met. This field is often used in conjunction with the count to set a threshold, but in practice, the Minimum Operation Count takes precedence for absolute thresholds.
Minimum Operation Count: 10 files. This means an anomaly alert will trigger if at least 10 files are deleted by an individual user within the specified interval.
User: Individual (applies to actions by a single user, not aggregate across all users).
Type/Interval: Hourly, with an interval of 1, meaning the threshold is evaluated every hour.
Calculation:
The repository has 1000 files.
The threshold for a “Delete” event is set to a Minimum Operation Count of 10 files.
This means an anomaly alert will be triggered if 10 or more files are deleted by an individual user within a 1-hour window, regardless of the percentage of the total repository.
The “Minimum Operation %” of 100% applies to the count threshold itself (i.e., 100% of 10 files = 10 files), confirming that the absolute threshold of 10 files is the key trigger.
Evaluation of Options:
Option A (1 file): Incorrect. Deleting 1 file is below the threshold of 10 files.
Option B (10 files): Correct. Deleting 10 files meets the minimum operation count of 10, triggering the anomaly alert.
Option C (100 files): Incorrect. While deleting 100 files would also trigger the alert (as it exceeds 10), the question asks for the minimum number of files to trigger the alert, which is 10.
Option D (1000 files): Incorrect. Deleting 1000 files would trigger the alert, but it’s far more than the minimum required (10 files).
Thus, the minimum number of files that must be deleted to trigger an anomaly alert is 10, corresponding to option B.
Exact Extract from Nutanix Documentation:
From the Nutanix File Analytics Administration Guide (available on the Nutanix Portal):
“File Analytics allows administrators to configure anomaly detection thresholds for file operations, such as deletions. The ‘Minimum Operation Count’ specifies the absolute number of files that must be affected to trigger an alert, while the ‘Minimum Operation %’ can be used to define a percentage-based threshold. For example, if the Minimum Operation Count is set to 10, an alert will be triggered when 10 or more files are deleted by the specified user type (e.g., Individual) within the defined interval (e.g., Hourly).”
Additional Notes:
The “Minimum Operation %” of 100% in the exhibit can be confusing. In Nutanix File Analytics, this typically means the threshold must fully meet the specified count (i.e., 100% of 10 files = 10 files). The count-based threshold (10 files) is the primary trigger in this case, as it’s more specific than a percentage of the total repository.
If the percentage were the primary threshold (e.g., 1% of 1000 files = 10 files), the result would be the same, but the documentation emphasizes the count-based threshold as the key setting in such configurations.
The exhibit confirms the settings align with standard File Analytics behavior, making option B the correct answer.
[References:, , Nutanix File Analytics Administration Guide, Version 4.0, Section: “Configuring Anomaly Detection” (Nutanix Portal)., Nutanix Certified Professional - Unified Storage (NCP-US) Study Guide, Section: “Nutanix File Analytics”., ]
