FlashArray-Storage-Professional Pure Certified FlashArray Storage Professional Questions and Answers

Edge Services and Gateways: Pure Storage FlashArray uses Edge Services (often associated with FA File or cloud integrations) to manage communication between the array and external services. The Gateway is the component that facilitates this secure connection.

Update Policy Control: To prevent unplanned outages or changes to the environment, Purity includes a safety toggle for Gateway updates. When the status shows " Eligible (updates disallowed) " , it means a newer version of the agent is available on the Pure Storage back-end, but the array ' s local policy is currently set to prevent automatic or manual " one-click " updates.

GUI Authorization: This is a security and administrative control. An administrator with Array Admin privileges must navigate to the Edge Services/Gateway configuration section in the Purity GUI and explicitly change the setting to " Allow Updates " . Once this toggle is enabled, the status will change to " Eligible, " and the update can be initiated.

Why Option A is incorrect: While the CLI is used for many advanced support functions, the puresupport namespace is generally reserved for Pure Storage Support technicians and requires a challenge-response session key. Standard agent updates are handled via the administrative GUI.

Why Option B is incorrect: Removing and re-installing the agent is an unnecessary and disruptive process. The " disallowed " status is simply a policy setting, not a corruption of the agent itself.

Remote Assist (RA) Overview: Remote Assist is a secure, customer-initiated tunnel that allows Pure Storage Technical Support Engineers (TSEs) to log into a FlashArray to perform diagnostics and maintenance. It is disabled by default and must be explicitly opened by the customer.

Access Modes in Purity: In modern Purity versions (like 6.8.4), Pure Storage has introduced granular access controls for these support sessions to satisfy enterprise security and compliance requirements (such as SOC2 or HIPAA).

Restricted Access: This mode is specifically designed for high-security environments. When RA is enabled with the Restricted flag, the Support Engineer is limited to a pre-defined subset of non-destructive, read-only, or diagnostic commands. They cannot perform major configuration changes, delete data, or access sensitive metadata without further authorization.

Elevated vs. Secured: * Elevated access (often used during emergency recovery) provides the TSE with broader permissions, including the ability to run system-level scripts and configuration commands that go beyond standard diagnostics.

Secured is often a baseline state but does not imply the specific command-level filtering that " Restricted " does.

Security Best Practice: If a security team mandates that " only certain commands can be executed, " Restricted is the correct administrative choice. This ensures that the principle of least privilege is applied even to the vendor’s support staff.

In Pure Storage Purity OS, the absolute best practice and proper configuration method for sharing a single volume across multiple hosts—such as a VMware ESXi cluster or a Microsoft Windows Server Failover Cluster (WSFC)—is to connect the volume to a Host Group .

When you create a Host Group, you add the individual Host objects (which contain the WWPNs, IQNs, or NQNs) into that group. When a volume is then connected to the Host Group, Purity automatically ensures that the volume is presented to every host in that group using the exact same LUN ID . Consistent LUN IDs across all nodes in a cluster are a strict requirement for clustered file systems like VMFS and Cluster Shared Volumes (CSV) to function correctly and prevent data corruption.

Here is why the other options are incorrect:

Connect the volume to each individual host (C): This is known as creating " private connections. " If you manually connect a shared volume to multiple hosts individually, Purity might assign a different LUN ID to the volume for each host. Inconsistent LUN IDs will cause clustered operating systems to fail to recognize the disk as a shared resource. Private connections should only be used for boot LUNs or standalone standalone servers.

Connect a volume group to the host (B): In Purity, a " Volume Group " is a logical container used for applying consistent snapshot policies, replication schedules, or ActiveCluster configurations to a set of related volumes (like a database and its log files). Volume groups are not used for host presentation or access control.

Understanding Data Reduction Rate (DRR): DRR is a measure of the effectiveness of Purity ' s deduplication and compression algorithms. It compares the amount of data written by the host to the amount of physical space actually occupied on the flash media after these processes have occurred.

Calculation: $\text{DRR} = (\text{Deduplication} \times \text{Compression})$.

Understanding Total Reduction: The Total Reduction metric is a broader " efficiency " value. It represents the ratio of the Total Provisioned (logical) space to the Physical space used.

The " Thin Provisioning " Factor: The primary difference between these two numbers is Thin Provisioning .

FlashArrays are 100% thin-provisioned by default. If a customer creates a 100TB volume but the host only writes 1TB of data, the " Total Reduction " will be massive because it counts all that unwritten, " virtual " space as " saved. "

The DRR, however, only looks at the 1TB that was actually written and calculates how well it was compressed and deduped.

Why Option C is incorrect: Both metrics generally account for the efficiency of snapshots. However, snapshots contribute to DRR through deduplication (since they share blocks with the source volume). The massive gap between DRR and Total Reduction is almost always mathematically attributed to the " unwritten " space provided by thin provisioning.

Key Takeaway: If your DRR is 5-to-1 but your Total Reduction is 50-to-1, it means your data is compressing/deduping well, but you have also provisioned a significant amount of volume space that hasn ' t been written to yet.

Pure Storage FlashArrays utilize Thin Provisioning as a core, always-on architectural principle. When a volume is created, the " size " assigned to it is merely a logical limit (a quota) presented to the host; no physical back-end flash capacity is allocated or " pinned " at the time of creation.

Because of this architecture, Purity allows administrators to create volumes that are significantly larger than the actual physical capacity of the array (this is known as over-provisioning). If an administrator accidentally selects PB (Petabytes) instead of GB, the Purity GUI will allow the volume to be created because it is a logical operation that doesn ' t immediately consume 1PB of physical flash. However, Purity includes a built-in safety check: if the requested logical size is exceptionally large or exceeds the current physical capacity of the array, the GUI will present a warning or confirmation prompt to ensure the administrator is aware of the massive logical size being provisioned before finalizing the change.

Here is why the other options are incorrect:

The volume will be created and space will immediately be used (A): This describes " Thick Provisioning, " which Pure Storage does not use. Space is only consumed on a FlashArray when unique data is actually written by the host and processed by the deduplication and compression engines.

The volume will not be created and a warning will be displayed (C): Purity does not strictly forbid over-provisioning. While it warns the user to prevent human error, it does not block the creation of the volume, as over-provisioning is a standard practice in thin-provisioned environments.

What is SafeMode Ratcheting?: SafeMode is Purity ' s " immutability " feature that prevents snapshots from being deleted, eradicated, or modified, even by an administrator with compromised credentials. Ratcheting is the process of increasing the protection levels (like extending the retention period) for a protection group (pgroup) to ensure even stricter data safety.

The Dependency on Local Snapshots: SafeMode ' s primary function is to protect point-in-time copies of data residing on the array. For a protection group to be " ratcheted " into a SafeMode-protected state, it must have an active Local Snapshot Schedule .

Why Option C is the Constraint: If a protection group does not have a local snapshot schedule, there are no local snapshots being generated for SafeMode to " lock. " SafeMode cannot protect what doesn ' t exist locally. While a pgroup might be used for replication only, SafeMode requires the local scheduling component to be active and configured to apply its immutable retention policies.

Why Option B is incorrect: Protection groups are designed to contain hosts, host groups, or volumes. This is the standard way to group related data for snapshot consistency and has no negative impact on SafeMode eligibility.

Operational Note: When you enable SafeMode on a protection group with a local schedule, the " Erradicate " button for those snapshots is disabled. To " ratchet " the protection, you typically work with Pure Storage Support to ensure the retention settings meet your compliance needs.

ActiveCluster Connectivity Models: In an ActiveCluster environment, hosts can connect to the arrays using either a Uniform or Non-Uniform access model. In a Uniform model, the host has active paths to both FlashArrays in the cluster.

The Failover Scenario: When the replication network between the two arrays fails (a " split-brain " scenario), the Mediator decides which array keeps the pod online (the winner) and which array takes it offline (the loser) to ensure data consistency.

Analyzing the Symptoms:

The pod failed over, meaning one array is now the exclusive servicer for that pod.

Most volumes in that pod stayed online for the host. This proves that the host is correctly registered in Purity (ruling out Option C) and that the general ActiveCluster/Pod logic is functioning.

Only one specific volume lost connectivity.

The Root Cause (Zoning/Access): If a single volume loses connectivity while others do not, it indicates a pathing issue specific to that volume ' s visibility. In an ActiveCluster failover, if the " winning " array does not have a physical path to the host for that specific volume (due to missing FC Zoning or Ethernet VLAN tagging on the switches), the host will lose access once the " losing " array drops its paths.

Why Option A is unlikely: If " Uniform access " (the ability to see both arrays) was the issue, it would typically affect all volumes in the pod equally during a failover, not just a single outlier. The fact that the rest of the volumes remained available suggests the host is configured for uniform access, but the specific network plumbing (zoning) for that one volume ' s path to the surviving array is missing.

!

Zoning Best Practices: In a Fibre Channel SAN environment, zoning is used to partition the fabric to ensure that initiators (hosts) can only see the targets (FlashArray ports) they are intended to communicate with.

The " Single Initiator " Rule: Pure Storage, following industry-standard SAN best practices (and Cisco/Brocade recommendations), strongly advises using Single Initiator Zoning . This means each zone should contain exactly one initiator (HBA port) and one or more targets (FlashArray ports) .

Why Single Initiator to Multiple Targets (Option B)?:

Isolation: This prevents " Initiator-to-Initiator " communication. If multiple initiators are in the same zone, they may attempt to communicate with or probe each other (Registered State Change Notifications - RSCNs), which can cause host instability, driver timeouts, or discovery issues.

Troubleshooting: It simplifies troubleshooting. If a port is experiencing CRC errors or flapping, the impact is isolated to that specific host ' s zone rather than affecting a broad " group " zone.

Efficiency: When a target port changes state (e.g., during a controller reboot), the switch sends an RSCN. In a single-initiator zone, only that specific host is notified. In a multi-initiator zone, every host in the zone is interrupted to process the notification, even if they aren ' t using the port that changed.

Target Selection: While the zone should have only one initiator, it can (and should) include multiple target ports from the FlashArray (usually one port from CT0 and one from CT1 for the same fabric) to provide path redundancy and allow the host ' s MPIO software to manage failover.

On the Pure Storage FlashArray//C R4 (as well as the //XL and //E series architectures), the onboard 100Gb/s Ethernet LOM (LAN on Motherboard) ports—specifically eth0 and eth1—are purpose-built and strictly reserved for DirectFlash Shelf (DFS) connectivity .

Pure Storage uses these dedicated 100GbE ports to run NVMe over RoCE (RDMA over Converged Ethernet), effectively extending the array ' s internal PCIe backplane to additional backend storage shelves. Because these ports are hardcoded exclusively for back-end shelf expansion, the Purity operating environment fundamentally restricts them from being assigned IP addresses for front-end host I/O services. Therefore, an administrator will be completely unable to configure eth0 or eth1 for iSCSI, NVMe/TCP, or Replication. Front-end iSCSI services must instead be configured on the dedicated Host I/O PCIe cards (which typically appear as eth2, eth3, etc., depending on the slot configuration).

Here is why the other options are incorrect:

The ports are designated for Management connectivity (A): On modern FlashArrays, dedicated management ports are typically out-of-band 1GbE/10GbE RJ45 ports (often designated as vir0 or specific management eth ports on older hardware), not the ultra-high-speed 100Gb/s QSFP28 ports.

The DAC cables are not compatible with the array ' s ports (B): While incompatible cables can prevent a link from coming up physically, the specific reason the administrator cannot configure the ports for iSCSI in the Purity software is due to the port ' s hardcoded role (DFS), not the physical cable type.

On a Pure Storage FlashArray, Role-Based Access Control (RBAC) allows administrators to integrate with Directory Services (like Active Directory or OpenLDAP) to control user access. Purity uses a specific hierarchy for its administrative roles, which from highest to lowest privilege are: Array Admin , Storage Admin , Ops Admin , and Read Only .

When a user logs in and is found to be a member of multiple Active Directory or LDAP groups that are mapped to different roles on the FlashArray, Purity ' s behavior is designed to grant the user the highest level of permissions among those conflicting group mappings. Because the Array Admin role is higher in the hierarchy than the Storage Admin role, the user will successfully log in and be granted full Array Admin permissions.

Here is why the other options are incorrect:

Inability to login (A): Purity handles overlapping group memberships gracefully by defaulting to the highest privilege. It does not lock the user out or cause a login failure.

Storage Admin permissions (B): Because the system grants the highest available mapped privilege, the user will not be restricted to the lower-tier Storage Admin role when they also possess group membership for the Array Admin role.

When new DirectFlash Modules (DFMs) or data packs are physically inserted into a Pure Storage FlashArray, the Purity operating environment detects the new hardware but places the drives in an " unadmitted " state. This safety mechanism prevents the accidental incorporation of drives and allows the system to verify the firmware and health of the modules before they are actively used to store data.

To formally accept these drives into the system ' s storage pool so their capacity can be utilized, the administrator must execute the CLI command puredrive admit. Once this command is run, the drive status transitions from " unadmitted " to " healthy, " and the array ' s usable capacity expands accordingly.

Here is why the other options are incorrect:

pureadmin -- admit-drive (A): This is syntactically incorrect. The pureadmin command suite is used for managing administrator accounts, API tokens, and directory services, not for hardware or drive management.

purearray admit drive (B): This is also incorrect syntax. While purearray is used for array-wide settings and status (like renaming the array or checking space), specific drive-level operations are exclusively handled by the puredrive command structure.

In a VMware vSphere environment utilizing Virtual Volumes (vVols), a Protocol Endpoint (PE) acts as a crucial logical proxy or I/O access point between the ESXi hosts and the storage array.

Unlike traditional VMFS datastores where the host mounts a massive LUN and places all VM files inside it, vVols map individual virtual machine disks directly to native volumes on the FlashArray. Because a single ESXi host could potentially need to communicate with thousands of individual vVol volumes, it would be extremely inefficient to map every single one directly to the host. Instead, the ESXi host mounts the Protocol Endpoint , and the storage array uses this PE to dynamically route the I/O to the correct underlying vVol. On a Pure Storage FlashArray, creating and connecting a PE volume to your ESXi host groups is a mandatory prerequisite for setting up a vVol datastore.

Here is why the other options are incorrect:

It allows for volumes of the same name within host groups (A): Purity OS requires all volume names across the entire FlashArray to be completely unique, regardless of which host group they are connected to or whether a Protocol Endpoint is in use.

It is required to set Host Protocol (C): The host communication protocol (such as iSCSI, Fibre Channel, or NVMe-oF) is determined by the physical host bus adapters (HBAs), network interface cards (NICs), and the configuration of the Host object in Purity, not by the creation of a volume type like a PE.

Understanding RFC2307: RFC2307 is an extension to the LDAP (Lightweight Directory Access Protocol) schema that allows for the storage of Unix-style information (POSIX attributes) within a directory service, most commonly Microsoft Active Directory . These attributes include things like uidNumber (User ID), gidNumber (Group ID), and login shells.

The Cross-Protocol Challenge: In a Unified Storage environment where the same data needs to be accessed by both Windows clients (using the SMB protocol) and Linux/Unix clients (using the NFS protocol), the storage array must be able to map a Windows Security Identifier (SID) to a Unix UID/GID.

How Pure Uses It: When an administrator enables RFC2307 support in Purity//FA File Services, the FlashArray can query Active Directory to retrieve these POSIX attributes. This creates a 1:1 mapping between the Windows user and the Unix identity.

The Benefit: This mapping ensures that a user can create a file via SMB and another user (or the same user on a different system) can access or modify that same file via NFS while maintaining consistent permission enforcement and ownership records. Without this (or a similar mapping service like NIS or local files), cross-protocol access often results in permission " Mapping " errors or files being owned by " nobody. "

In any NVMe-based storage fabric (including NVMe/TCP, NVMe/FC, and NVMe/RoCE), the standard method for identifying endpoints and enforcing device-level access control is the NQN (NVMe Qualified Name) .

The NQN serves the exact same purpose in the NVMe protocol as an IQN (iSCSI Qualified Name) does in an iSCSI environment, or a WWPN (World Wide Port Name) does in a Fibre Channel environment. It is a unique identifier assigned to both the host (initiator) and the storage array (target subsystem). When setting up access control on a Pure Storage FlashArray, the storage administrator must capture the Host NQN from the operating system and configure a Host object on the array with that specific NQN. This ensures that only the authorized host can discover, connect to, and access its provisioned NVMe namespaces (volumes).

Here is why the other options are incorrect:

VLANs (A): Virtual LANs are used for network-level isolation and segmentation at Layer 2 of the OSI model. While you might use a VLAN to separate your storage traffic from your management traffic, it is a network security measure, not a device-level access control mechanism for the storage protocol itself.

LACP (C): Link Aggregation Control Protocol (LACP) is a network protocol used to bundle multiple physical network links into a single logical link for redundancy and increased bandwidth. It has nothing to do with storage access control or mapping volumes to hosts.

When physical links fail to establish—especially when using Direct Attach Copper (DAC) cables or Twinax—the most common culprit is a hardware compatibility mismatch. Pure Storage arrays have specific requirements for optics and cabling to ensure optimal signal integrity and performance.

The FlashArray Transceiver and Cable Support article (available on the Pure Storage Support portal) is the authoritative, verified resource for this scenario. It provides a comprehensive, constantly updated compatibility matrix detailing exactly which vendor DAC cables (e.g., Cisco, Brocade, Arista) and transceivers are officially validated and supported for use with specific FlashArray models and port types. If an unsupported DAC cable is used, the switch or host bus adapter (HBA) on the array might simply refuse to bring the link up.

Here is why the other options are incorrect for this specific issue:

The FlashArray User Guide (A): This guide is excellent for day-to-day administration (volume creation, host grouping, etc.) but is too broad to contain granular, constantly updating hardware compatibility matrices for specific cables.

The Port Usage and Definitions article (C): This document explains the logical and physical purpose of the ports on the back of the controllers (e.g., defining which ports are used for management, replication, or host connectivity), but it does not dictate hardware transceiver or cable interoperability.

Understanding the Audit Log: In Purity, accountability and security are maintained through the Audit Log . This log captures every administrative action taken on the array, whether through the GUI, CLI, or REST API. It records who performed the action, what the action was (e.g., volume creation, host deletion), and when it occurred.

The CLI Command: The command pureaudit list is the specific CLI tool used to display these logs. By default, it lists events in chronological order, making it the perfect tool for an administrator to review " shift change " activities.

Command Options: * pureaudit list can be filtered with flags like --user to see actions by a specific admin, or --start-time and --end-time to narrow down the " previous shift " window.

Why Option C is incorrect: puremessage (accessed via puremessage list) is used to view Alerts and Notifications generated by the system (e.g., a failed drive or a high-temperature warning). While it tells you what the array did, it does not track what users did.

Why Option A is incorrect: This is not a valid Purity command syntax. Purity does not use double-dashes to " pipe " or combine independent commands like pureaudit and puremessage in that manner.

As Pure Storage has iterated through FlashArray generations (moving from //X R2 to R3, R4, and beyond), the power density and performance capabilities of the controllers have increased significantly. Modern high-performance controllers, such as those found in the //X R4 or //XL series, have strict power requirements that often exceed what a standard 110V/120V (Low-Line) circuit can provide.

To support the higher wattage and current draw of modern CPUs and NVRAM modules, Pure Storage requires 200-240V (High-Line) power for its latest generation controllers. If an existing array is currently running on 110V power, it must be migrated to 220V power outlets before the upgrade can proceed. Attempting to run newer, high-spec controllers on 110V power could lead to power supply instability, insufficient cooling performance, or the controllers failing to boot entirely.

Here is why the other options are incorrect:

Call support to schedule a power supply replacement (A): The issue is not a faulty power supply; it is the external electrical infrastructure ' s inability to provide the necessary voltage/wattage for the new hardware. Replacing the power supply with the same model would not solve the voltage limitation.

Transition the array to DC power (B): While Pure Storage does offer DC power options for specific telco environments, this is not a standard requirement for a typical controller upgrade. Moving to standard high-line AC power (220V) is the standard prerequisite for data center environments.

In the Pure Storage ecosystem, " Meta fingerprinting " refers to the core technology behind Pure1 Meta , which is Pure ' s cloud-based artificial intelligence and machine learning engine. Pure1 collects thousands of data points of telemetry (metadata) from all connected FlashArrays globally every day.

By analyzing this vast amount of telemetry data, Pure1 Meta creates workload signatures or " fingerprints. " It then continuously compares your array ' s telemetry footprint against the global pool of arrays. The major benefit of this is that it enables predictive support . If Pure1 Meta detects that your array ' s fingerprint matches a known issue experienced by another array elsewhere in the world, Pure Storage can proactively alert you, open a support ticket, or recommend a Purity upgrade before you ever experience an outage or performance impact. It also uses these fingerprints for highly accurate capacity and performance forecasting.

Here is why the other options are incorrect:

Provides security for Remote Assist (RA) (A): Remote Assist allows Pure Support to log into your array for troubleshooting, but its security is based on a customer-initiated, secure outbound TLS connection (tunneling), not meta fingerprinting.

Ensures biometric security (B): This is a distractor. " Fingerprinting " in the context of Pure Storage refers to data and workload profiling, not human biometric authentication like physical fingerprint scanners.