Practice Free NCP-CI-AWS Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam Exam Questions Answers With Explanation

To allow wide open access to a particular NC2 AWS cluster from an on-premises subnet (10.19.160.0/24), the proper Custom Security Group formatting needs to include the necessary tags that specify the external cluster UUID and the networks allowed.

Custom Security Group Configuration:

The configuration should include tags to identify the cluster and the networks that should be granted access.

Key: nutanix:clusters

Key: nutanix:clusters:external

Value: < cluster-uuid >

Explanation of Choice:

Option Bincludes the necessary tags and values, ensuring that the specific cluster UUID is recognized and the on-premises subnet (10.19.160.0/24) can communicate with the NC2 cluster.

Security Group Tags:

nutanix:clusters:external- Identifies the cluster as external.

nutanix:clusters:external:cluster-uuid- Specifies the unique identifier for the cluster, enabling proper traffic routing and access.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Security Group Documentation

Nutanix Best Practices for Custom Security Group Configuration

To manually create an AWS VPC with Public access to Prism Element for testing purposes, the following components must be created:

VPC: A Virtual Private Cloud to provide an isolated network for the resources.

Delegated Subnets: Subnets within the VPC to segment the network and allocate IP ranges.

Route Tables: To define routing rules for the subnets to ensure proper traffic flow.

NAT Gateway: To enable instances in the private subnets to access the internet.

Internet Gateway: To allow direct internet access to instances in the public subnets.

Load Balancer: To distribute traffic across multiple instances for improved availability and redundancy.

Refer to the AWS documentation on VPC creation and Nutanix documentation on network setup for Prism Element access.

The role of " Customer Administrator " in Nutanix Cloud Integration with AWS (NC2) is designed to meet the requirements of creating and managing multiple organizations and clusters, as well as managing user access for the entire company.

Roles and Permissions:

Customer Administrator: This role has the broadest set of permissions, allowing the user to create and manage organizations, clusters, and user access across the entire company. It encompasses administrative control over multiple aspects of the NC2 environment.

Capabilities:

Organization Management: Ability to create and manage multiple organizations.

Cluster Management: Full control over creating, configuring, and managing clusters.

User Access Management: Manage user roles and permissions, ensuring that the right individuals have access to the necessary resources.

Why Not Other Roles:

Organization Administrator: Limited to managing organizations but not clusters and user access at the company level.

Customer Security Administrator: Focuses on security aspects, lacking broader administrative capabilities.

Cluster Administrator: Limited to managing clusters without the ability to manage organizations and user access comprehensively.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Role-Based Access Control Documentation

Migrating an existing NC2 cluster from native AWS networking to an overlay network (Flow Virtual Networking) requires careful coordination between the Nutanix software and the AWS environment. A primary prerequisite is ensuring thatExternal IPAMis correctly configured for the cloud subnets to manage the IP address lifecycle within the new overlay. Additionally, the administrator must ensure thatcorresponding cloud subnets are added in the Prism Element UI and mapped to the existing AWS subnets. This mapping is essential for the Nutanix Controller VMs (CVMs) and AHV hosts to properly encapsulate and route traffic between the virtual overlay and the physical AWS VPC infrastructure. Validating these configurations prevents IP conflicts and connectivity loss during the transition from standard VPC routing to the software-defined Geneve-encapsulated overlay.

When creating an NC2 cluster in AWS, the account used to run the CloudFormation script requires specific permissions to ensure the deployment is successful. The required permissions are:

IAMFullAccess: Provides full access to IAM resources.

AmazonEC2FullAccess: Allows full access to EC2 resources.

AWSCIoudFormationFullAccess: Grants full access to manage AWS CloudFormation stacks.

These permissions are necessary to create, manage, and deploy the required AWS resources for the NC2 cluster.

Nutanix Support and Insights

AWS IAM Documentation

The 192.168.5.0/24 range is often reserved for internal cluster communication within Nutanix deployments.

Using this CIDR range for other purposes could lead to network conflicts and connectivity issues, as it might interfere with the internal operations and communication channels of the Nutanix cluster.

Ensuring that the CIDR range is not overlapping with any reserved ranges is crucial for maintaining proper network connectivity and cluster functionality.

Refer to the Nutanix documentation on network configuration and best practices for NC2 deployments to confirm reserved IP ranges and their appropriate use.

During the NC2 cluster creation process, the administrator is presented with options for the licensing portfolio they wish to utilize. Nutanix has transitioned to theNCI (Nutanix Cloud Infrastructure)portfolio, but the legacyAOSportfolio is still available for certain customers. If the " AOS Licenses " option appears greyed out or unselectable, it is typically becausethe administrator did not select AOS in the licensing section of the NC2 Creation Wizard. The wizard requires an explicit choice early in the workflow to determine which features and software tiers (Pro, Ultimate, etc.) will be available for selection later. If the portfolio is not correctly identified at the start, the specific license keys or reservations associated with the legacy AOS model will not be recognized by the deployment engine, defaulting instead to the newer NCI-based consumption model.

When deploying Windows Server workloads on NC2 on AWS without existing licenses, administrators must carefully choose the tenancy and licensing model to remain compliant with Microsoft ' s cloud mobility rules. For a new deployment where " Bring Your Own License " (BYOL) is not an option due to the lack of existing licenses with Software Assurance, the administrator should select Shared Tenancy with License-included instances. This configuration ensures that the cost of the Windows OS is included in the hourly rate of the bare-metal instances provisioned by AWS. Although the question ' s source Answer (A) lists " BYOL, " standard Nutanix/AWS best practices for unlicensed environments dictate using License-included options on Shared Tenancy to provide the most cost-effective and compliant path for Windows-based virtual machines in the cloud.

In an NC2 heterogeneous cluster (mixing different host types), the ability to addAmazon EBS volumesfor supplemental storage capacity is governed by both host compatibility and cluster redundancy rules. First, the administrator must ensure that the selected host types actually support EBS attachment; if the current selection does not, they mustadd a host type that supports EBS volumes. Second, the cluster must maintain its Replication Factor (RF) integrity. If the number of nodes for a specific storage-heavy host type is not amultiple of the RF(e.g., needing 4 nodes for RF2), the system may restrict storage expansion to prevent data unavailability during a failure. By ensuring the node count aligns with RF requirements and using compatible bare-metal instances, the administrator can unlock the EBS volume configuration options within the deployment workflow.

The clusters that are to be protected must be registered with the same instance of Prism Central (Answer C):

For Cluster Protect to function correctly, all clusters intended for protection must be registered under the same Prism Central instance. This ensures consistent management and coordination of protection policies and operations across clusters.

The Cluster Protect feature requires AOS version 6.7 or higher (Answer D):

Cluster Protect is a feature that is available starting from AOS version 6.7. To utilize this feature, ensure that the Nutanix clusters are running this version or a newer one.

Nutanix Cluster Protection Documentation

Nutanix AOS Release Notes

Integrating Flow Virtual Networking (FVN) into an NC2 cluster necessitates the creation of specific management and transit subnets to coordinate the overlay traffic. The administrator must ensure that aPrism Central subnet is configured on the Prism Elementside to facilitate the management link between the cluster nodes and the centralized management instance. Additionally, aTransit subnet must be configured on Prism Central. This transit subnet is critical because it houses the virtual routing components and gateways that manage traffic flow between different VPCs and the external network. By establishing these two subnets, the administrator provides the necessary control plane and data plane paths for the FVN overlay to communicate effectively with the underlying AWS infrastructure and the broader Nutanix management ecosystem.

To create a CloudFormation stack, the AWSCloudFormationFullAccess role is required.

This role grants the necessary permissions to create, update, and delete CloudFormation stacks, which are essential for deploying and managing AWS infrastructure using CloudFormation templates.

CloudFormation stacks are often used to automate the deployment of complex infrastructures, including those required for NC2 on AWS.

Proper permissions ensure that the deployment process is seamless and adheres to the security and operational policies of the organization.

Refer to the AWS IAM documentation for details on the AWSCloudFormationFullAccess role and Nutanix documentation on prerequisites for deploying NC2 on AWS.

When selecting the NC2 subscription plan from the Nutanix Billing portal, the available options include:

Pay-as-you-Go (PayG): A flexible payment option where users are billed based on their actual usage, providing cost efficiency for variable workloads.

Bring your own License (BYOL): Allows users to utilize existing Nutanix licenses they have purchased, offering a cost-effective way to leverage existing investments in Nutanix software.

Refer to the Nutanix billing and subscription documentation for detailed descriptions of subscription plans and their benefits.

While NC2 bare-metal instances come with high-performance local NVMe storage, many organizations require additional capacity to support large data sets or long-term storage needs. For instance types that support Amazon EBS attachment, theminimum number of additional EBS volumesthat can be added per node is1. Adding even a single EBS volume allows the Nutanix cluster to expand its storage pool beyond the physical limitations of the bare-metal chassis. Administrators can then increase this capacity as needed, although once attached, these volumes typically cannot be removed or decreased. This flexibility is key for scaling storage-intensive applications without necessarily increasing the compute node count, thereby optimizing the overall TCO of the cloud cluster.

To deploy NC2 in AWS using an existing VPC, the following AWS resources should be configured beforehand:

NAT Gateway: This allows instances in the private subnet to connect to the internet or other AWS services, while preventing the internet from initiating connections with those instances.

Public and Private Subnets: These are necessary to segregate the network traffic. Public subnets provide a direct route to the internet gateway, while private subnets are used for internal resources that do not need direct access to the internet.

Nutanix Cloud Clusters on AWS Deployment Guide

Nutanix Support and Insights

For AOS software support related to NC2, the appropriate entity to contact is Nutanix. Nutanix provides comprehensive support for their software, including the Acropolis Operating System (AOS) used in NC2 deployments.

Support Scope:

Nutanix offers support for the deployment, configuration, and management of NC2 clusters, including any issues related to AOS software.

This includes troubleshooting, updates, and technical assistance.

Why Not Other Options:

Internal IT Operations team: Typically handles internal issues but does not have the specialized knowledge or resources for AOS software support.

Partner: May provide support but would ultimately escalate issues to Nutanix for software-specific concerns.

Public Cloud Vendor: Manages infrastructure-related issues but does not provide support for Nutanix AOS software.

Nutanix Support Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for AOS Support

Nutanix offers a free trial to allow organizations to test NC2 capabilities.

This trial is flexible; users can initiate a separate 30-day free trial for each supported cloud provider, such as AWS and Azure, allowing for independent evaluations of different cloud environments. It is important to note that the " free " aspect of the trial applies only to theNutanix software licensing. The user is still responsible for allAWS infrastructure costs(bare-metal instances, storage, and data transfer) incurred during the trial period. Additionally, users are not restricted to the trial alone; they can choose to activate aPay-As-You-Go (PAYG)subscription even while the free trial is active to ensure a smooth transition to production after the evaluation ends.

To avoid IP address conflicts and ensure there are no configuration issues when reusing an existing AWS subnet, the administrator should take the following actions:

aCLI > net.add_to_ip_blacklist 10.79.4.200 aCLI > net.add_to_ip_blacklist 10.79.4.201 (Answer A):

This command adds the specified IP addresses to the blacklist, preventing AHV IPAM from assigning these addresses to any VMs. This ensures that the existing EC2 instances with IPs 10.79.4.200 and 10.79.4.201 are not allocated to other VMs in the NC2 cluster.

Configure the AHV IPAM to use DHCP range 10.79.4.2 -10.79.4.253 (Answer D):

By configuring the AHV IPAM to use a specific DHCP range, you ensure that the IP addresses assigned to the EC2 instances (10.79.4.200 and 10.79.4.201) are not included in the DHCP pool. This prevents IP address conflicts within the subnet.

Nutanix aCLI Reference

Nutanix NC2 on AWS Documentation

AWS VPC and Subnet Basics

For VDI workloads that require GPU acceleration, the g4dn.metal nodes are the appropriate choice. These instances are equipped with NVIDIA T4 GPUs, which are well-suited for graphics-intensive applications such as VDI workloads that need GPU acceleration. Other node types like AN36P, m6g.metal, or AN36 do not provide the necessary GPU capabilities.

Nutanix Support and Insights - GPU support in AWS

In an NC2 environment using Flow Virtual Networking (FVN), the External Routable Prefix (ERP) is used to identify the address space that can reach external networks. If the ERP is correctly configured in both the Transit and User VPCs but outbound communication still fails, the issue typically lies within the virtual routing table. A static route (such as 0.0.0.0/0) must be manually added to the User VPC routing table with the next hop set to the overlay-external-subnet. Without this explicit static route, the virtual router within the User VPC does not know how to direct traffic toward the Transit VPC for outbound delivery, even if the address ranges are theoretically compatible. Verifying this routing path is a standard step in ensuring overlay workloads can reach on-premises or internet resources.

When deploying a new NC2 cluster on AWS, especially when moving to specialized hardware like EC2 dedicated hosts, two critical external factors must be verified: subscription status and AWS resource limits. First, the administrator must ensure that theNC2 subscriptionis active and has sufficient credits or a valid payment method to support the new deployment. Second, AWS imposes default limits on the number ofvCPUsand specific instance types that can be provisioned in a region. Since dedicated hosts consume a large number of vCPUs, the deployment will fail if the AWS account quota is exceeded. Verifying and, if necessary, requesting a quota increase from AWS is a mandatory step to ensure the underlying infrastructure is available for the Nutanix software.

ThePrism Central Marketplaceserves as the centralized hub for discovering, enabling, and managing various Nutanix services and integrated technologies. For administrators deploying NC2 on AWS, the Marketplace is the designated environment to verify the compatibility and support status ofMulticloud Snapshot Technology (MST). Within this interface, the system provides documentation and automated workflows that confirm the best installation process for the specific environment. This ensures that the required software versions and dependencies are met before attempting to protect workloads to cloud object storage like Amazon S3. Utilizing the Marketplace simplifies the " Day Two " operational tasks by providing a validated path for deployment rather than relying on manual configuration or external templates.

When planning to leverage NC2 on AWS for an elastic DR scenario where the initial cluster is using 13en.metal, the following additional node types are supported for cluster expansion:

I3.metal: These instances provide high IOPS and low latency with NVMe SSDs, making them suitable for storage-intensive applications.

i4i.metal: These instances offer higher performance with AWS Nitro SSDs, improved network bandwidth, and better compute performance compared to the I3.metal instances.

Nutanix Cloud Clusters on AWS Documentation

Amazon EC2 I4i Instances – AWS

Amazon EC2 I3 Instances – AWS

The exhibit indicates a replication operation with specific details about the protection domain, remote site, and snapshot. Key points to note are:

Bytes Completed: 0 bytes completed.

Complete Percent: 0.0%

Paused: false

Aborted: false

Given these details:

No ongoing replication: The operation has started, but there is no progress in terms of bytes completed or percentage completed. Since the status shows 0 bytes and 0 percent completed, it indicates that no data has been replicated yet.

Nutanix Protection Domain and Replication Documentation

Nutanix Best Practices for Monitoring Replication

Post-deployment, Nutanix provides flexibility in managing the software capabilities and licensing models of an NC2 cluster to adapt to changing workload requirements. Administrators canswitch the software tier from Pro to Ultimateto unlock advanced features such as synchronous replication, Nutanix Flow, and advanced security. Additionally, users can transition between different licensing portfolios, such asswitching from the NCI (Nutanix Cloud Infrastructure) portfolio to the legacy AOS portfolio, depending on their contract terms and desired consumption model. These changes are typically managed through the Nutanix portal and applied to the cluster without requiring a full redeployment of the bare-metal instances. However, it is important to note that switching tiers may result in changes to the billing rate or require additional license reservations to cover the upgraded feature set.

To add an AWS account to the NC2 console, an AWS IAM user needs to be configured with the appropriate permissions to manage the EC2 resources. The required permission for the IAM user includes full access to manage EC2 instances, volumes, and related resources.

AmazonEC2FullAccess:

This permission grants full access to all EC2 resources, including the ability to create, modify, and delete instances, volumes, security groups, and more.

Essential for NC2 operations to manage the lifecycle of EC2 instances and associated components within the AWS environment.

Why Not Other Permissions:

IAMFullAccess: Grants full access to IAM resources but not specifically needed for EC2 operations.

IAMReadOnlyAccess: Only provides read access to IAM resources, insufficient for managing EC2 instances.

AmazonEC2ReadOnlyAccess: Provides read-only access to EC2 resources, insufficient for creating or modifying instances and other resources.

AWS IAM Policies Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for IAM User Permissions

Nutanix Cloud Clusters (NC2) on AWS is designed to provide a " cloud-native " resilience experience, meaning it proactively manages the underlying hardware health.

If AWS issues a notification for aSystem Rebootor a hardware-related event on a bare-metal instance, the NC2 console does not simply wait for the reboot to occur. To maintain cluster availability and avoid potential data integrity issues during an uncontrolled hardware event, NC2 triggers anautomated host replacement. The system will provision a new bare-metal instance, integrate it into the cluster, and migrate the data and workloads (using High Availability if necessary) away from the degraded or scheduled-to-reboot host. This automation ensures that the Nutanix cluster remains healthy and functional despite the ephemeral nature of cloud infrastructure hardware.

When connectivity is required between two separate AWS VPCs—one hosting native EC2 instances and the other hosting an NC2 cluster—and advanced overlay networking (FVN) is not in use, the most straightforward solution is VPC Peering. Configuring VPC Peering in Amazon Web Services allows for the routing of traffic between the two VPCs using private IP addresses as if they were on the same network. This method requires the least administrative effort because it does not require the deployment of new software overlays like FVN or the management of a complex Transit Gateway. Administrators simply need to establish the peering connection and update the route tables in both VPCs to allow traffic to flow between the respective CIDR ranges, providing secure, high-performance connectivity.

To manage outbound traffic and prevent unfiltered internet access without deploying a dedicated firewall appliance, administrators can leverage aProxy Server. WhenFlow Virtual Networking (FVN)is implemented, it allows for sophisticated routing and encapsulation that can be integrated with an AWS Proxy server. This configuration forces all traffic exiting the Nutanix User VPCs to pass through the proxy for inspection and filtering based on corporate security policies. This setup is particularly effective for clusters requiring AOS updates or access to specific Nutanix cloud endpoints while maintaining a " locked-down " posture for User VMs. It provides an administrative chokepoint for traffic without the complexity of managing third-party firewall rules or NAT Gateway filters.

AHV Metro Availability provides a synchronous replication solution for zero-RPO disaster recovery.

For this to function correctly within an NC2 on AWS environment, the clusters must be architected to survive anAvailability Zone (AZ)failure while maintaining the extremely low latency required for synchronous operations. The supported configurations include havingtwo NC2 clusters running in the same AWS region but in different AZs, ensuring that if one zone goes offline, the other can immediately take over. Additionally, asingle-node NC2 clustercan be used as a target in a different AZ within the same region for specific low-footprint synchronous requirements. Deploying across different regions is not suitable for Metro Availability due to the high latency of inter-region traffic, which would exceed the requirements for synchronous data writes.

NC2 on AWS allows for the dynamic addition ofAmazon EBS volumesto bare-metal nodes to expand the cluster ' s storage capacity beyond the local NVMe drives. According to Nutanix architectural guidelines, once these EBS volumes are attached and integrated into the storage pool, the capacitycan only be increased. Reducing the storage capacity by removing or shrinking attached EBS volumes is not a supported operation because it would risk data loss and disrupt the Distributed Storage Fabric (DSF) which expects consistent disk availability. Therefore, administrators should carefully size their initial EBS requirements, knowing that they can scale up to meet demand but cannot scale back the capacity of individual existing volumes without a complex data migration or cluster redeployment.

The maximum number of nodes supported in an NC2 cluster on AWS is 24 nodes. This limit ensures optimal performance and manageability within the AWS infrastructure while leveraging the benefits of the Nutanix architecture.

Nutanix Clusters on AWS Deployment Guide

Nutanix Support and Insights

Nutanix provides a flexible licensing model for NC2, allowing customers to use their existingon-premises licensesthrough reservation. A key benefit of this approach is thatreserved licensed capacity automatically handles incidental overages. If a cluster temporarily scales out and exceeds the reserved capacity, the Nutanix billing system accounts for the excess usage automatically, typically by drawing from the associated Pay-As-You-Go (PAYG) account or consumption credits. This ensures that the cluster remains operational and compliant even during unexpected spikes in demand. Administrators can manage these reservations through the Nutanix portal, allowing them to balance their committed on-premises license spend with the variable needs of their cloud-resident clusters.

To ensure that only application servers from the source subnet 10.79.1.0/24 can access the SQL databases running on the NC2 cluster in the subnet 10.78.1.0/24, the administrator can take the following actions:

Option A: Create a custom Security Group with the following rules:

Key = tag:nutanix:clusters

Key = tag:nutanix:clusters:external

and value = the clusters ' UUID

Key = tag:nutanix:clusters:external

and value = 10.78.1.0/24

Option D: Create a custom Security Group with the following:

Key = nutanix:clusters

Key = nutanix:clusters:external

and value = the clusters ' UUID

Key = nutanix:clusters:external

and value = 10.79.1.0/24

These actions help create security rules that restrict access to the databases only from the specified source subnet, ensuring secure and controlled access.

Nutanix Cloud Clusters on AWS Administration

AWS Security Groups Documentation

In an NC2 environment using Flow Virtual Networking (FVN), routing traffic between the AWS cloud and on-premises environments requires specific configuration of the Transit VPC and User VPCs.

To ensure that traffic reaching the on-premises environment is not subjected to Network Address Translation (NAT)—which would obscure the original IP addresses and potentially break connectivity for certain applications—the routing tables must point to the correct internal gateway interface. Theoverlay-external-subnet-nonatacts as the designated gateway for traffic that should be routed without address translation. Verifying that the " Next Hop " for on-premises prefixes is set to this specific subnet ensures that internal communication remains transparent and complies with standard corporate networking and security policies.

Cluster Protect in an NC2 environment can protect and recover the following services and their associated metadata:

VM Templates: Ensures that templates used for creating virtual machines are backed up and recoverable.

Files: Protects data stored in Nutanix Files, ensuring that file services are backed up and can be restored as needed.

Nutanix Support and Insights

Nutanix Cloud Clusters on AWS Administration

To SSH into a Controller VM (CVM) in an NC2 on AWS cluster without on-premises connectivity, the administrator needs to ensure that the security settings allow SSH access from the Jump Host. This involves editing the User Management Network Security Group to permit SSH traffic from the Jump Host IP.

Deploy Jump Host:

Ensure the Jump Host is deployed in a public subnet with an Elastic IP (EIP) assigned for external access.

Edit User Management Network Security Group:

Locate the security group associated with the user management network.

Modify the inbound rules to allow SSH (port 22) from the Jump Host ' s IP address. This ensures that the Jump Host can establish an SSH connection to the CVM.

Steps to Edit Security Group:

Navigate to the EC2 dashboard in the AWS Management Console.

Select " Security Groups " under the " Network and Security " section.

Find and select the appropriate security group.

Edit the inbound rules to add a new rule:

Type: SSH

Protocol: TCP

Port Range: 22

Source: Custom IP (enter the Jump Host ' s public IP address)

Additional Configuration:

Ensure that the CVM itself allows SSH connections and that no internal firewall rules block the traffic.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Security Group Documentation

Nutanix Best Practices for Secure Access