NCP-BC-7.5 Nutanix Certified Professional - Business Continuity (NCP-BC) 7.5 Questions and Answers

Troubleshooting replication failures requires analyzing the relationship between snapshot creation and data transfer. In this scenario, the failure occurs during the snapshot creation phase rather than during the transfer of data across the wire. While network spikes and I/O timeouts are noted (Option D), these are often symptoms rather than the root cause when the specific failure point is the snapshot itself .

If multiple replication jobs or protection policies are scheduled to run at the exact same time, the cluster may experience " snapshot contention " or metadata locks. When schedules overlap significantly, the overhead on the Controller VMs (CVMs) can lead to the observed I/O timeout errors in the guest OS as the system struggles to quiesce applications and freeze the filesystem multiple times in quick succession. This is particularly common in environments with high data change rates where the previous replication cycle has not finished before the next one begins. Since storage is sufficient (Option B) and the clusters are compatible (Option E), the most logical cause is schedule misconfiguration. To resolve this, the administrator should stagger the start times of protection policies or combine multiple VMs into a single, unified policy to ensure that the Nutanix snapshot engine can process the requests sequentially without causing the resource exhaustion that leads to job failure.

Testing is the most vital component of a resilient BCDR strategy, as it proves that recovery objectives (RTO/RPO) are achievable before a real emergency occurs. The Nutanix " Test Failover " feature is purpose-built for this requirement. Unlike a Planned Failover (which shuts down production) or an Unplanned Failover (which assumes production is dead), a Test Failover performs a non-disruptive validation.

During a Test Failover, the orchestration engine uses the most recent snapshots to power on VMs at the destination cluster. To satisfy the " without impacting production " requirement, the test VMs are typically attached to an " Isolated " or " Test " network segment that has no route to the live production network. This prevents IP address conflicts and service interference while allowing the administrator to log into the recovered VMs and verify that applications start correctly. Simple " Validation " (Option A) only checks the configuration settings and connectivity but does not actually test the power-on sequence or application logic. By executing a full Test Failover, the organization gains documented proof of its DR readiness, identifying potential issues like missing dependencies or incorrect boot orders without causing any disruption to the users currently accessing the primary site.

The Nutanix Cerebro service manages replication by scheduling snapshots and transferring the delta changes to the remote site. In an asynchronous replication schedule, if a new snapshot is taken before the previous one has finished replicating, the system faces a choice. To ensure that the most current data is available at the recovery site as quickly as possible, Nutanix may " skip " the replication of an older pending snapshot in favor of starting the replication of the newest one.

In this scenario, all infrastructure components (bandwidth, ports, hardware) are verified as healthy and have supported successful replication for months. This points toward a data-level issue rather than a connectivity issue. A " significant one-time surge in change rate " (Option D) means the VM generated a massive amount of new data blocks (churn) in a short period. Because the " Snapshot-on-wire " transfer size is directly tied to the number of changed blocks, this specific snapshot would take much longer than usual to replicate. If the transfer time exceeds the RPO interval, the next scheduled snapshot will trigger. The Cerebro service will see that it has a newer recovery point ready to go and will skip the " stuck " or slow-moving older snapshot to maintain the most recent RPO possible at the target. This behavior generates the " Replication was skipped " warning to notify the administrator that the historical sequence was interrupted due to a temporary imbalance between data churn and available throughput.

IP address management (IPAM) in Nutanix networks ensures that IP assignments are tracked to prevent conflicts. When a Recovery Plan is validated, the orchestrator checks if it can successfully assign the required IPs at the recovery site. The warning occurs when the system detects a potential conflict or cannot automatically " guarantee " the preservation of a static IP, often due to overlapping pools or the way IPAM is configured on the destination subnet.

To resolve this without changing the VM ' s assigned IP, the administrator should use " Custom VM IP Mapping " . This feature allows the administrator to override the default automatic assignment and explicitly state which IP the VM must receive at the recovery site. By manually defining this mapping, the administrator " claims " the IP within the Recovery Plan ' s logic, satisfying the validation check and ensuring that the VM boots with its correct identity during a failover. Disabling IPAM (Option A) is often not feasible in production environments, and adding a vNIC (Option B) complicates the VM ' s OS configuration. Custom IP mapping is the purpose-built administrative tool for resolving IP assignment ambiguity and ensuring predictable recovery in complex, IPAM-enabled networking environments.

A multisite deployment in Nutanix Disaster Recovery allows a single primary cluster to replicate its workloads to multiple destination availability zones (AZs) for increased resilience. While a single " Protection Policy " can define the replication schedules to both recovery sites, the " Recovery Plan " is the separate object responsible for the actual orchestration of the failover.

A Recovery Plan is fundamentally a point-to-point object; it defines how to move workloads from Site A to Site B. If an administrator wants the ability to failover to either of two different recovery AZs, they must create two distinct Recovery Plans: one for AZ1 and another for AZ2. Each plan will contain the site-specific network mappings, boot sequences, and IP mappings relevant to that specific destination. If the administrator has only created a recovery plan for the first AZ, they will be able to see recovery points at both locations but will only have a " target " defined for the first site. The second AZ will not appear as a valid destination in the failover menu until its specific Recovery Plan is built and validated. This modular design ensures that each DR site can have its own customized networking and application orchestration logic.

In Nutanix Protection Domains, the relationship between a virtual machine and a snapshot is tied to the metadata at the time the snapshot was created . When an administrator removes a VM from a PD (Option B), the cluster stops taking new snapshots, but the historical snapshots (recovery points) remain in the storage system until their retention period expires .

If a disaster or corruption occurs (Option Wednesday), the administrator can still use those historical snapshots to perform a " Revert " operation. The Nutanix AOS engine can successfully roll back the VM ' s vDisks to the Monday state because the data exists. However, the " Revert " operation only impacts the data on the disks; it does not re-establish the logical configuration of the Protection Domain. Because the VM was explicitly removed from the PD on Tuesday, the system treats it as an " unprotected " VM after the restore is finished. It will not be included in the next scheduled snapshot cycle of PD_Production. To resume ongoing protection, the administrator must manually add the Inventory-VM back into the PD_Production Protection Domain. This scenario illustrates a critical operational point: restoring data does not automatically restore the protection schedule, and administrators must verify the " Protection Status " of VMs following any manual recovery task to ensure they are not left vulnerable to future failures.

Nutanix Disaster Recovery to the Cloud is built on the principle of automation and resource optimization. When a failover to a Nutanix Cloud Availability Zone (AZ) occurs, the orchestration engine can dynamically provision virtual networks to ensure recovered VMs have immediate connectivity. These networks are temporary infrastructure components required only while the workloads are running in the cloud. Once the primary on-premises site is restored and a failback is successfully executed, the VMs are migrated back to their original home. At this point, the dynamically created virtual networks at the cloud recovery site no longer host any active entities. The Nutanix orchestration engine is designed to automatically clean up these ephemeral resources (Option B) to prevent " infrastructure sprawl " and to ensure the customer is not billed for unused networking components in the cloud. This automated cleanup is a core feature of the Nutanix Cloud AZ workflow, allowing administrators to focus on stabilizing production rather than performing manual housekeeping tasks on the recovery site. This cycle of dynamic provisioning and automated cleanup ensures that the DR environment is always " right-sized " and ready for the next event.

In the Nutanix Disaster Recovery orchestration workflow, Network Mapping is a critical step that tells the system which production VLAN at the primary site corresponds to which VLAN at the recovery site. This ensures that when a VM is recovered, its virtual NIC (vNIC) is " plugged in " to a functional and valid network at the new location.

If an administrator leaves the Network Mapping section blank, the Nutanix orchestrator has no information about where to connect the VM ' s network interface. In this scenario, the priority of the system is to ensure the VM can boot and start its services without causing a " network storm " or security risk. If the system were to simply attach the VM to a random or default network, it could cause IP address conflicts or expose the VM to the wrong security zone. Therefore, the built-in behavior for a failover without a valid mapping is to recover the VM with all its network adapters in a " disconnected " state. The vNIC still exists on the VM, but the " connected " checkbox in the hypervisor is unchecked. This explains why the application owners report that the VMs are " isolated. " To fix this, the administrator must either update the Recovery Plan with the correct mappings and re-run the task or manually connect each VM ' s vNIC to the correct local VLAN in the recovery site ' s Prism interface.

In a Business Continuity strategy, " downtime " can be categorized as either unexpected (disaster) or controlled (maintenance). When an administrator knows that a disruption is coming, such as scheduled network maintenance on a primary cluster, they should utilize the " Planned Failover " mechanism within the Nutanix Recovery Plan.

A Planned Failover is a graceful, orchestrated migration. It first shuts down the virtual machines at the primary site to ensure all data is flushed and no new writes occur. It then performs a final synchronization to the recovery site to ensure zero data loss (Zero RPO), and finally powers the VMs on at the destination site according to the plan ' s sequence. This differs significantly from an " Unplanned Failover " (Option A), which assumes the primary site is already offline and may result in minor data loss depending on the last successful replication. A " Test Failover " (Option D) merely validates the process in an isolated environment and does not move the actual production workload. By executing a Planned Failover before the maintenance begins, the administrator ensures that the services are safely running on the target cluster, maintaining application availability and meeting the objective of zero downtime during the maintenance window.

In a Nutanix legacy Protection Domain (PD) configuration, three primary elements must be in place for data protection to occur: the entities (VMs), the remote site (destination), and the schedule. Even if a VM has been added to a Protection Domain (negating Option A), the cluster will not take any action unless it is explicitly told " when " and " how often " to do so.

If no new snapshots are being created locally and replication is not starting, the most likely issue is that no " Schedule " has been configured for that Protection Domain. The schedule defines the RPO (e.g., hourly, daily) and the retention period for the snapshots. Without an active schedule, the Cerebro service simply has no instruction to initiate the snapshot process. While a missing vStore mapping (Option C) would cause the " replication " to fail, the " local snapshots " would still be created in the PD. Similarly, low bandwidth throttling (Option D) would cause the replication to move slowly or time out, but it would not prevent the initial creation of the local recovery points. Therefore, verifying the presence of a valid, active replication schedule is the mandatory first step for an administrator when a Protection Domain appears to be " idle " despite having VMs assigned to it.

Replication between Nutanix clusters involves the transfer of both actual data blocks and the metadata required to manage the consistency and scheduling of those snapshots. Two specific services running on the Controller VMs (CVMs) are responsible for these tasks: Stargate and Cerebro.

Port TCP 2009 is used by the Stargate service. Stargate is the primary I/O manager for the Nutanix cluster, and in a BCDR context, it handles the " Snapshot-on-wire " data transfer. This is the port where the actual bits of the virtual disks are sent from the source cluster to the destination cluster. Port TCP 2020 is used by the Cerebro service. Cerebro is the replication engine that handles protection domain orchestration, snapshot scheduling, and cross-site handshake operations. Without port 2020, the clusters cannot synchronize their schedules or confirm that a recovery point has been successfully stored at the remote site. While other ports like 9440 (Prism management) and 22 (SSH) are used for administrative tasks, ports 2009 and 2020 are the mandatory " data path " and " control path " ports required for the continuous and successful replication of workloads between availability zones.

Nutanix Cloud Clusters (NC2) on AWS or Azure allows for flexible disaster recovery models, including " Pilot Light " and " Zero Compute " . " Zero Compute " is a cost-effective model where data is replicated to cloud storage (like S3 or Azure Blob) without needing a running cluster at the recovery site. Multi-Site Tooling (MST) or Nutanix Disaster Recovery orchestration can be used to manage this process.

In a " Zero Compute " setup, the orchestration of an automated failover is technically complex because there is no active cluster management plane at the recovery site until the failover is triggered. A key technical requirement for successful automated failover in this model is the management of networking and IP addresses. Because the VMs are being brought up in a cloud environment that likely has a different network subnet than the on-premises environment, the system must be able to dynamically assign and manage IP addresses. Therefore, configuring an external IPAM (IP Address Management) system is a strict requirement to ensure that when VMs are restored, they receive valid networking configurations that allow them to communicate with external users and other services. Without a properly configured IPAM and network mapping in the Recovery Plan, the restored workloads would be isolated and non-functional. This highlights the need for careful network planning when designing DR strategies that utilize cloud-native storage and on-demand compute resources.

Volume Groups (VGs) are used in Nutanix to provide block storage to virtual machines, often for high-performance applications like SQL Server. VGs can be attached to VMs in two ways: " In-guest " (using iSCSI initiators) or " Hypervisor-attached " (where the hypervisor handles the connection).

In a disaster recovery scenario managed by Recovery Plans, there is a technical distinction in how these attachments are handled. While Nutanix Disaster Recovery can replicate the data in the Volume Groups and recover the VM itself, VGs that are " hypervisor-attached " do not currently support automatic reattachment as part of the orchestration workflow in all AOS versions. When the failover completes, the VM powers on at the recovery site, but the VGs are not connected to the VM at the hypervisor level. This causes the application (SQL) to find its data disks missing, resulting in the database staying offline. To resolve this, the administrator must manually reattach the Volume Groups to the VM at the recovery site using the Prism interface or a script. This limitation highlights the need to verify specific application storage configurations during DR testing. For automated recovery of VGs, using " In-guest " iSCSI attachments is often preferred because the iSCSI initiator within the guest OS can re-establish the connection to the new cluster ' s Data Services IP once the network is active.

Single Root I/O Virtualization (SR-IOV) allows a virtual machine to bypass the hypervisor ' s virtual switch and communicate directly with a physical network adapter ' s virtual functions. This is commonly used for high-performance applications that require extremely low latency and high throughput. However, SR-IOV creates a " hard " dependency between the virtual machine and the specific physical hardware (NIC) of the host it is running on.

Disaster Recovery involves moving a VM to an entirely different cluster, which likely has different physical network adapters or a different SR-IOV configuration. Nutanix Disaster Recovery orchestration is designed to ensure that VMs can always boot at the recovery site, even if specialized hardware resources are unavailable. For VMs configured with SR-IOV, the recovery process includes a built-in fallback mechanism. During failover, the system will recover the VM and power it on, but it will disable the SR-IOV attachment. To ensure connectivity, it automatically adds or falls back to a standard virtio-net virtual adapter. This allows the VM to have network access immediately, though at a potentially lower performance level. The administrator must then manually re-configure SR-IOV at the recovery site if the local hardware supports it. This design prioritizes service availability (powering on and communicating) over specialized hardware performance during a disaster recovery event.

Nutanix 2-node clusters are often used in small remote office (ROBO) environments to provide high availability with a smaller hardware footprint. However, the reduced node count introduces specific limitations on advanced data protection features compared to standard 3-node or larger clusters.

One of the key limitations of a 2-node cluster is the support for high-frequency replication. Technologies like NearSync (which provides RPOs from 1 to 15 minutes) and Synchronous replication (0 RPO) require a minimum of three nodes to manage the necessary metadata overhead, storage consistency, and lightweight snapshot (LWS) engine requirements. In a 2-node cluster, the system is restricted to using standard Asynchronous replication. The minimum RPO supported for standard Asynchronous replication in these small cluster configurations is typically 1 hour (60 minutes). An administrator attempting to set a more aggressive RPO will find that the system does not support the necessary lightweight snapshot infrastructure. Therefore, while a 2-node cluster provides excellent local availability, its off-site disaster recovery capability is limited to a 1-hour RPO, which should be considered during the initial architectural design and risk assessment phase for critical workloads.

Storage consumption in a BCDR environment is directly governed by two factors: the frequency of recovery points (RPO) and the length of time those points are kept (Retention). When a third-party backup solution integrates with Nutanix Protection Policies, it often takes over the management of the snapshot lifecycle.

If storage utilization is increasing unexpectedly at both sites, the most likely cause is that recovery points are not being expired or purged at the expected rate. The administrator should first review the retention settings within the backup solution. If the retention period is set too long, or if the backup software is failing to send the " delete " command to Prism after its local catalog is updated, snapshots will accumulate on both the primary and recovery Nutanix clusters, leading to a steady growth in storage consumption. Other factors like network segmentation (Option C) or encryption (Option B) affect traffic paths and security but do not directly influence the quantity of data stored on the disks. Recovery validation (Option A) might use temporary storage but should not cause a continuous, long-term increase. Therefore, aligning the retention policy of the backup software with the available cluster capacity is the primary troubleshooting step.

The Recovery Point Objective (RPO) is a measure of how much data an organization can afford to lose during an outage. An RPO of zero means that absolutely no data loss is tolerated; every write performed at the primary site must be safely committed to the recovery site before the application receives a confirmation. In the Nutanix portfolio, Synchronous Replication (Option A) is the only technology that guarantees this level of data protection. It mirrors every write in real-time between two clusters, ensuring they are always in perfect synchronization. In contrast, Nearsync Replication (Option B) allows for very low RPOs (as low as 20 seconds to 1 minute), but it is still fundamentally an asynchronous process using lightweight snapshots, meaning some " data-in-flight " could be lost. Async Replication (Option C) typically involves RPOs of one hour or more and is used for less critical workloads. Cloud Connect (Option D) is a legacy feature for off-site backup and does not support zero-RPO requirements. Synchronous Replication is the " gold standard " for Tier-1, mission-critical applications where data integrity and zero loss are the primary business requirements, provided the network latency between sites is 5ms or less.

Self-Service Restore (SSR) is a Nutanix feature that allows end-users to recover individual files by mounting a recovery point as a local drive within the guest VM. NearSync replication provides high-frequency protection with Recovery Point Objectives (RPOs) as low as 1 minute using Lightweight Snapshots (LWS). However, there is a technical distinction in how these high-frequency points are handled for end-user recovery.

In a NearSync configuration, the system generates dozens of LWS throughout an hour. While these are available for full VM disaster recovery, Nutanix limits the " granularity " available for Self-Service Restore to manage metadata overhead and guest agent performance. By default, SSR in a NearSync environment typically supports recovery point intervals of 1 hour. This means that while an administrator can restore the entire VM to a state from 5 minutes ago, an end-user using the SSR browser inside the VM will see recovery points at 1-hour increments (the " consolidated " points). This design balances the need for high-frequency disaster protection with the operational efficiency of file-level recovery. If a user needs a file from a point between the hourly intervals, an administrator may need to perform a full VM clone or an " Out-of-place " restore to provide access to those more granular lightweight recovery points.

Nutanix Guest Tools (NGT) is a software bundle that must be installed on the guest virtual machine (VM) to enable advanced management and data protection features within the Nutanix ecosystem. For the specific functionality of Self-Service Restore (SSR), NGT provides the necessary communication drivers and the Nutanix SSR agent. This agent allows end-users or administrators to mount recovery point snapshots as local drives directly within the guest operating system. Without NGT, the cluster lacks the specialized hooks into the guest OS required to perform granular file-level recovery without restoring the entire VM. Furthermore, NGT facilitates the creation of application-consistent snapshots by interacting with the Windows Volume Shadow Copy Service (VSS), which is often a prerequisite for high-integrity backups of Tier-1 applications like SQL Server or Exchange. By installing NGT, the VM is granted the intelligence to browse and attach historical vDisks, effectively enabling the SSR workflow and reducing the operational burden on the infrastructure team for simple file recovery requests.

Nutanix Disaster Recovery offers several replication tiers to meet varying business Recovery Point Objectives (RPOs). NearSync replication is a specific technology designed to fill the gap between traditional Asynchronous replication and zero-RPO Synchronous replication.

NearSync replication supports a minimum RPO of 1 minute. It achieves this by using Lightweight Snapshots (LWS), which are highly efficient and can be taken much more frequently than standard full snapshots without causing significant I/O overhead on the system. While some versions of Nutanix software allow NearSync to reach RPOs as low as 20 seconds, the standard minimum RPO recognized in the context of the NCP-BC 7.5 evaluation for minutes-based intervals is 1 minute. Option A (0 RPO) is only achievable through Synchronous replication. Option C (15 minutes) is the typical maximum RPO for NearSync before it transitions to Async, and Option D (60 minutes) is the standard interval for Asynchronous replication. Understanding these thresholds is essential for administrators when designing protection policies for mission-critical workloads.

Transitioning from legacy Protection Domains (which are cluster-centric) to modern Prism Central-based Protection Policies (which are management-plane centric) is a common task during Nutanix environment upgrades. This migration involves a " handoff " where the responsibility for snapshots and replication shifts from the local Cerebro service on the cluster to the global orchestration provided by Prism Central.

The primary risk during this migration is the creation of a " protection gap. " If an administrator deletes the legacy snapshots immediately after assigning a new policy, and that new policy has not yet successfully completed its first replication cycle, the virtual machine is effectively unprotected. If a disaster occurs at that exact moment, there would be no valid recovery points at the destination site to restore from. Nutanix best practice dictates that legacy artifacts must be preserved until the new system is verified as operational. Once the first recovery point for the VM appears in the Prism Central " Recovery Points " tab, it confirms that the new Protection Policy has successfully captured the VM ' s state and replicated it to the recovery AZ. At this stage, the legacy snapshots in the Protection Domain become redundant and can be safely deleted to reclaim storage space without compromising the organization ' s ability to meet its Recovery Point Objective (RPO) and Recovery Time Objective (RTO).

Nutanix NearSync replication provides low RPOs (1 to 15 minutes) by using " Lightweight Snapshots " (LWS). NearSync has higher performance and hardware requirements than standard Asynchronous replication because it must handle metadata operations and data transfers much more frequently.

For a cluster to support NearSync, it must have sufficient high-performance storage to handle the additional I/O load associated with LWS. On hybrid nodes (those with both SSDs and HDDs), Nutanix has a specific hardware requirement: each node must have at least two SSDs. This is because the NearSync LWS metadata and incoming replicated data are initially written to the SSD tier to ensure low latency and high throughput. A single SSD per node is typically insufficient to handle both active VM production I/O and the high-frequency NearSync overhead without performance degradation. Therefore, adding a second SSD to each node (Option D) is the mandatory modification. While upgrading to NVMe (Option A) or adding more nodes (Option B) would also improve performance, adding a second SSD is the minimum " cost-effective " requirement specified by Nutanix engineering for NearSync support on hybrid clusters. Meeting these hardware prerequisites is essential to ensure that the cluster can maintain the 15-minute RPO without transitioning back to an hourly schedule due to resource constraints.

Post-failover cleanup is a vital operational step to ensure that the environment remains optimized and that resources are not being wasted on workloads that are no longer part of the production environment. When virtual machines are removed from a Protection Policy after a failover, the orchestration engine stops creating new recovery points for them; however, the existing schedule metadata and historical snapshots may still consume space on both the primary and recovery clusters. Reconfiguring the replication schedule (Option B) is the specific task that refreshes the policy ' s state and forces the system to re-evaluate the storage requirements for the remaining entities. This action ensures that the background cleanup processes (managed by Cerebro and Curator) can properly identify and purge the snapshots associated with the removed VMs once their retention period has passed. Failing to reconfigure the schedule or the associated protection policy can leave " orphaned " snapshots in the storage tier, leading to a steady increase in storage utilization over time. By reconfiguring the schedule, the administrator confirms the new steady-state of the DR environment, ensuring that storage is only consumed by the active, required workloads.

Network segmentation in a Nutanix cluster allows for the physical or logical isolation of different types of traffic (management, storage, and backplane). When applied to Disaster Recovery, it allows an administrator to dedicate a specific network interface (typically ntnx0) and a dedicated subnet for replication traffic, ensuring it does not contend with VM or management traffic for bandwidth.

However, Disaster Recovery is a site-to-site operation that requires a symmetric network configuration. If an administrator enables segmentation on the primary cluster, the Cerebro service at that site will now attempt to originate and receive all replication traffic on the newly defined segmented IP addresses. If the recovery cluster is still in its original " brownfield " state without segmentation, it will be looking for traffic on its management IP addresses (on eth0). This creates a mismatch where the two sites are effectively " speaking different languages " or looking for each other on the wrong networks. Nutanix does not automatically propagate segmentation settings between clusters because each site may have different physical network topologies or VLAN requirements. Therefore, the administrator must manually enable and configure network segmentation on the recovery cluster to match the primary. Only when both sites have consistent segmented interfaces and the routing/firewall rules are updated to allow communication between these new subnets will the replication link be restored and functional.

To achieve the goal of " minimal downtime " and " no user intervention, " a zero-RPO solution with automated failover capabilities is required. In the Nutanix ecosystem, this is accomplished through Synchronous Replication. Unlike Asynchronous or NearSync replication, which rely on snapshot intervals and manual failover triggers, Synchronous replication ensures that data is written to both the local and remote clusters simultaneously. This architecture provides the foundation for zero data loss during a site failure.

However, the " automatic " part of the requirement is fulfilled by the addition of a Witness VM. Without a Witness, a secondary cluster cannot independently determine if the primary cluster has actually failed or if there is merely a network partition. In a " no witness " scenario (Option C), the secondary cluster stays in a passive state to prevent " split-brain " data corruption, requiring an administrator to manually promote the storage. By deploying a Witness VM at a third, independent site, the secondary cluster can communicate with the Witness to " acquire the lock " on the protection domain. Once the Witness confirms the primary site is unreachable, the orchestrator automatically promotes the secondary container and powers on the VMs. This combined solution of a Synchronous Protection Policy and a Witness VM provides the highest level of availability and the fastest possible recovery without requiring human action during the disaster event.

Security and compliance are critical components of a Business Continuity strategy, particularly regarding the integrity of backups and snapshots. To prevent accidental or malicious deletion of critical recovery points, Nutanix Prism Central allows administrators to configure " Approval Policies " . These policies enforce a " four-eyes " principle where certain high-risk actions require validation by a second authorized user.

When an Approval Policy is active for DR snapshots, and a user attempts a deletion, the system does not execute the command immediately. Instead, the Nutanix orchestration engine captures the request and creates a " Pending Approval " task. The user who initiated the request will see the status update in the Task console, and an notification is sent to the designated " Approvers " . The snapshot remains fully protected and available for recovery until an authorized approver reviews and explicitly grants permission for the deletion. This mechanism provides a vital layer of defense against ransomware or administrative errors that could otherwise lead to the loss of a known-good recovery state. By integrating approval workflows into the storage management layer, Nutanix ensures that data destruction is a deliberate and verified process, meeting the strict control requirements of modern enterprises.

In a Nutanix Synchronous Replication or Metro Availability setup, data is mirrored in real-time, but the " intelligence " required to automate a failover resides outside of the two primary clusters. Without a Witness VM (Option C), the secondary cluster cannot distinguish between a total primary site failure and a simple network partition between the two data centers. If the clusters lose communication but there is no Witness to act as an independent tie-breaker, the secondary cluster will stay in a " Standby " state and will not automatically " promote " its storage to " Active " or power on the VMs. This is a safety mechanism to prevent " split-brain " where two clusters might try to serve the same data, leading to corruption. To enable automatic failover, a Witness VM must be deployed at a third, independent site and registered to both clusters. The Witness allows the secondary site to verify that the primary site has indeed failed; once verified, the Witness grants the " lock " to the secondary site, allowing the automated failover process to begin. Thus, the lack of a Witness is the " most likely cause " for why a failover test would fail to trigger automatically during a storage or site outage.

Disaster recovery orchestration in the Nutanix environment often involves the pairing of two separate Availability Zones (AZs), each managed by its own Prism Central instance. For these two management planes to communicate, exchange metadata, and synchronize Protection Policies and Recovery Plans, specific firewall ports must be open between them.

Port 9440 is the standard port used for all Prism Central and Prism Element web interface and API traffic. During the AZ pairing process, the primary Prism Central must reach the recovery Prism Central ' s API to establish the trust relationship and pair the sites. Other ports mentioned, such as 2009 (Option A) and 2020 (Option B), are used for data replication between Controller VMs (CVMs) but are not used for the initial management-plane pairing between Prism Central instances. Port 2074 (Option C) is typically used for Nutanix Guest Tools (NGT) communication with the cluster. Therefore, ensuring port 9440 is open between the two Prism Central instances is a mandatory prerequisite for successful disaster recovery site pairing.

Preserving IP addresses during a failover is a common requirement for applications with hardcoded IP references or complex inter-service dependencies. In a standard multi-site DR setup, the source and destination sites reside on different Layer 3 subnets, meaning a VM would naturally require a new IP address to be routable at the recovery site. To achieve " IP Preservation, " the underlying network infrastructure must support Layer 2 (L2) stretching.

L2 stretching (often implemented via VXLAN or specialized VPN tunnels like Nutanix Flow Virtual Networking) allows a single logical subnet to span multiple physical locations. When a VM fails over to a cluster on a stretched subnet, it effectively stays on the same network broadcast domain. As a result, its IP address, default gateway, and subnet mask remain valid and unchanged. If the subnets are not stretched, the administrator must rely on the Recovery Plan ' s " IP Mapping " feature to assign a new, valid IP at the destination—which does not " preserve " the original address. While preserving IPs simplifies application recovery, it requires more complex network engineering to ensure that traffic is correctly routed to the active site during a disaster, highlighting the trade-off between application simplicity and infrastructure complexity in BCDR design.