NCP-CI-AWS Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam Questions and Answers

After the NC2 free trial expires, to continue using all features of NC2 on existing clusters, the administrator needs to switch to a paid subscription plan.

A paid subscription ensures uninterrupted access to the full range of features and support for NC2 clusters.

Without switching to a paid plan, the features might be limited, and support may not be available, impacting the cluster ' s operations and management.

Refer to the Nutanix billing and subscription documentation for details on switching from a trial to a paid plan and the benefits associated with paid subscriptions.

When deploying a new NC2 cluster, the AWS Directory Service must be able to resolve the addressgateway-external-api.cloud.nutanix.com.

This external API gateway is critical for the NC2 cluster to communicate with Nutanix services for operations such as management, updates, and licensing.

Ensuring that this address can be resolved allows the cluster to interact properly with the Nutanix cloud infrastructure and services.

Refer to the Nutanix documentation on network and DNS requirements for NC2 deployments, specifically the addresses that need to be resolvable for proper functionality.

Selecting the " I want to protect the cluster " option during the initial NC2 deployment wizard enables the underlying support for theCluster Protectfeature but does not fully finalize the protection policies. Once the bare-metal instances are provisioned and the Nutanix software is initialized, the administrator mustconfigure Cluster Protect after the deployment completes. This " Day Two " configuration involves specifying the Amazon S3 bucket that will serve as the backup target, defining the protection frequency (RPO), and selecting the specific User VMs or Prism Central data to be protected. Since the NCI Ultimate license already includes the advanced replication and protection features by default, no additional add-on purchase is required, but the functional setup of the backup policies remains a mandatory post-deployment task.

The alert indicates a potential issue with the VPC/Subnet settings, preventing the cluster nodes from contacting Nutanix services.

To resolve this, the administrator needs to ensure that the subnet 10.0.1.0/24, which is assigned for Bare metal hosts, has an outbound Internet connection.

This connection is necessary for the cluster nodes to communicate with external Nutanix services for updates, license validation, and other essential operations.

Verify that there are appropriate route tables and security group rules allowing outbound traffic to the Internet from the 10.0.1.0/24 subnet.

Ensure that there is either an Internet Gateway (IGW) attached to the VPC or a NAT Gateway configured if using private subnets.

Refer to the Nutanix documentation and AWS VPC configuration guides to ensure proper Internet connectivity and routing setups.

Monitoring the health and connectivity of stretched Layer 2 networks is vital for maintaining seamless hybrid cloud operations.

In a Nutanix environment managed via Prism Central, the specific location to verify the operational status of these extensions is underNetwork and Security, specifically within theNetwork Servicessection labeledSubnet Extensions. This dashboard provides visibility into the VTEP (VXLAN Tunnel Endpoint) gateways and the specific subnets that have been extended from the on-premises environment to NC2 on AWS. Administrators can check if the tunnel is " Up " or " Down " and view performance metrics associated with the stretched segment. Ensuring the status is monitored here allows for rapid troubleshooting of connectivity issues that might prevent virtual machines from communicating across the hybrid link.

The Cluster Protect feature, which provides data protection and disaster recovery capabilities for Nutanix clusters, requires either the AOS Ultimate or NCI Ultimate license. These licenses include the necessary features to leverage Cluster Protect for ensuring data resilience and recovery.

Nutanix Documentation - Cluster Protection Features

Nutanix AOS 6.7 New Features

When selecting the NC2 subscription plan from the Nutanix Billing portal, the available options include:

Pay-as-you-Go (PayG): A flexible payment option where users are billed based on their actual usage, providing cost efficiency for variable workloads.

Bring your own License (BYOL): Allows users to utilize existing Nutanix licenses they have purchased, offering a cost-effective way to leverage existing investments in Nutanix software.

Refer to the Nutanix billing and subscription documentation for detailed descriptions of subscription plans and their benefits.

To ensure that every NC2 on AWS cluster deployed allows full access from the on-premises CVM subnet efficiently, the administrator should create a custom AWS Network Security Group.

Use a key value oftag:nutanix:clusters:externalfor the security group, and set the inbound allow address to the on-premises subnet.

This approach leverages AWS tags to manage security group rules dynamically and ensures that the necessary access permissions are applied automatically to all clusters with the specified tag.

This method reduces the need for manual configuration of each cluster ' s security group, streamlining the process for a test/dev environment where clusters are frequently created and destroyed.

Refer to the AWS documentation on Network Security Groups and Nutanix documentation on best practices for securing NC2 clusters.

The administrator has not created the necessary Security Group:

The error message indicates that the creation of network interfaces in a shared subnet requires specifying a security group. This means that the necessary security group has not been created or assigned to the network interfaces.

Creating the appropriate security group and ensuring it is associated with the network interfaces during cluster deployment should resolve this issue.

Refer to AWS documentation on security groups and network interface configuration and Nutanix documentation on prerequisites for deploying NC2 clusters in an existing AWS VPC.

Ensure the specialist is assigned the RBAC role with proper permissions (Answer A):

Role-Based Access Control (RBAC) ensures that the specialist has the necessary permissions to troubleshoot and manage the NC2 environment. This avoids unnecessary privilege escalations and maintains security.

Confirm the Support Authorization on the organization is set to Full Access (Answer C):

Setting the Support Authorization to Full Access allows the Nutanix support specialist to have the required access to investigate and resolve issues in the environment. This is essential for effective troubleshooting.

Nutanix RBAC Documentation

Nutanix Support Access Guide

Nutanix Cloud Clusters on AWS requires bare-metal EC2 instances to run the Nutanix AHV hypervisor and the Controller VMs (CVMs).

Nutanix supports specific " metal " instance types that provide the necessary hardware access for the hypervisor to manage resources efficiently. The primary supported instance types include thei3.metal, which is optimized for high I/O workloads; thei3en.metal, which offers more storage capacity and higher network bandwidth; and thei4i.metal, which utilizes the latest Intel Ice Lake processors for superior compute and storage performance. Other instance types listed, such as virtualized " xlarge " or " micro " instances, do not provide the bare-metal access required to run the Nutanix software stack in an NC2 environment.

Enable IGMP snooping on the AHV hosts:

IGMP (Internet Group Management Protocol) snooping is a feature that listens to IGMP traffic between hosts and routers. By enabling IGMP snooping on the AHV (Acropolis Hypervisor) hosts, the switch can intelligently forward multicast traffic only to the ports that have requested it.

This reduces unnecessary multicast traffic on the network and prevents congestion by ensuring that multicast packets are only delivered to the appropriate endpoints.

Refer to the Nutanix documentation on network configuration and best practices for managing multicast traffic.

To resolve the IP conflict issue when an EC2 instance is powered on in a subnet also used by Nutanix NC2, the administrator should block or exclude the IP address used by the NC2 VM from being assigned to EC2 instances. This can be done by configuring the IP address management (IPAM) settings to ensure that the specific IP addresses allocated to the NC2 VMs are not used by EC2 instances, preventing IP conflicts and ensuring smooth operation of both environments.

Nutanix Cloud Clusters on AWS Deployment Guide

Nutanix Support and Insights

Synchronous replication requires extremely low latency (typically sub-5ms) and high throughput between the primary and secondary storage controllers. While Flow Virtual Networking (FVN) supports various multi-VPC architectures, the most robust and supported configuration for synchronous replication within a single AWS region is to ensure that both clusters reside within the same AWS VPC. This placement minimizes network hops and avoids the additional latency that might be introduced by VPC Peering or Transit Gateway traversal between separate VPCs. By sharing the same VPC, the clusters communicate over the same high-speed internal AWS network fabric, providing the deterministic performance and zero-RPO data protection required for synchronous data writes and Metro Availability configurations.

To ensure continuous availability and maintain the specified Replication Factor (RF) during maintenance or hardware issues, Nutanix follows a proactive " provision before removal " logic for host replacement in the cloud. The correct operational sequence begins with adding a new host to the cluster first. This step expands the cluster ' s capacity and ensures there is a destination ready for data synchronization. Once the new host is fully integrated into the storage fabric, the system migrates the virtual machines and their associated data away from the degraded or old host. Only after the old host has been completely evacuated and the cluster returns to a healthy, balanced state does the NC2 console conclude the operation by removing the old host from the cluster configuration.

The error message in the image indicates that the cluster creation failed due to reaching the maximum retries for provisioning cluster nodes. Here are two possible scenarios that could lead to this issue:

Insufficient Permissions (Answer B):

If the AWS user or role used to create the cluster does not have sufficient permissions, it can result in failures during the provisioning process. Proper IAM policies must be attached to ensure that the necessary actions can be performed, such as launching instances, creating VPCs, or managing networking components.

AWS Quota Exceeded/Instance Limit Exceeded (Answer D):

AWS imposes quotas and limits on the number of instances and other resources that can be created within an account. If these quotas are exceeded, new instances cannot be provisioned, causing the cluster creation to fail. This can be resolved by requesting a quota increase from AWS.

Nutanix Knowledge Base Article 9774

AWS Service Quotas

Nutanix NC2 on AWS Documentation

The 192.168.5.0/24 range is often reserved for internal cluster communication within Nutanix deployments.

Using this CIDR range for other purposes could lead to network conflicts and connectivity issues, as it might interfere with the internal operations and communication channels of the Nutanix cluster.

Ensuring that the CIDR range is not overlapping with any reserved ranges is crucial for maintaining proper network connectivity and cluster functionality.

Refer to the Nutanix documentation on network configuration and best practices for NC2 deployments to confirm reserved IP ranges and their appropriate use.

To establish full connectivity between the company’s on-premises datacenter and the AWS cloud, the following AWS offerings will satisfy this requirement:

AWS VPN: This service allows you to create a secure connection between your on-premises network or other remote network and your AWS VPC using an IPsec VPN tunnel. It is suitable for low to moderate bandwidth requirements and provides secure, encrypted connections.

Direct Connect: AWS Direct Connect is a dedicated network connection from your premises to AWS. It provides a private, high-bandwidth, low-latency connection which is ideal for high-throughput applications and workloads that need consistent network performance.

AWS VPN Documentation

AWS Direct Connect Documentation

Nutanix offers tailored licensing models for different workload types within NC2 to optimize costs. ForVDI-specific clusters, Nutanix utilizes auser-based consumption model. In this scenario, pricing is determined by the number of concurrent users, which is ideal for elastic desktop environments where the number of active VMs fluctuates. Conversely,general-purpose clusterstypically default to acapacity-based method. Here, consumption is calculated based on the total provisioned capacity (cores or TiB) of the cluster, providing predictable costs for steady-state server workloads. These models allow organizations to align their software spend directly with their actual resource utilization patterns. It is important to note that switching between portfolio types (NCI and AOS) is generally restricted once a cluster is deployed.

Route tables for cloud subnets contain incorrect route entries:

If the route tables associated with the cloud subnets contain incorrect route entries, the NC2 cluster might not be able to reach the necessary AWS services or endpoints. Correct route entries are crucial for ensuring proper communication between the NC2 cluster and the underlying AWS infrastructure.

IAM roles and policies are incorrectly configured:

Incorrectly configured IAM roles and policies can prevent NC2 from making API calls to AWS services. These roles and policies must be properly set up to allow the necessary permissions for NC2 to interact with AWS resources and perform required operations.

Refer to the AWS documentation on route table configuration and IAM roles and policies, and Nutanix documentation on NC2 cloud connectivity and permissions.

Nutanix Cloud Clusters (NC2) on AWS is designed to provide a " cloud-native " resilience experience, meaning it proactively manages the underlying hardware health.

If AWS issues a notification for aSystem Rebootor a hardware-related event on a bare-metal instance, the NC2 console does not simply wait for the reboot to occur. To maintain cluster availability and avoid potential data integrity issues during an uncontrolled hardware event, NC2 triggers anautomated host replacement. The system will provision a new bare-metal instance, integrate it into the cluster, and migrate the data and workloads (using High Availability if necessary) away from the degraded or scheduled-to-reboot host. This automation ensures that the Nutanix cluster remains healthy and functional despite the ephemeral nature of cloud infrastructure hardware.

For the NC2 cluster deployed in the North Virginia region (us-east-id), consuming IPs from the 10.78.2.0/24 range, the subnets configured within the same CIDR range of 10.78.0.0/16 will be recognized.

The subnetDR01 (10.78.2.0/24)is directly within the range of the deployed cluster.

The subnetL2stretch (10.19.101.0/24)is also configured in the NC2 AWS VPC, although not in the immediate range of the cluster, it may show up due to broader network configurations for stretched L2 operations.

SubnetsVDI (10.78.130.0/22)andDR02 (10.79.120.0/24), although part of the same VPC, are not directly within the immediate CIDR range or may not be recognized in this specific configuration scenario.

Refer to the Nutanix documentation on NC2 AWS VPC subnet configurations and Prism Element settings for detailed guidelines on network visibility and configuration.

Synchronous replication requires extremely low latency (sub-5ms) and a reliable high-speed connection between the primary and secondary storage controllers. While Flow Virtual Networking (FVN) supports various architectures, the most robust and supported way to enable synchronous replication for NC2 clusters in the same region is to ensure thatboth clusters reside within the same AWS VPC. This placement minimizes network hops and avoids the added latency that might be introduced by VPC Peering or a Transit Gateway between separate VPCs. By sharing the same VPC, the clusters can communicate via the same internal AWS network fabric, providing the deterministic performance required for zero-RPO data protection and Metro Availability configurations.

In a Layer 2 stretched environment where the default gateway resides on-premises, a " Forward policy " is used to route traffic from the cloud back to the data center. If the on-premises data center goes completely offline, the on-premises gateway is no longer reachable, which would halt all North-South communication for the VMs failed over to AWS. To restore full service, the administrator must not only failover the VMs to the NC2 cluster but also remove the Forward policy on the on-premises cluster (or specifically update the routing logic to ensure the AWS cluster takes over gateway duties). This allows the cloud cluster to stop attempting to tunnel traffic to the missing on-premises gateway and instead utilize local cloud-based exit points for network traffic, restoring external connectivity.

When configuring a syslog server in the Prism Central Admin Center for Nutanix, one of the available log modules is Acropolis.

The Acropolis module logs system events related to the Nutanix Acropolis operating system, which is critical for monitoring and auditing system activities and performance.

Configuring syslog with the Acropolis module ensures that important events and issues related to the Acropolis environment are captured and can be forwarded to an external syslog server for centralized logging and analysis.

Refer to the Nutanix documentation on Prism Central and syslog configuration for the full list of available log modules and detailed steps for configuration.

The Nutanix disaster recovery capabilities include recovery plans that define how entities are recovered in the event of a failure. There is a limit to the number of entities that can be managed within a single recovery plan.

Entity Limit:

According to Nutanix documentation, the maximum number of entities that can be recovered using a single recovery plan is 300. Exceeding this limit will cause issues during the execution of the recovery plan.

Impact of Exceeding the Limit:

If the number of entities in a recovery plan exceeds the supported limit, the recovery process may fail or not execute correctly, as observed in the scenario.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Disaster Recovery Best Practices Documentation

When a catastrophic failure occurs, such as an entire AWS Availability Zone (AZ) becoming unavailable, the Cluster Protect feature provides a cloud-native orchestrated recovery path. The critical first step for an administrator to trigger the recovery workflow is to manually set the cluster to the " Failed " state within the NC2 console. Marking the cluster as failed signals the NC2 portal that the original infrastructure is non-functional and initiates the logic required to redeploy the cluster in a healthy, alternative AZ. Without this manual confirmation, the portal may continue attempting to reach the original nodes. Once the " Failed " state is confirmed, the portal provides the subsequent options to provision new bare-metal hardware and re-hydrate data from the Amazon S3 snapshots.

Flow Virtual Networking (FVN)usesGeneve encapsulation, which adds 58 bytes of overhead to every packet. On a standard 1,500-byte network, the effective MTU for the payload is reduced to1442 bytes. While Nutanix attempts to communicate this to User VMs (UVMs) via DHCP, some operating systems or static configurations ignore these advertisements. If a UVM sends a full 1,500-byte packet, the encapsulated packet (1,558 bytes) will be dropped by the AWS physical network. To resolve this, the administrator mustenable jumbo MTU on the UVMs(typically 9,001 bytes in AWS). By allowing the UVM to process larger packets or properly fragment them, the AHV host can successfully encapsulate and transmit the traffic over the underlying AWS infrastructure without fragmentation errors or packet loss.

A heterogeneous cluster allows organizations to mix different bare-metal instance types to satisfy diverse workload requirements, such as combining compute-heavy and storage-heavy nodes. According to Nutanix architectural guidelines for NC2 on AWS, administrators can mix amaximum of 3 different instance typeswithin a single cluster. This limitation ensures that the Distributed Storage Fabric (DSF) can maintain predictable performance and balanced data distribution across the varied hardware. When designing such a cluster, it is also vital that the number of nodes of each type is a multiple of the Replication Factor (RF) to ensure data redundancy is maintained. Mixing more than three types could lead to significant performance skews and complex management of hardware affinity rules.

The Nutanix Create Cluster wizard may not support selecting subnets that have both IPv4 and IPv6 CIDR blocks due to compatibility or configuration constraints.

When a subnet with both CIDR blocks is present, it can cause issues in the selection process during cluster creation, as the system might not be able to properly handle or recognize the dual-stack configuration.

Ensuring that the management subnet has only an IPv4 CIDR block, without an IPv6 CIDR block, could resolve this issue and allow for successful selection in the cluster creation wizard.

Refer to the Nutanix and AWS documentation on subnet configuration and requirements for NC2 cluster deployments, specifically addressing IPv4 and IPv6 compatibility and constraints.

In the NC2 console, an organization is used to segregate clusters based on specific requirements. This segregation allows administrators to manage clusters more effectively by grouping them according to business units, projects, or other criteria. This organizational structure helps in maintaining clear boundaries and applying specific policies or permissions to different clusters within the same NC2 environment.

Nutanix Cloud Clusters on AWS Administration

Nutanix Certified Professional - Cloud Integration - AWS

AVTEP (VXLAN Tunnel Endpoint) Gatewayshowing a status of " Down " indicates a connectivity or configuration failure within the control plane. In an NC2 environment, the gateway relies on consistent communication withPrism Central (PC)for management and synchronization, as well asNTP and DNSfor time-sync and name resolution. If the route tables in the AWS VPC are missing the necessary entries to reach these management services, the VTEP gateway will fail to initialize or maintain its heartbeat, resulting in a " Down " status. While on-premises reachability is important for traffic flow, the failure to create the extension entirely usually points to these missing internal routes that prevent the Nutanix software components from coordinating correctly within the cloud environment.

When reserving licenses for Nutanix Cloud Clusters (NC2), administrators must understand the inclusion of add-ons within different tiers. For organizations requiring multi-protocol storage, the Nutanix Unified Storage (NUS) add-on is flexible and can be associated with either the NCI Pro or NCI Ultimate licensing tiers. Furthermore, the NCI Ultimate tier is designed to be comprehensive; it automatically includes high-value features such as Advanced Replication and Security (Microsegmentation) by default. This simplifies the licensing process because these features do not require separate manual applications once the Ultimate tier is selected. While NCI Ultimate is feature-rich, it does not include the NUS add-on by default, which remains a capacity-based selection that must be specifically managed alongside the base license tier.

Nutanix offers a free trial to allow organizations to test NC2 capabilities.

This trial is flexible; users can initiate a separate 30-day free trial for each supported cloud provider, such as AWS and Azure, allowing for independent evaluations of different cloud environments. It is important to note that the " free " aspect of the trial applies only to theNutanix software licensing. The user is still responsible for allAWS infrastructure costs(bare-metal instances, storage, and data transfer) incurred during the trial period. Additionally, users are not restricted to the trial alone; they can choose to activate aPay-As-You-Go (PAYG)subscription even while the free trial is active to ensure a smooth transition to production after the evaluation ends.

The role of " Customer Administrator " in Nutanix Cloud Integration with AWS (NC2) is designed to meet the requirements of creating and managing multiple organizations and clusters, as well as managing user access for the entire company.

Roles and Permissions:

Customer Administrator: This role has the broadest set of permissions, allowing the user to create and manage organizations, clusters, and user access across the entire company. It encompasses administrative control over multiple aspects of the NC2 environment.

Capabilities:

Organization Management: Ability to create and manage multiple organizations.

Cluster Management: Full control over creating, configuring, and managing clusters.

User Access Management: Manage user roles and permissions, ensuring that the right individuals have access to the necessary resources.

Why Not Other Roles:

Organization Administrator: Limited to managing organizations but not clusters and user access at the company level.

Customer Security Administrator: Focuses on security aspects, lacking broader administrative capabilities.

Cluster Administrator: Limited to managing clusters without the ability to manage organizations and user access comprehensively.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Role-Based Access Control Documentation

The Nutanix NC2 portal uses a hierarchical structure consisting of Customers, Organizations, andWorkspacesto manage resources. A common point of confusion for administrators is that clusters are localized to specific Workspaces. If an administrator logs into the portal and finds their cluster " missing, " the most likely cause is that they are currently viewing a differentworkspacethan the one where the cluster was provisioned. The NC2 console requires users to select the correct context to view their resources. Checking the workspace selector in the portal interface usually resolves this visibility issue, as the account and overall portal permissions are already verified by the successful login.

Gateway Endpoint:

A Gateway Endpoint in AWS allows you to connect to supported AWS services privately without going through the public internet. This setup provides secure and efficient connectivity directly from the corporate VPC to the required AWS services.

Gateway Endpoints support services such as Amazon S3 and DynamoDB and are ideal for scenarios where private connectivity to these services is needed.

Refer to the AWS documentation on VPC endpoints, specifically Gateway Endpoints, and the Nutanix documentation on configuring private connectivity for NC2 deployments.

WhenFlow Virtual Networking (FVN)is enabled for an NC2 cluster, Nutanix orchestrates the creation of aTransit VPCto handle traffic between the overlay and external networks. The core subnet created within this Transit VPC is namedoverlay-external-subnet-nonat. This subnet is critical as it serves as the entry and exit point for traffic that should not be subjected to address translation, such as traffic moving between the cloud overlay and an on-premises data center via a Transit Gateway or VPN. While administrators can manually add a NAT-enabled subnet later, the " nonat " variant is the primary default used to ensure that internal corporate communications remain transparent across the hybrid cloud boundary.

Within an NC2 environment, the Cluster Protect feature can ensure the protection of:

Nutanix Files: This provides file services within the Nutanix ecosystem, and Cluster Protect can safeguard the data stored in Nutanix Files.

Virtual Machine Disks: This ensures that the data stored on virtual machine disks is protected, providing backup and recovery options for the virtual machines running within the cluster.

Nutanix Cloud Clusters on AWS Administration

Nutanix AOS 6.7 Documentation