NCP-CI-AWS Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam Questions and Answers

To ensure that every NC2 on AWS cluster deployed allows full access from the on-premises CVM subnet efficiently, the administrator should create a custom AWS Network Security Group.

Use a key value oftag:nutanix:clusters:externalfor the security group, and set the inbound allow address to the on-premises subnet.

This approach leverages AWS tags to manage security group rules dynamically and ensures that the necessary access permissions are applied automatically to all clusters with the specified tag.

This method reduces the need for manual configuration of each cluster ' s security group, streamlining the process for a test/dev environment where clusters are frequently created and destroyed.

Refer to the AWS documentation on Network Security Groups and Nutanix documentation on best practices for securing NC2 clusters.

To resolve the IP conflict issue when an EC2 instance is powered on in a subnet also used by Nutanix NC2, the administrator should block or exclude the IP address used by the NC2 VM from being assigned to EC2 instances. This can be done by configuring the IP address management (IPAM) settings to ensure that the specific IP addresses allocated to the NC2 VMs are not used by EC2 instances, preventing IP conflicts and ensuring smooth operation of both environments.

Nutanix Cloud Clusters on AWS Deployment Guide

Nutanix Support and Insights

In an NC2 heterogeneous cluster (mixing different host types), the ability to addAmazon EBS volumesfor supplemental storage capacity is governed by both host compatibility and cluster redundancy rules. First, the administrator must ensure that the selected host types actually support EBS attachment; if the current selection does not, they mustadd a host type that supports EBS volumes. Second, the cluster must maintain its Replication Factor (RF) integrity. If the number of nodes for a specific storage-heavy host type is not amultiple of the RF(e.g., needing 4 nodes for RF2), the system may restrict storage expansion to prevent data unavailability during a failure. By ensuring the node count aligns with RF requirements and using compatible bare-metal instances, the administrator can unlock the EBS volume configuration options within the deployment workflow.

When opting for a native networking deployment (Standard AWS Networking), the architectural requirements differ from an overlay-based setup.

This configuration typically requiresone private management subnetto house the bare-metal hosts and Controller VMs (CVMs). To facilitate outbound communication and administrative access,two public subnetsare required—one for the NAT Gateway to provide internet access to the private nodes, and another to host resources like the Prism load balancer. Finally,one or more User VM (UVM) subnetsare created to host the actual workloads. Unlike Flow Virtual Networking, which uses a single transit VPC, native networking relies on these multiple standard AWS subnets to segregate management, public-facing, and workload traffic within the VPC.

Gateway Endpoint:

A Gateway Endpoint in AWS allows you to connect to supported AWS services privately without going through the public internet. This setup provides secure and efficient connectivity directly from the corporate VPC to the required AWS services.

Gateway Endpoints support services such as Amazon S3 and DynamoDB and are ideal for scenarios where private connectivity to these services is needed.

Refer to the AWS documentation on VPC endpoints, specifically Gateway Endpoints, and the Nutanix documentation on configuring private connectivity for NC2 deployments.

Integrating Flow Virtual Networking (FVN) into an NC2 cluster necessitates the creation of specific management and transit subnets to coordinate the overlay traffic. The administrator must ensure that aPrism Central subnet is configured on the Prism Elementside to facilitate the management link between the cluster nodes and the centralized management instance. Additionally, aTransit subnet must be configured on Prism Central. This transit subnet is critical because it houses the virtual routing components and gateways that manage traffic flow between different VPCs and the external network. By establishing these two subnets, the administrator provides the necessary control plane and data plane paths for the FVN overlay to communicate effectively with the underlying AWS infrastructure and the broader Nutanix management ecosystem.

WhenFlow Virtual Networking (FVN)is enabled for an NC2 cluster, Nutanix orchestrates the creation of aTransit VPCto handle traffic between the overlay and external networks. The core subnet created within this Transit VPC is namedoverlay-external-subnet-nonat. This subnet is critical as it serves as the entry and exit point for traffic that should not be subjected to address translation, such as traffic moving between the cloud overlay and an on-premises data center via a Transit Gateway or VPN. While administrators can manually add a NAT-enabled subnet later, the " nonat " variant is the primary default used to ensure that internal corporate communications remain transparent across the hybrid cloud boundary.

For the NC2 cluster deployed in the North Virginia region (us-east-id), consuming IPs from the 10.78.2.0/24 range, the subnets configured within the same CIDR range of 10.78.0.0/16 will be recognized.

The subnetDR01 (10.78.2.0/24)is directly within the range of the deployed cluster.

The subnetL2stretch (10.19.101.0/24)is also configured in the NC2 AWS VPC, although not in the immediate range of the cluster, it may show up due to broader network configurations for stretched L2 operations.

SubnetsVDI (10.78.130.0/22)andDR02 (10.79.120.0/24), although part of the same VPC, are not directly within the immediate CIDR range or may not be recognized in this specific configuration scenario.

Refer to the Nutanix documentation on NC2 AWS VPC subnet configurations and Prism Element settings for detailed guidelines on network visibility and configuration.

Bare-metal EC2 instances are a specialized resource in AWS, and their availability can sometimes be limited within a specific region or Availability Zone. If an administrator attempts to expand an NC2 cluster and the requested instance types are out of stock at the AWS level, the NC2 console will attempt to provision the nodes but will eventually reach aretry limit and fail. The portal does not indefinitely hold the cluster in maintenance mode. Instead, the administrator is responsible for verifying node availability through the AWS Service Health Dashboard or AWS support. If the desired instance type (e.g., i3.metal) is unavailable, the administrator may need to consider expanding into a different Availability Zone or choosing a different supported instance type to satisfy the expansion requirement.

For VDI workloads that require GPU acceleration, the g4dn.metal nodes are the appropriate choice. These instances are equipped with NVIDIA T4 GPUs, which are well-suited for graphics-intensive applications such as VDI workloads that need GPU acceleration. Other node types like AN36P, m6g.metal, or AN36 do not provide the necessary GPU capabilities.

Nutanix Support and Insights - GPU support in AWS

To control network traffic at the individual User VM (UVM) subnet level, creating a custom security group is the appropriate action. This approach allows for fine-grained control over inbound and outbound traffic rules that can be applied to specific subnets or individual instances within those subnets.

Custom Security Group:

Custom security groups enable administrators to define specific traffic rules tailored to the needs of individual subnets or VMs. This includes specifying allowed IP ranges, ports, and protocols.

By applying these custom security groups to the UVMs, the organization can control access and enhance security according to their policies and requirements.

Steps to Create a Custom Security Group:

Navigate to the AWS Management Console and go to the VPC service.

Select " Security Groups " under the " Security " section.

Click on " Create Security Group " and define the name, description, and VPC.

Add inbound and outbound rules according to the desired traffic control policies.

Attach the custom security group to the UVMs or subnets in question.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Security Group Documentation

Nutanix Best Practices for Security Groups

NC2 on AWS allows for the dynamic addition ofAmazon EBS volumesto bare-metal nodes to expand the cluster ' s storage capacity beyond the local NVMe drives. According to Nutanix architectural guidelines, once these EBS volumes are attached and integrated into the storage pool, the capacitycan only be increased. Reducing the storage capacity by removing or shrinking attached EBS volumes is not a supported operation because it would risk data loss and disrupt the Distributed Storage Fabric (DSF) which expects consistent disk availability. Therefore, administrators should carefully size their initial EBS requirements, knowing that they can scale up to meet demand but cannot scale back the capacity of individual existing volumes without a complex data migration or cluster redeployment.

Cluster Protect in an NC2 environment can protect and recover the following services and their associated metadata:

VM Templates: Ensures that templates used for creating virtual machines are backed up and recoverable.

Files: Protects data stored in Nutanix Files, ensuring that file services are backed up and can be restored as needed.

Nutanix Support and Insights

Nutanix Cloud Clusters on AWS Administration

When a catastrophic failure occurs, such as an entire AWS Availability Zone (AZ) becoming unavailable, the Cluster Protect feature provides a cloud-native orchestrated recovery path. The critical first step for an administrator to trigger the recovery workflow is to manually set the cluster to the " Failed " state within the NC2 console. Marking the cluster as failed signals the NC2 portal that the original infrastructure is non-functional and initiates the logic required to redeploy the cluster in a healthy, alternative AZ. Without this manual confirmation, the portal may continue attempting to reach the original nodes. Once the " Failed " state is confirmed, the portal provides the subsequent options to provision new bare-metal hardware and re-hydrate data from the Amazon S3 snapshots.

The Cluster Protect feature, which provides data protection and disaster recovery capabilities for Nutanix clusters, requires either the AOS Ultimate or NCI Ultimate license. These licenses include the necessary features to leverage Cluster Protect for ensuring data resilience and recovery.

Nutanix Documentation - Cluster Protection Features

Nutanix AOS 6.7 New Features

A standard NC2 deployment typically requires a management subnet and a public subnet for basic internet and console access. However, when moving to aFlow-based deployment(using Flow Virtual Networking), the architecture becomes more complex, requiringManagementandFlow Virtual Networksubnets specifically tailored for the overlay. TheManagement subnetis used for the bare-metal hosts and CVMs to communicate with the NC2 portal and Prism Central. TheFlow Virtual Network subnet(often the Transit VPC subnet) is required to host the distributed gateways that manage encapsulated Geneve traffic. These subnets are essential for segregating the management traffic from the virtualized workload traffic, ensuring that the software-defined overlay has a dedicated and secure path through the AWS VPC infrastructure.

Deploying NC2 on AWS using Flow Virtual Networking (FVN) requires a specific landing zone architecture to isolate management and user traffic. The minimum configuration requires three distinct subnets. First, one Private Management Subnet is needed for the bare-metal hosts and Controller VMs (CVMs). Second, one Public Subnet is required to host the NAT Gateway, providing the private management nodes with outbound internet access for Nutanix portal communication and updates. Third, one Flow Virtual Networking Subnet (often referred to as the Transit VPC subnet) is required to handle the encapsulation and routing of User VM traffic. This baseline setup ensures that the management plane is secure, the internet-bound traffic is correctly routed, and the FVN overlay has the necessary transit path for workload communication.

The requirement for two private subnets in the NC2 cluster configuration workflow serves the same purposes:

One subnet is designated for user VMs, ensuring user workloads are separated from management operations.

The other subnet is designated for cluster management, maintaining the integrity and security of management processes and internal communications.

Nutanix Clusters on AWS Deployment Guide

Nutanix Cloud Clusters on AWS Administration

While Nutanix provides multiple management interfaces, each serves a distinct purpose in the hybrid cloud lifecycle. Prism Central and Prism Element are used for managing software-level entities like VMs, storage containers, and replication policies. However, for thedefinitive status of the cluster ' s cloud infrastructure—including whether the bare-metal nodes are provisioned, if the cluster is in a " Healthy, " " Degraded, " or " Failed " state, or if a " boot timeout " has occurred—administrators must usethe NC2 Portal. The NC2 Portal acts as the primary orchestration layer that bridges Nutanix and AWS; it is the only console that displays specific cloud deployment tasks, hardware replacement status, and AWS-raised infrastructure events in a unified view.

AHV Metro Availability provides a synchronous replication solution for zero-RPO disaster recovery.

For this to function correctly within an NC2 on AWS environment, the clusters must be architected to survive anAvailability Zone (AZ)failure while maintaining the extremely low latency required for synchronous operations. The supported configurations include havingtwo NC2 clusters running in the same AWS region but in different AZs, ensuring that if one zone goes offline, the other can immediately take over. Additionally, asingle-node NC2 clustercan be used as a target in a different AZ within the same region for specific low-footprint synchronous requirements. Deploying across different regions is not suitable for Metro Availability due to the high latency of inter-region traffic, which would exceed the requirements for synchronous data writes.

The Nutanix NC2 portal uses a hierarchical structure consisting of Customers, Organizations, andWorkspacesto manage resources. A common point of confusion for administrators is that clusters are localized to specific Workspaces. If an administrator logs into the portal and finds their cluster " missing, " the most likely cause is that they are currently viewing a differentworkspacethan the one where the cluster was provisioned. The NC2 console requires users to select the correct context to view their resources. Checking the workspace selector in the portal interface usually resolves this visibility issue, as the account and overall portal permissions are already verified by the successful login.

To deploy NC2 in AWS using an existing VPC, the following AWS resources should be configured beforehand:

NAT Gateway: This allows instances in the private subnet to connect to the internet or other AWS services, while preventing the internet from initiating connections with those instances.

Public and Private Subnets: These are necessary to segregate the network traffic. Public subnets provide a direct route to the internet gateway, while private subnets are used for internal resources that do not need direct access to the internet.

Nutanix Cloud Clusters on AWS Deployment Guide

Nutanix Support and Insights

To protect workloads on an NC2 cluster on AWS, deploying strategies that ensure high availability and disaster recovery are essential. The two valid options are:

Create a Second NC2 Cluster in a Different Availability Zone:

High Availability: Deploying a second NC2 cluster in a different availability zone ensures that workloads can be quickly recovered in case of an availability zone failure.

Disaster Recovery: This setup enables asynchronous replication between clusters, providing a robust disaster recovery solution.

Use an Existing On-Prem Nutanix Cluster as a Disaster Recovery Target:

Hybrid DR: Leveraging an existing on-premises Nutanix cluster for disaster recovery provides a cost-effective and efficient DR solution.

Replication: Set up replication policies to ensure data is consistently copied from the NC2 cluster on AWS to the on-premises cluster.

Why Not Other Options:

One-node cluster in another availability zone: Not a valid DR solution as a single-node cluster cannot provide the required resilience and high availability.

Deploy a cluster across two availability zones: While this can enhance availability, it is not a typical approach for Nutanix clusters which are designed to operate within a single availability zone for simplicity and performance reasons.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Disaster Recovery Best Practices

AWS Availability Zones and Disaster Recovery Documentation

For a new NC2 on AWS deployment where workload VMs have low storage and memory requirements but high CPU frequency ( > 3.0 GHz) requirements, and the goal is to minimize the number of CPU cores to reduce application licensing costs, thei3.metalinstance type is the most suitable.

i3.metal:

High CPU Frequency: i3.metal instances offer high-frequency Intel Xeon processors (up to 3.1 GHz) which meet the high CPU frequency requirement.

Low Storage and Memory: These instances come with a balanced amount of storage and memory, suitable for workloads with low requirements in these areas.

Minimized CPU Cores: i3.metal instances have fewer CPU cores compared to other high-frequency instances like i4i.metal, making them ideal for minimizing application licensing costs.

Other Instance Types:

z1d.metal: While also offering high CPU frequency, these instances typically come with a higher core count and more memory, which may not be optimal for minimizing licensing costs.

i4i.metal: Designed for I/O intensive applications with higher core counts.

m5d.metal: Balanced instance type but with more cores and not as high CPU frequency as required.

AWS EC2 Instance Types Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Instance Selection

To enable inbound internet access to Virtual Servers in an NC2 cluster on AWS for the HTTPS protocol, the administrator should use an AWS Network Load Balancer (NLB).

Configure the NLB listener to listen on TCP port 443, which is the standard port for HTTPS traffic.

Create a target group in AWS, and register the servers (Virtual Servers in the NC2 cluster) as targets within this group.

Ensure the NLB is properly configured with an Elastic IP (EIP) if required, to provide a static IP address for the load balancer.

Verify that the security groups and network ACLs associated with the load balancer and the target group allow inbound traffic on port 443.

Refer to AWS documentation on Network Load Balancers and Nutanix NC2 on AWS integration guides for step-by-step instructions on setting up and configuring the necessary components for enabling HTTPS access.

AWS Direct Connect allows companies to create private, dedicated connections between their data centers and AWS. This bypasses the internet and provides a more reliable and faster network connection directly to AWS services, including S3.

AWS Direct Connect Documentation

AWS S3 Access over Direct Connect

When performing a migration from an NC2 environment to a Nutanix on-premises environment, the task should be performed using the NC2 Prism Central. This is because NC2 Prism Central provides a centralized management interface that allows administrators to manage and migrate workloads between cloud and on-premises environments seamlessly.

Nutanix Cloud Clusters (NC2) Documentation

Nutanix Community Guide

The exhibit shows two cloud accounts, one for Azure and one for AWS, with their statuses indicated. The AWS cloud account status is marked as " U " (which likely stands for " Unavailable " or " Unreachable " ). This indicates that the AWS cloud account configuration is not properly connected or accessible.

Status Check:

The AWS cloud account is marked with an " U " status, meaning it is not active or accessible.

This status prevents the creation of an NC2 cluster because the necessary cloud resources cannot be allocated or managed without a proper connection.

Action:

The best course of action is to create a new cloud account in the organization. This involves setting up the cloud account details correctly and ensuring it is properly configured to communicate with Nutanix and AWS.

Steps to Create a New Cloud Account:

Log in to the Nutanix console.

Navigate to the " Organizations " section.

Select " Add Cloud Account " and provide the required AWS credentials and permissions.

Ensure the new cloud account is active and correctly configured.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Cloud Account Management

To ensure that alert emails are sent properly from Prism Central within an NC2 environment, configuring an SMTP server in the Prism Central settings is required. The SMTP server facilitates the sending of email notifications for alerts and other communications.

SMTP Configuration:

Prism Central requires an SMTP server to send email alerts. This involves specifying the SMTP server address, port, and authentication details if needed.

The configuration must include the email address from which the alerts will be sent and the recipient addresses.

Steps to Configure SMTP Server in Prism Central:

Log in to Prism Central.

Navigate to the " Settings " menu.

Select " Email Server " under the " Alerts " section.

Enter the SMTP server details, including the server address, port, and authentication credentials.

Test the configuration to ensure emails are sent correctly.

Nutanix Prism Central Administration Guide

Nutanix Support Documentation on Email Alert Configuration

Best Practices for Configuring SMTP Servers in Cloud Environments

Given the company ' s large spend commitments as part of an AWS Enterprise Discount Program (EDP) totaling $15 million, purchasing Nutanix licenses through the AWS Marketplace ensures that the costs contribute to the EDP commitment.

This approach integrates the Nutanix license costs into the overall AWS spend, thereby maximizing the benefits of the EDP.

Purchasing directly from Nutanix or leveraging existing licenses might not count towards the AWS EDP commitment, and trial licenses are typically for evaluation purposes and do not contribute to the committed spend.

Refer to the Nutanix and AWS documentation on licensing and marketplace purchases, and EDP program details.

To establish full connectivity between the company’s on-premises datacenter and the AWS cloud, the following AWS offerings will satisfy this requirement:

AWS VPN: This service allows you to create a secure connection between your on-premises network or other remote network and your AWS VPC using an IPsec VPN tunnel. It is suitable for low to moderate bandwidth requirements and provides secure, encrypted connections.

Direct Connect: AWS Direct Connect is a dedicated network connection from your premises to AWS. It provides a private, high-bandwidth, low-latency connection which is ideal for high-throughput applications and workloads that need consistent network performance.

AWS VPN Documentation

AWS Direct Connect Documentation

To deploy an NC2 cluster using an existing AWS network, the NAT Gateway should be placed in a public subnet. A public subnet is one that has a route to an Internet Gateway, allowing the NAT Gateway to provide outbound internet access for resources in private subnets. The NAT Gateway is used to enable instances in private subnets to access the internet while keeping them secure by not exposing them directly to the public internet.

Nutanix Cloud Clusters (NC2) on AWS Documentation

To achieve anRTO (Recovery Time Objective)as low as15 minutesusing Multicloud Snapshot Technology, aPilot Light Deploymentis essential. In this model, a minimal Nutanix cluster is always active in the cloud. This active presence ensures that the Prism Central management layer is ready to receive recovery commands and that the storage containers are already mounted. Because the " compute " is already provisioned, the recovery process simply involves hydrating the snapshots from the S3 bucket and powering on the VMs according to the Recovery Plan. A " Zero Compute " model would exceed this RTO because the time required to provision new bare-metal instances from AWS and initialize the Nutanix software can take significantly longer than 15 minutes.

Nutanix provides a flexible licensing model for NC2, allowing customers to use their existingon-premises licensesthrough reservation. A key benefit of this approach is thatreserved licensed capacity automatically handles incidental overages. If a cluster temporarily scales out and exceeds the reserved capacity, the Nutanix billing system accounts for the excess usage automatically, typically by drawing from the associated Pay-As-You-Go (PAYG) account or consumption credits. This ensures that the cluster remains operational and compliant even during unexpected spikes in demand. Administrators can manage these reservations through the Nutanix portal, allowing them to balance their committed on-premises license spend with the variable needs of their cloud-resident clusters.

Nutanix offers tailored licensing models for different workload types within NC2 to optimize costs. ForVDI-specific clusters, Nutanix utilizes auser-based consumption model. In this scenario, pricing is determined by the number of concurrent users, which is ideal for elastic desktop environments where the number of active VMs fluctuates. Conversely,general-purpose clusterstypically default to acapacity-based method. Here, consumption is calculated based on the total provisioned capacity (cores or TiB) of the cluster, providing predictable costs for steady-state server workloads. These models allow organizations to align their software spend directly with their actual resource utilization patterns. It is important to note that switching between portfolio types (NCI and AOS) is generally restricted once a cluster is deployed.

While NC2 bare-metal instances come with high-performance local NVMe storage, many organizations require additional capacity to support large data sets or long-term storage needs. For instance types that support Amazon EBS attachment, theminimum number of additional EBS volumesthat can be added per node is1. Adding even a single EBS volume allows the Nutanix cluster to expand its storage pool beyond the physical limitations of the bare-metal chassis. Administrators can then increase this capacity as needed, although once attached, these volumes typically cannot be removed or decreased. This flexibility is key for scaling storage-intensive applications without necessarily increasing the compute node count, thereby optimizing the overall TCO of the cloud cluster.

AWS supports EC2 bare-metal instances in regions with at least 3 partitions. Partitions in AWS provide high availability and fault tolerance by distributing instances across different hardware to minimize the impact of hardware failures.

AWS EC2 Bare Metal Instances Documentation

AWS Regions and Availability Zones

AVTEP (VXLAN Tunnel Endpoint) Gatewayshowing a status of " Down " indicates a connectivity or configuration failure within the control plane. In an NC2 environment, the gateway relies on consistent communication withPrism Central (PC)for management and synchronization, as well asNTP and DNSfor time-sync and name resolution. If the route tables in the AWS VPC are missing the necessary entries to reach these management services, the VTEP gateway will fail to initialize or maintain its heartbeat, resulting in a " Down " status. While on-premises reachability is important for traffic flow, the failure to create the extension entirely usually points to these missing internal routes that prevent the Nutanix software components from coordinating correctly within the cloud environment.

When establishing a landing zone in a brand new AWS region for NC2 with Flow Virtual Networking (FVN), the network team must provision specific subnets to support the management plane and the transit architecture. The first essential component is theFVN Overlay External Subnet, which resides within the Transit VPC and acts as the entry/exit point for traffic moving between the overlay network and external environments like the internet or on-premises data centers. The second requirement is a dedicatedPrism Central subnet, which is necessary to host the Prism Central instance that will manage the NC2 clusters within that region. These subnets provide the structural foundation for the software-defined networking overlay, ensuring that management traffic is properly segregated from user workload traffic and that the transit gateway logic has a designated physical network path.