NCP-MCA Nutanix Certified Professional - Multicloud Automation (NCP-MCA 6.10) Exam Questions and Answers

TheeScript(embedded script) module in Nutanix Self-Service (Calm) utilizesPythonas its scripting engine.

Version Standard:As of recent versions (specifically post-3.8.0), support for Python 2 has been deprecated and revoked. The system exclusively supportsPython 3for all new eScript tasks in Blueprints and Runbooks.

Context:While eScripts run in a containerized environment that processes the script logic, Python 3 is the mandatory syntax and runtime environment for these tasks.

PowerShell (A):Supported as a separate task type ("PowerShell"), not as the language for the "eScript" task type.

The image typically shows the Task Editor window where "Type" is selected as "eScript" and the script editor pane clearly displays "Python 3" as the script type syntax highlighter.

When configuring a Playbook in Intelligent Operations (X-Play), the "User Execution" settings allow the administrator to define a specific user context (impersonation) under which the playbook actions run.

However, for alocal user accountcreated in Prism Central to be available and valid for this impersonation, that usermust have logged into the Prism Central interface at least once. This login event creates the necessary user profile and mapping within the Prism Central database that X-Play requires to authenticate and execute actions on their behalf. If the user has been created but never logged in, they cannot be successfully used for playbook execution.

To ensure a Playbook executes at a specific resource threshold (95% Memory), the administrator must link the Playbook to anAlert Policydefined with that specific threshold.

Relationship between Alerts and Playbooks:In Nutanix Intelligent Operations (X-Play), Playbooks are typically event-driven. The most common trigger is theAlerttrigger. The Playbook itself does not define the threshold (e.g., "95%"); rather, it waits for an Alert to fire.

Configuration:The administrator must configure a specific Alert Policy (e.g., "Critical Memory Usage") in Prism Central to trigger when Memory Usage exceeds 95%.

The Solution:By selecting"Change Trigger to be based off Critical Memory Usage Alert"(Option B), the administrator ensures the Playbook reacts specifically to the alert that corresponds to the 95% threshold. If the system was previously alerting at 100%, it implies the Playbook was linked to a different or default policy. Switching the trigger to the correct "Critical" policy (configured for 95%) solves the issue.

Autopilot (Option A):Autopilot is used totuneinfrastructure limits (like adding CPU/Memory) based on KPI targetsaftera playbook runs; it does not trigger the initial remediation playbook itself.

According to the Nutanix Prism Central Admin Guide, a category is a grouping of entities into key-value pairs. Categories are used to group entities (such as VMs, hosts, or subnets) based on specific criteria (e.g., Department: Marketing or Environment: Production).

Once entities are assigned to a category, administrators can link policies (such as security, protection, or automation playbooks) to the category rather than to individual entities. This allows for scalable and dynamic management, as any new entity tagged with that category will automatically inherit the associated policies.

Among the options provided, calm_unique is the standard built-in macro provided by the Self-Service engine.

Purpose:The @@{calm_unique}@@ macro generates a unique, short alphanumeric string at runtime.

Use Case:It is widely used in Blueprints to ensure uniqueness for VM names, hostname prefixes, or other resources that cannot have duplicate identifiers within the infrastructure (e.g., naming a VM Web-@@{calm_unique}@@ to prevent naming collisions).

Other Options:calm_date, calm_generate_uuid, and calm_math are not standard built-in macro names in the Self-Service macro library (though calm_time and calm_now exist for time-based operations).

To fully validate the integration between a Self-Service Project and a Playbook, the administrator must perform a test deploymentwithin the specific Project context.

Project Context:Playbooks often rely on triggers (like Categories) or parameters that are applied specifically by the Project's environment settings. Running the Playbook independently (Option A) only tests the script logic, not the trigger or the project-specific inputs.

End-to-End Validation:By deploying the blueprint associated with the Project (Option D), the administrator confirms:

The Project correctly provisions the resources (Quotas/Environment).

The Resources receive the correct Categories/Tags from the Project.

The Playbook Trigger successfully fires upon detecting these specific Project-derived events.

The Playbook executes successfully.

This is the only method that validates "both the Project and Playbook configurations" as a unified workflow.

To successfully enable and deploy Nutanix Self-Service (formerly Calm), thePrism Centralinstance must have a configuredFully Qualified Domain Name (FQDN).

Requirement:The Self-Service engine (Calm) runs as a set of containerized microservices. These services rely on internal certificates for secure communication and ingress routing.

Validation:During the enablement of the Self-Service feature, Prism Central validates that an FQDN is configured. If only an IP address is used, the enablement process may fail or the services may not function correctly because the certificate generation process requires a valid hostname to establish trust.

Contrast:While Network Segmentation (A) and SNMP (C) are supported features, they are not mandatory prerequisites for the basic deployment of the Self-Service engine.

Nutanix Self-Service defines several user roles, each with specific permissions.

Documentation describes theConsumerrole as:

Allowed todeploy applications from the Marketplace or assigned blueprints

Allowed to performday-2 operations(power actions, snapshots, etc.)

Restricted from modifying blueprints, environments, or project configurations

Ideal for end users who need access to deploy and manage their workloadswithout administrator capabilities

This matches exactly what the DevOps team requires.

Why the other roles are incorrect

Developer (A):Can modify blueprints and environments — too much privilege.

Project Admin (C):Full control over project resources — far more access than needed.

Operator (D):Used for automation and operational oversight, not end-user VM deployment.

Thus,Consumer (B)is the correct and intended role.

When troubleshooting or optimizing blueprints where complex operations (like Provisioning combined with detailed Network Configuration) frequently fail, the recommended best practice is to split the steps into smaller tasks.

In Nutanix Self-Service (Calm), theAudittab provides a sequential log of every task executed during an application's lifecycle. If provisioning and network configuration are bundled into a "single step" (e.g., a large script or a single package install), a failure makes it difficult to determine if the issue was with the VM creation, the OS boot, or the specific network parameter application.

By splitting the logic into distinct tasks (e.g., Task 1: Provision VM, Task 2: Configure Network), the administrator can:

Isolate the failure:The Audit log will clearly show "Provision VM: Success" and "Configure Network: Failed".

Validate inputs:It ensures the VM is fully available before attempting configuration.

Improve Auditing:Granular logs allow for faster root cause analysis of the "misconfigured parameters."

Retrying (Option B) or adding delays (Option D) are reactive measures that do not address the root cause of configuration errors, and disabling logging (Option C) hinders troubleshooting.

In Nutanix Self-Service (Calm),Endpointsare external execution targets used by Playbooks and Runbooks to run scripts or automation tasks. Nutanix documentation specifies the followingvalid Endpoint types:

Windows Endpoint

Linux Endpoint

Database Endpoints(e.g., PostgreSQL, MySQL)

HTTP/Webhook Endpoints

Calm identifiesWindowsandLinuxmachines as valid, manageable Endpoints, meaning administrators can run scripts, commands, and automation tasks on them.

Why the correct answer is B (Windows)

Windows is explicitly listed as a supported Endpoint type.It supports script execution (PowerShell), credential storage, and remote orchestration through Calm.

Why the other options are incorrect

❌A. API Gateway

An API Gateway isnot an Endpoint typein Self-Service; it is not used for script execution or orchestration.

❌C. CentOS

Although CentOS is a Linux distribution, Calm doesnotregister distribution-specific Endpoints like "CentOS."

Instead, it uses thegeneric Linux Endpoint type, not OS-specific entries.

Therefore, "CentOS" isnota selectable Endpoint type.

❌D. Kubernetes

A Kubernetes cluster can be integrated with Nutanix, but it isnot classified as a Playbook/Runbook Endpointin Self-Service.

Kubernetes resources are handled through Calm Blueprints—not through Endpoint registration for automation tasks.

In Nutanix Self-Service (Calm), Macros are used to reference variables and properties dynamically using the syntax @@{Entity.Attribute}@@.

Servicesare a primary supported entity for macros. You can reference properties of other services within the same application blueprint. For example, a web server service might need the IP address of a database service. This can be achieved using a macro like @@{Database_Service.address}@@. This allows for dynamic orchestration where values are populated at runtime based on the actual deployment details of the Service entity.

In Nutanix Self-Service,Projectsare the foundational organizational construct. Documentation states that Projects allow administrators to:

Groupusers and user groups

Assignroles(Consumer, Developer, Project Admin, etc.)

Defineresources(clusters, networks, images) allocated to that project

Attachblueprints, application profiles, and environments

Thus,Projects manage user grouping and role-based access, which matchesOption A.

Options B, C, and D do not represent Project functionality within Self-Service.

In Self-Service, anOperatorrole can:

Create blueprints

Modify blueprints

Add tasks (shell, PowerShell, script, package installs, etc.)

Use project-provided resources (images, networks, credentials)

To deploy a Linux VM with NGINX:

Asingle-VM blueprintis sufficient.

Developer must selectLinux substrate.

Installation of NGINX occurs througha shell taskin the blueprint’s package or service.

No additional permissions are required for an Operator to perform these actions.

Therefore, the correct answer isC.

When a Blueprint is designed to trigger external automation (like a Playbook via Webhook or API) or perform post-deployment actions (like applying categories via script), these actions must be explicitly defined asTaskswithin the Blueprint's lifecycle.

The Symptom:The VM provisioning (Substrate) succeeded, but the subsequent logic (Categories/Notifications) failed to happen.

The Cause:In Self-Service, simply creating a Blueprint does not automatically link it to an Intelligent Operations Playbook. The developer must add a specific task (e.g., an HTTP Request task targeting the Playbook trigger, or a specific "Execute Playbook" action) to theService Profile(specifically the Post-Create or Create phase).

If this task is missing, disabled, or misconfigured (e.g., wrong URL or payload), the VM will deploy, but the call to the Playbook will never occur, resulting in missing categories and notifications.

Option A is incorrect because deployment would not start at all without a Project. Option D is incorrect because Playbooks are not published to the Marketplace (Blueprints are).

Self-Service Domain-Specific Language (DSL)is the specific capability within Nutanix Self-Service (formerly Calm) that enablesInfrastructure-as-Code (IaC).

Definition:The Self-Service DSL is a Python-based domain-specific language that allows administrators and developers to define Blueprints, Runbooks, and Projects as code.

Functionality:Instead of using the Graphical User Interface (GUI), users can write Python code to describe the application structure, services, and logic. This code can then be version-controlled (e.g., in Git), reviewed, and deployed via the CLI, fulfilling the principles of Infrastructure-as-Code.

Contrast:While "Application Development" and "Orchestration" are broad concepts, theDSLis the specific tool/feature that delivers the IaC mechanism.

To enforce different configurations for different types of workloads within the same Project, Nutanix Self-Service usesEnvironments.

Environments:These are logical configurations within a Project that map to specific infrastructure settings. An administrator can define multiple environments (e.g., "Development" and "Production") within the "Engineering" project.

Category Assignment:Within each Environment configuration, the administrator can define specificVM Categoriesthat will be automatically applied to any VM provisioned into that environment.

Mapping:

Production Environment:Assign the category Protection: async_1hr_repl (Matches requirement: Asynchronous remote replication every 1 hour).

Development Environment:Assign the category Protection: snap_24_hr (Matches requirement: Daily snapshots).

Execution:When a user launches a blueprint, they select the target Environment (Dev or Prod). The system automatically tags the VMs with the categories defined in that environment, which in turn engages the Protection Policies associated with those tags.

Option B uses the wrong category values (sync_remote_repl instead of async). Options C and D suggest using Playbooks, but the native and most efficient method for applying deployment-time governance in Self-Service is via theProject Environmentsettings.

Comprehensive and Detailed Explanation

Self-Service supports provisioning into:

AWS

Azure

GCP

VMware

Nutanix AHV

To deploy into external clouds, Calm requires:

AProvider Account(credentials + API endpoints + permissions)

Assigned to theProject

Without a Provider Account, the Project cannot access cloud infrastructure and provisioning fails.

Documentation is explicit:

A Projectmusthave at least one Provider Account to enable cloud provisioning.

Thus the correct answer isD.

TheAccount(often referred to as theProvider Account) is the foundational prerequisite for any public cloud integration in Nutanix Self-Service.

Configuration Hierarchy:

Account (A):The administrator must first configure the Provider Account (e.g., AWS, Azure, GCP) in the Settings tab, providing the necessary API keys, Secret keys, or Service Principal credentials to establish the connection.

Project (B):Once the Account exists, it can be assigned to a Project.

Blueprint (D):Once the Project has access to the Account, Blueprints can be designed to target it.

Therefore, without theAccountconfigured first, the downstream components (Projects and Blueprints) cannot interface with the public cloud.

InIntelligent Operations (X-Play) Playbooks, the syntax for string interpolation (using parameters) differs from Self-Service (Calm).

Playbook Syntax:X-Play uses thedouble curly bracesyntax {{ ... }} to reference parameters.

Example:To reference the name of the entity that triggered the playbook, the correct parameter string is {{trigger[0].source_entity_info.name}} or {{trigger[0].alert_entity_info.name}} depending on the trigger type.

Contrast:@@{...}@@ (Option B) is the syntax used inSelf-Service (Calm)macros, not X-Play Playbooks.

In the Nutanix Self-Service (Calm) Blueprint lifecycle, tasks are executed in a specific order relative to the provisioning of the infrastructure (Substrate).

Pre-Create Task:This is the specific phase designed to run scripts or set variablesbeforethe VM provision call is sent to the provider (AHV).

Workflow:

The developer creates a pre-create task (e.g., a Python script) to generate the custom hostname string based on logic (e.g., date, user input, or sequence).

The script outputs this string to a variable (e.g., @@{vm_hostname}@@).

The VM Service configuration (Substrate) references this variable in the "VM Name" or "Hostname" field.

Execution:When the blueprint launches, the pre-create task runs first, populates the variable, and then the VM creation occurs using that calculated name.

Tasks in post-create or package-install (Options B and C) runafterthe VM has already been provisioned and named, making them too late for this requirement.

To automate actions based on a signal from a third-party monitoring tool, the administrator should use the Webhook Trigger in Nutanix Intelligent Operations (X-Play).

Webhook Trigger:The administrator creates a playbook that starts with a Webhook Trigger. This generates a unique URL.

Integration:The third-party tool is configured to send an HTTP POST request (the notification) to this unique URL when the "low capacity" threshold is reached.

Automation:Receiving this signal automatically triggers the playbook to execute the expansion tasks (e.g., calling APIs to provision more VDI nodes or expand storage), removing the manual step.

While "Alert" (Option D) is used for native Nutanix alerts, the "Webhook" is the designated mechanism for receiving external events.

Nutanix Calm documentation states thatApplication Profiles (App Profiles)define:

Default variable values

Deployment targets (cluster, subnet, environment)

Runtime configuration differences across environments

App Profiles act aslogical deployment configurationswithin a blueprint, allowing the same blueprint to be deployed differently across staging, test, or production environments.

Thus, the correct answer isC. App Profiles.

In Nutanix Self-Service (Calm), applications deployed through Projects can performSnapshot actionson VMs. Snapshot expiration is governed bySnapshot Policies, which define:

Retention period

Number of snapshots to retain

Expiration / deletion schedule

Nutanix documentation specifies thatsnapshot expiration is controlled at the Environment level, which belongs to aProject. When a Snapshot action is executed through Self-Service, Calm references theSnapshot Policy associated with that Environmentto determine how the snapshot will be retained and when it will expire.

Thus, to enforce expiration on snapshots taken from Self-Service:

✔You must create a Snapshot Policy for the Environments in the Project.

Why the other options are incorrect

❌B. MST (Multicloud Snapshot Technology)

MST is used for cross-cloud replication and storage integration—not for setting snapshot expiration policies.

❌C. Approval Policy

Approval Policies govern user-request approval workflows, not snapshot retention.

❌D. Protection Domain

Protection Domains are for DR replication and do not manage snapshot expiration for Calm Self-Service actions.

The feature within Nutanix Self-Service (Calm) designed specifically for publishing blueprints to end-users is theMarketplace.

Marketplace:This component acts as an app store for the organization. Administrators and developers create Blueprints and thenpublishthem to the Marketplace.

Process:The "Marketplace and Application Management" capability encompasses the workflow of submitting a blueprint for approval, versioning it, and making it visible to users based on their Project entitlements.

Consumption:Once published, users do not access the raw blueprint design canvas; instead, they access the Marketplace Item to launch (consume) the application.

While "Unified Multi-Cloud Orchestration" describes the platform's broad goal, and "DSL" is a method for creating code-based blueprints, "Marketplace" is the specific functional area for publishing and consumption.

The placement of applications in Nutanix Self-Service is dictated by the intersection of theProjectconfiguration and theBlueprintdefinition.

Project Construct:The Project defines which infrastructure accounts (Providers) are available for use (e.g., AHV, AWS, Azure). If the Project is configured to allow access tobothAWS and another provider (like on-prem AHV or Azure), the potential exists for deployment to those targets.

Blueprints:The Blueprint (or the specific Environment selected at launch) dictates where the workload actually goes. If the administrator intended "Only AWS," but the Project allows multiple providers and the Blueprints (or the users launching them) are configured to use a non-AWS environment, the application will be deployed there.

Therefore, the cause is that theProject construct(allowing multiple clouds) and theBlueprints(utilizing those available clouds) are configured to allow this distribution. To restrict it, the administrator should remove the unintended providers from the Project's "Infrastructure" or "Environment" settings.

To scale out a Self-Service (formerly Calm) deployment from a single Self-Service VM (SSVM) to a multi-node cluster, the administrator must follow a migration-style procedure rather than an in-place expansion. According to the Self-Service Administration and Operations Guide section onSetting up Scale-Out Self-Service VM:

Backup:The process involves destructive cluster commands, so the administrator must first take a backup of the existing Self-Service data.

Deploy New VMs:The administrator must deploythree new Self-Service VMsusing the provided OVA/template. This ensures a clean, uniform environment for the new cluster. (Adding nodes to an existing, potentially drifted single node is not the standard procedure).

Restore and Cluster:The administrator must then run the specific cluster creation commands (such as cluster create with the IPs of the three new nodes) andrestorethe Self-Service data and configuration from the backup to the new cluster to retain all projects, blueprints, and users.

While the exact order of "Restore" and "Cluster Create" involves technical nuance (creating the service capabilities then populating the data), the key differentiator is that the administrator must deploythree new SSVMs(Migrate) rather than just adding two to the existing one, and must explicit perform arestoreoperation to migrate the data.

When creating a Runbook that involves power cycling a VM (Restart), there is a gap in connectivity while the Guest OS reboots and network services initialize.

If the Runbook moves immediately from the "VM Restart" task to the "Add new credential" task (which likely uses SSH or PowerShell to connect to the VM), the connection will fail because the VM is not yet accessible.

To correct this, the administrator must insert a Delay task between the restart and the configuration step.

The sequence should be:

VM Restart:Initiates the reboot.

Delay:Pauses the runbook execution for a set duration (e.g., 60-120 seconds) to allow the OS to boot.

Add new credential:Executes the script once the VM is back online.