NCP-CI-AWS Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam Questions and Answers

With the Nutanix AOS Pro licensing, several advanced features and add-on products become available. Specifically, in the AWS cluster deployment wizard, the following add-ons are available:

Files:

Nutanix Files provides a software-defined, scale-out file storage solution that simplifies the management and scaling of unstructured data.

Advanced Replication:

Advanced Replication features in Nutanix include synchronous and asynchronous replication capabilities, allowing for robust disaster recovery and data protection solutions.

DARE (Data-At-Rest Encryption):

DARE ensures that all data stored on Nutanix clusters is encrypted, providing a higher level of security for sensitive information.

These features are included in the AOS Pro licensing tier, offering enhanced data management, protection, and security capabilities.

Nutanix Licensing Guide

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Advanced Features

The scalability of Nutanix Cloud Clusters (NC2) on AWS is a critical architectural consideration for high-growth environments. While earlier versions or specific regions might have different baseline limits, the maximum size for a single NC2 cluster on AWS is officially supported up to28 nodes. This limit is designed to balance the performance benefits of the Nutanix Distributed Storage Fabric (DSF) with the underlying AWS bare-metal infrastructure and networking constraints. Expanding a cluster to this size allows for significant workload consolidation and high availability within a single management domain. Administrators must ensure that their AWS account quotas and VPC subnet sizing are sufficient to accommodate the vCPU and IP address requirements associated with a 28-node deployment to prevent provisioning failures.

For mission-critical workloads, the Recovery Time Objective (RTO) is a primary concern.

Multicloud Snapshot Technology (MST)coupled with aPilot Light Deploymentprovides the necessary infrastructure to support an automated recovery plan. In a Pilot Light scenario, a small, " always-on " version of the Nutanix cluster (usually the minimum number of nodes) is maintained in AWS to host Prism Central and handle background replication tasks. Because the management layer is already active, recovery plans can be fully automated to power on VMs and adjust networking instantly upon failure. In contrast, a " Zero Compute " deployment lacks an active management interface, requiring manual intervention to provision a cluster before recovery can begin, which significantly increases RTO and prevents full automation.

To successfully onboard an AWS account into the NC2 console, the administrator must deploy a specific CloudFormation stack that establishes the necessary trust relationship and permissions. This process is highly sensitive as it involves the creation of IAM roles that allow Nutanix to orchestrate AWS resources. Consequently, the user executing this script must possessIAMFullAccessto create and modify these security identities andAWSCloudFormationFullAccessto manage the lifecycle of the stack itself. Without these high-level administrative permissions, the deployment will fail, preventing NC2 from obtaining the " secret " keys and roles required to launch bare-metal instances. This one-time setup is fundamental to the security architecture of the hybrid cloud environment.

While NC2 bare-metal instances come with high-performance local NVMe storage, many organizations require additional capacity to support large data sets or long-term storage needs. For instance types that support Amazon EBS attachment, theminimum number of additional EBS volumesthat can be added per node is1. Adding even a single EBS volume allows the Nutanix cluster to expand its storage pool beyond the physical limitations of the bare-metal chassis. Administrators can then increase this capacity as needed, although once attached, these volumes typically cannot be removed or decreased. This flexibility is key for scaling storage-intensive applications without necessarily increasing the compute node count, thereby optimizing the overall TCO of the cloud cluster.

ThePrism Central Marketplaceserves as the centralized hub for discovering, enabling, and managing various Nutanix services and integrated technologies. For administrators deploying NC2 on AWS, the Marketplace is the designated environment to verify the compatibility and support status ofMulticloud Snapshot Technology (MST). Within this interface, the system provides documentation and automated workflows that confirm the best installation process for the specific environment. This ensures that the required software versions and dependencies are met before attempting to protect workloads to cloud object storage like Amazon S3. Utilizing the Marketplace simplifies the " Day Two " operational tasks by providing a validated path for deployment rather than relying on manual configuration or external templates.

When deploying Windows Server workloads on NC2 on AWS without existing licenses, administrators must carefully choose the tenancy and licensing model to remain compliant with Microsoft ' s cloud mobility rules. For a new deployment where " Bring Your Own License " (BYOL) is not an option due to the lack of existing licenses with Software Assurance, the administrator should select Shared Tenancy with License-included instances. This configuration ensures that the cost of the Windows OS is included in the hourly rate of the bare-metal instances provisioned by AWS. Although the question ' s source Answer (A) lists " BYOL, " standard Nutanix/AWS best practices for unlicensed environments dictate using License-included options on Shared Tenancy to provide the most cost-effective and compliant path for Windows-based virtual machines in the cloud.

To backup Prism Central configuration data to an Amazon S3 bucket, thepcdr-clicommand with theprotectparameter is used. This parameter is specifically designed for creating protection policies and backing up Prism Central data.

Nutanix Prism Central Documentation

Nutanix pcdr-cli Command Reference

To control network traffic at the individual User VM (UVM) subnet level, creating a custom security group is the appropriate action. This approach allows for fine-grained control over inbound and outbound traffic rules that can be applied to specific subnets or individual instances within those subnets.

Custom Security Group:

Custom security groups enable administrators to define specific traffic rules tailored to the needs of individual subnets or VMs. This includes specifying allowed IP ranges, ports, and protocols.

By applying these custom security groups to the UVMs, the organization can control access and enhance security according to their policies and requirements.

Steps to Create a Custom Security Group:

Navigate to the AWS Management Console and go to the VPC service.

Select " Security Groups " under the " Security " section.

Click on " Create Security Group " and define the name, description, and VPC.

Add inbound and outbound rules according to the desired traffic control policies.

Attach the custom security group to the UVMs or subnets in question.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Security Group Documentation

Nutanix Best Practices for Security Groups

While Nutanix provides multiple management interfaces, each serves a distinct purpose in the hybrid cloud lifecycle. Prism Central and Prism Element are used for managing software-level entities like VMs, storage containers, and replication policies. However, for thedefinitive status of the cluster ' s cloud infrastructure—including whether the bare-metal nodes are provisioned, if the cluster is in a " Healthy, " " Degraded, " or " Failed " state, or if a " boot timeout " has occurred—administrators must usethe NC2 Portal. The NC2 Portal acts as the primary orchestration layer that bridges Nutanix and AWS; it is the only console that displays specific cloud deployment tasks, hardware replacement status, and AWS-raised infrastructure events in a unified view.

Synchronous replication requires extremely low latency (typically sub-5ms) and high throughput between the primary and secondary storage controllers. While Flow Virtual Networking (FVN) supports various multi-VPC architectures, the most robust and supported configuration for synchronous replication within a single AWS region is to ensure that both clusters reside within the same AWS VPC. This placement minimizes network hops and avoids the additional latency that might be introduced by VPC Peering or Transit Gateway traversal between separate VPCs. By sharing the same VPC, the clusters communicate over the same high-speed internal AWS network fabric, providing the deterministic performance and zero-RPO data protection required for synchronous data writes and Metro Availability configurations.

The exhibit shows two cloud accounts, one for Azure and one for AWS, with their statuses indicated. The AWS cloud account status is marked as " U " (which likely stands for " Unavailable " or " Unreachable " ). This indicates that the AWS cloud account configuration is not properly connected or accessible.

Status Check:

The AWS cloud account is marked with an " U " status, meaning it is not active or accessible.

This status prevents the creation of an NC2 cluster because the necessary cloud resources cannot be allocated or managed without a proper connection.

Action:

The best course of action is to create a new cloud account in the organization. This involves setting up the cloud account details correctly and ensuring it is properly configured to communicate with Nutanix and AWS.

Steps to Create a New Cloud Account:

Log in to the Nutanix console.

Navigate to the " Organizations " section.

Select " Add Cloud Account " and provide the required AWS credentials and permissions.

Ensure the new cloud account is active and correctly configured.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Cloud Account Management

The administrator has not created the necessary Security Group:

The error message indicates that the creation of network interfaces in a shared subnet requires specifying a security group. This means that the necessary security group has not been created or assigned to the network interfaces.

Creating the appropriate security group and ensuring it is associated with the network interfaces during cluster deployment should resolve this issue.

Refer to AWS documentation on security groups and network interface configuration and Nutanix documentation on prerequisites for deploying NC2 clusters in an existing AWS VPC.

In an NC2 heterogeneous cluster (mixing different host types), the ability to addAmazon EBS volumesfor supplemental storage capacity is governed by both host compatibility and cluster redundancy rules. First, the administrator must ensure that the selected host types actually support EBS attachment; if the current selection does not, they mustadd a host type that supports EBS volumes. Second, the cluster must maintain its Replication Factor (RF) integrity. If the number of nodes for a specific storage-heavy host type is not amultiple of the RF(e.g., needing 4 nodes for RF2), the system may restrict storage expansion to prevent data unavailability during a failure. By ensuring the node count aligns with RF requirements and using compatible bare-metal instances, the administrator can unlock the EBS volume configuration options within the deployment workflow.

Successful onboarding of an AWS environment into the Nutanix Cloud Clusters ecosystem requires a precise set of administrative permissions to be present on the account used for initial configuration. Specifically, the AWS user must haveCreateRoleFullAccessto allow the automated scripts to generate the necessary service-linked roles. Additionally, the user must possessIAMFullAccessto manage identity policies andAWSCloudFormationFullAccessto execute the deployment templates. This specific combination ensures that the NC2 portal can correctly configure the " Cross-Account Role " which serves as the primary communication bridge between the Nutanix management plane and the AWS infrastructure APIs. Failing to provide any of these three core permissions will result in an " Insufficient Permissions " alert during the cloud account registration process.

Deploying NC2 on AWS requires the creation of specific IAM roles and policies to allow the Nutanix service to manage AWS resources like EC2 instances and VPCs. This is typically handled by an automatedCloudFormation stack. For this process to succeed, the AWS user executing the script must possess high-level administrative permissions. Specifically, they requireIAMFullAccessto create the necessary roles andAWSCloudFormationFullAccessto deploy and manage the stack itself. Without these permissions, the CloudFormation template will fail to create the security identities required for the NC2 console to communicate with the AWS API. This is a one-time prerequisite for onboarding the AWS account into the NC2 organization.

Nutanix offers a free trial to allow organizations to test NC2 capabilities.

This trial is flexible; users can initiate a separate 30-day free trial for each supported cloud provider, such as AWS and Azure, allowing for independent evaluations of different cloud environments. It is important to note that the " free " aspect of the trial applies only to theNutanix software licensing. The user is still responsible for allAWS infrastructure costs(bare-metal instances, storage, and data transfer) incurred during the trial period. Additionally, users are not restricted to the trial alone; they can choose to activate aPay-As-You-Go (PAYG)subscription even while the free trial is active to ensure a smooth transition to production after the evaluation ends.

TheCluster Protectfeature is the native Nutanix solution designed specifically for NC2 on AWS to protect both the cluster data and thePrism Centralmanagement instance. Unlike standard replication, Cluster Protect utilizesAmazon S3 bucketsto store snapshots of the cluster configuration, Prism Central metadata, and User VM data. This is considered the " best way " for native protection because the entire recovery workflow is orchestrated directly from theNC2 console. If a cluster or an entire Availability Zone fails, the administrator can use the NC2 portal to redeploy the cluster and restore the Prism Central instance and data from the S3 bucket, eliminating the need for third-party backup software while maintaining a simple cloud-native recovery path.

To add an AWS account to the NC2 console, an AWS IAM user needs to be configured with the appropriate permissions to manage the EC2 resources. The required permission for the IAM user includes full access to manage EC2 instances, volumes, and related resources.

AmazonEC2FullAccess:

This permission grants full access to all EC2 resources, including the ability to create, modify, and delete instances, volumes, security groups, and more.

Essential for NC2 operations to manage the lifecycle of EC2 instances and associated components within the AWS environment.

Why Not Other Permissions:

IAMFullAccess: Grants full access to IAM resources but not specifically needed for EC2 operations.

IAMReadOnlyAccess: Only provides read access to IAM resources, insufficient for managing EC2 instances.

AmazonEC2ReadOnlyAccess: Provides read-only access to EC2 resources, insufficient for creating or modifying instances and other resources.

AWS IAM Policies Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for IAM User Permissions

When using the Nutanix Cluster Protect feature to recover a failed NC2 cluster on AWS, and the management Prism Central (PC) instance is hosted on a separate, healthy cluster, a specific orchestration sequence must be followed. The process begins in the NC2 console, where the administrator must manually change the status of the cluster to Failed. This step is critical as it signals the portal to initiate the recovery workflow and release associated cloud resources. Next, the administrator uses the console to redeploy the cluster, which provisions new bare-metal instances and installs the AOS software. Once the infrastructure is ready, Multicloud Snapshot Technology (MST) must be redeployed or re-enabled on the new cluster to re-establish the connection to the Amazon S3 bucket containing the snapshots. Finally, the User VMs (UVMs) are recovered and hydrated from these snapshots. This specific order ensures that the target environment and management links are fully operational before data restoration commences.

The Cluster Protect feature, which provides data protection and disaster recovery capabilities for Nutanix clusters, requires either the AOS Ultimate or NCI Ultimate license. These licenses include the necessary features to leverage Cluster Protect for ensuring data resilience and recovery.

Nutanix Documentation - Cluster Protection Features

Nutanix AOS 6.7 New Features

The clusters that are to be protected must be registered with the same instance of Prism Central (Answer C):

For Cluster Protect to function correctly, all clusters intended for protection must be registered under the same Prism Central instance. This ensures consistent management and coordination of protection policies and operations across clusters.

The Cluster Protect feature requires AOS version 6.7 or higher (Answer D):

Cluster Protect is a feature that is available starting from AOS version 6.7. To utilize this feature, ensure that the Nutanix clusters are running this version or a newer one.

Nutanix Cluster Protection Documentation

Nutanix AOS Release Notes

For issues related to cloud hardware support such as EC2 instances, VPC, etc., the public cloud vendor (AWS in this case) should be contacted. AWS provides support and documentation for their infrastructure and services, ensuring that users can get assistance for any hardware or cloud-specific queries.

Nutanix Support and Insights

Cluster Protect in an NC2 environment can protect and recover the following services and their associated metadata:

VM Templates: Ensures that templates used for creating virtual machines are backed up and recoverable.

Files: Protects data stored in Nutanix Files, ensuring that file services are backed up and can be restored as needed.

Nutanix Support and Insights

Nutanix Cloud Clusters on AWS Administration

For a VM to be accessible over the internet through a load balancer, the VM itself must have a public IP address.

In this case, the health check for the VM target is failing and the DNS returns a " NOT Found " message because web-1 does not have a public IP assigned.

Without a public IP, the load balancer cannot route traffic to web-1 from the internet.

Assigning a public IP to web-1 ensures that the VM can be accessed via the load balancer, resolving the connectivity issue.

Refer to the AWS documentation on network load balancers and public IP assignments, and Nutanix documentation on VM network configurations.

Gateway Endpoint:

A Gateway Endpoint in AWS allows you to connect to supported AWS services privately without going through the public internet. This setup provides secure and efficient connectivity directly from the corporate VPC to the required AWS services.

Gateway Endpoints support services such as Amazon S3 and DynamoDB and are ideal for scenarios where private connectivity to these services is needed.

Refer to the AWS documentation on VPC endpoints, specifically Gateway Endpoints, and the Nutanix documentation on configuring private connectivity for NC2 deployments.

When configuring a syslog server in the Prism Central Admin Center for Nutanix, one of the available log modules is Acropolis.

The Acropolis module logs system events related to the Nutanix Acropolis operating system, which is critical for monitoring and auditing system activities and performance.

Configuring syslog with the Acropolis module ensures that important events and issues related to the Acropolis environment are captured and can be forwarded to an external syslog server for centralized logging and analysis.

Refer to the Nutanix documentation on Prism Central and syslog configuration for the full list of available log modules and detailed steps for configuration.

Enable IGMP snooping on the AHV hosts:

IGMP (Internet Group Management Protocol) snooping is a feature that listens to IGMP traffic between hosts and routers. By enabling IGMP snooping on the AHV (Acropolis Hypervisor) hosts, the switch can intelligently forward multicast traffic only to the ports that have requested it.

This reduces unnecessary multicast traffic on the network and prevents congestion by ensuring that multicast packets are only delivered to the appropriate endpoints.

Refer to the Nutanix documentation on network configuration and best practices for managing multicast traffic.

Given the company ' s large spend commitments as part of an AWS Enterprise Discount Program (EDP) totaling $15 million, purchasing Nutanix licenses through the AWS Marketplace ensures that the costs contribute to the EDP commitment.

This approach integrates the Nutanix license costs into the overall AWS spend, thereby maximizing the benefits of the EDP.

Purchasing directly from Nutanix or leveraging existing licenses might not count towards the AWS EDP commitment, and trial licenses are typically for evaluation purposes and do not contribute to the committed spend.

Refer to the Nutanix and AWS documentation on licensing and marketplace purchases, and EDP program details.

The requirement for two private subnets in the NC2 cluster configuration workflow serves the same purposes:

One subnet is designated for user VMs, ensuring user workloads are separated from management operations.

The other subnet is designated for cluster management, maintaining the integrity and security of management processes and internal communications.

Nutanix Clusters on AWS Deployment Guide

Nutanix Cloud Clusters on AWS Administration

For a new NC2 on AWS deployment where workload VMs have low storage and memory requirements but high CPU frequency ( > 3.0 GHz) requirements, and the goal is to minimize the number of CPU cores to reduce application licensing costs, thei3.metalinstance type is the most suitable.

i3.metal:

High CPU Frequency: i3.metal instances offer high-frequency Intel Xeon processors (up to 3.1 GHz) which meet the high CPU frequency requirement.

Low Storage and Memory: These instances come with a balanced amount of storage and memory, suitable for workloads with low requirements in these areas.

Minimized CPU Cores: i3.metal instances have fewer CPU cores compared to other high-frequency instances like i4i.metal, making them ideal for minimizing application licensing costs.

Other Instance Types:

z1d.metal: While also offering high CPU frequency, these instances typically come with a higher core count and more memory, which may not be optimal for minimizing licensing costs.

i4i.metal: Designed for I/O intensive applications with higher core counts.

m5d.metal: Balanced instance type but with more cores and not as high CPU frequency as required.

AWS EC2 Instance Types Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Instance Selection

To establish full connectivity between the company’s on-premises datacenter and the AWS cloud, the following AWS offerings will satisfy this requirement:

AWS VPN: This service allows you to create a secure connection between your on-premises network or other remote network and your AWS VPC using an IPsec VPN tunnel. It is suitable for low to moderate bandwidth requirements and provides secure, encrypted connections.

Direct Connect: AWS Direct Connect is a dedicated network connection from your premises to AWS. It provides a private, high-bandwidth, low-latency connection which is ideal for high-throughput applications and workloads that need consistent network performance.

AWS VPN Documentation

AWS Direct Connect Documentation

When a " boot timeout " alert occurs during a cluster expansion, it often indicates that the NC2 console requested a new instance from AWS, but the instance failed to reach a " healthy " state within the allotted time. While networking can be a factor, common " hard " stops at the AWS API level includeService QuotasandInstance Limits. AWS accounts have default limits on the number of bare-metal instances (like i3.metal or i4i.metal) that can be active in a single region. If the expansion request exceeds thevCPU quotaor the specificinstance type limit, AWS will deny the request or fail to provision the hardware. Administrators must verify these quotas in the AWS Service Quotas console and request an increase to support the additional nodes required for the Nutanix cluster.

To avoid IP address conflicts and ensure there are no configuration issues when reusing an existing AWS subnet, the administrator should take the following actions:

aCLI > net.add_to_ip_blacklist 10.79.4.200 aCLI > net.add_to_ip_blacklist 10.79.4.201 (Answer A):

This command adds the specified IP addresses to the blacklist, preventing AHV IPAM from assigning these addresses to any VMs. This ensures that the existing EC2 instances with IPs 10.79.4.200 and 10.79.4.201 are not allocated to other VMs in the NC2 cluster.

Configure the AHV IPAM to use DHCP range 10.79.4.2 -10.79.4.253 (Answer D):

By configuring the AHV IPAM to use a specific DHCP range, you ensure that the IP addresses assigned to the EC2 instances (10.79.4.200 and 10.79.4.201) are not included in the DHCP pool. This prevents IP address conflicts within the subnet.

Nutanix aCLI Reference

Nutanix NC2 on AWS Documentation

AWS VPC and Subnet Basics

Nutanix offers tailored licensing models for different workload types within NC2 to optimize costs. ForVDI-specific clusters, Nutanix utilizes auser-based consumption model. In this scenario, pricing is determined by the number of concurrent users, which is ideal for elastic desktop environments where the number of active VMs fluctuates. Conversely,general-purpose clusterstypically default to acapacity-based method. Here, consumption is calculated based on the total provisioned capacity (cores or TiB) of the cluster, providing predictable costs for steady-state server workloads. These models allow organizations to align their software spend directly with their actual resource utilization patterns. It is important to note that switching between portfolio types (NCI and AOS) is generally restricted once a cluster is deployed.

To achieve anRTO (Recovery Time Objective)as low as15 minutesusing Multicloud Snapshot Technology, aPilot Light Deploymentis essential. In this model, a minimal Nutanix cluster is always active in the cloud. This active presence ensures that the Prism Central management layer is ready to receive recovery commands and that the storage containers are already mounted. Because the " compute " is already provisioned, the recovery process simply involves hydrating the snapshots from the S3 bucket and powering on the VMs according to the Recovery Plan. A " Zero Compute " model would exceed this RTO because the time required to provision new bare-metal instances from AWS and initialize the Nutanix software can take significantly longer than 15 minutes.

In the NC2 console, an organization is used to segregate clusters based on specific requirements. This segregation allows administrators to manage clusters more effectively by grouping them according to business units, projects, or other criteria. This organizational structure helps in maintaining clear boundaries and applying specific policies or permissions to different clusters within the same NC2 environment.

Nutanix Cloud Clusters on AWS Administration

Nutanix Certified Professional - Cloud Integration - AWS

To manually hibernate an NC2 on AWS cluster, the administrator can use the following methods:

Select the cluster under NC2 console and Select Hibernate/Resume on the cluster sur page: Navigate to the specific cluster in the NC2 console and use the provided Hibernate/Resume option.

Log into NC2 console, find the cluster name and select Hibernate/Resume from the ellipses: Access the NC2 console, locate the cluster name, and select the Hibernate/Resume option from the ellipses (three dots) menu.

These options allow for the manual control of the cluster ' s hibernation state directly within the NC2 console interface.

Nutanix Cloud Clusters on AWS Administration

Nutanix Support and Insights

When setting up a landing zone for Nutanix clusters on AWS, having only private subnets for cluster management and user VMs is not sufficient for full cluster functionality. Nutanix clusters often need to communicate with the internet for updates, patches, and other cloud services.

VPC Configuration:

The VPC already has two private subnets (one for cluster management and one for user VMs).

Additional Requirements:

To access public services like S3 or for the cluster nodes to reach Nutanix services for updates, a public subnet is essential.

Why Public Subnet for Internet Access?:

A public subnet allows resources within it to communicate directly with the internet, which is necessary for accessing Nutanix ' s update servers, applying patches, and other maintenance tasks.

This subnet typically includes an internet gateway, enabling instances in the public subnet to receive and send traffic directly to the internet.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Networking Best Practices

Nutanix Networking and Subnet Configuration Guidelines