NCP-CN Nutanix Certified Professional - Cloud Native (NCP-CN-6.10) Questions and Answers

NKP Platform Applications (e.g., Rook Ceph, Prometheus, Fluent Bit) are pre-integrated tools that can be deployed to Kubernetes clusters within a workspace to provide services like storage, monitoring, and logging. The NKPA course specifies that to deploy a platform application to all clusters in a workspace from the command line, the engineer uses thenkp create appdeploymentcommand. This command creates an application deployment resource that targets the specified workspace and clusters.

The required parameters include theapplication ID(to identify the platform application), theversion(to specify the desired version of the application), and theNKP workspace(to define the scope of clusters). For example: nkp create appdeployment --app-id prometheus --version 2.30.0 --workspace fin-vd. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Use the nkp create appdeployment command to deploy platform applications, specifying the application ID, version, and target workspace to apply the deployment across all clusters in that workspace.”

Incorrect Options:

B. nkp deploy platform-app: This is not a valid NKP command. The correct command is nkp create appdeployment.

C. nkp deploy app: This is not a recognized command in the NKPA documentation.

D. kubectl create appdeployment: kubectl interacts with Kubernetes resources, not NKP-specific platform applications.

The NKPA course specifies that the Nutanix Image Builder (NIB), used for creating custom machine images for NKP cluster nodes, supports specific Linux distributions that are compatible with Nutanix infrastructure and Kubernetes requirements. For NKP v2.12.x, the supported distributions for NIB areUbuntuandRocky Linux, as these are tested and optimized for NKP deployments, ensuring stability and compatibility with Cluster API (CAPI) and Nutanix AHV.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP Image Builder (NIB) supports Ubuntu and Rocky Linux as base distributions for creating custom images for NKP cluster nodes, ensuring compatibility with Kubernetes and Nutanix infrastructure.” Ubuntu provides a widely-used, well-supported base with long-term support (LTS) versions, while Rocky Linux is a CentOS replacement that Nutanix has adopted for its reliability and enterprise focus, especially after CentOS 8’s end-of-life in 2021.

Incorrect Options:

B. Fedora: Fedora is not a supported distribution for NIB in NKP, as it is more suited for bleeding-edge development rather than production Kubernetes environments.

D. CentOS: CentOS 8 reached end-of-life in December 2021, and Nutanix has shifted to Rocky Linux as its replacement for NKP image building. The course does not list CentOS as a supported option for NIB in NKP v2.12.x.

As outlined in theNKPA 6.10 documentation,Gossis used tovalidatethat an OS image meets the requirements to serve as an NKP node (such as the presence of required packages, kernel modules, and system settings). Goss is not used to modify or harden the image; rather, it validates conformance.

Key reference:

“During the image build process, Goss tests validate that the image meets the required standards for use as a Kubernetes node in NKP deployments.”

The NKP documentation recommends using a combination of RBAC assignments and exported manifests to manage access across multiple clusters. By exporting the role assignments to YAML, the engineer can consistently apply these settings across the different environments, ensuring the new team has the necessary resources and limits. This approach is especially useful for environments with multiple clusters and standardized configurations.

The exhibit shows the NKP UI with the "Create Cluster" option grayed out in a new workspace, indicating that a prerequisite for cluster creation is missing. The NKPA course explains that to create a new Kubernetes cluster in a workspace, anInfrastructure Providermust be configured for that workspace. An Infrastructure Provider defines the underlying infrastructure (e.g., Nutanix AHV, AWS, vSphere) where the cluster will be provisioned, and without it, the Create Cluster option remains disabled in the UI.

The NKP Ultimate license supports creating clusters across various infrastructures, but the workspace must be associated with an Infrastructure Provider to enable cluster creation. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Before creating a cluster in a new workspace, ensure an Infrastructure Provider is configured for the workspace in the NKP UI; otherwise, the Create Cluster option will be grayed out.” The engineer should navigate to the Infrastructure Providers section in the NKP UI (typically under the Global or Administration view), create a provider (e.g., for Nutanix AHV, AWS, or vSphere), and associate it with the workspace. Once this is done, the Create Cluster option will become available.

Incorrect Options:

A. Create the cluster only using YAML and not the GUI: The issue is not with the GUI itself but with the missing Infrastructure Provider, which affects both GUI and CLI cluster creation. YAML alone does not resolve this.

B. Attach existing clusters instead of creating a new cluster: Attaching existing clusters is an alternative but does not address the requirement to create a new cluster.

D. Ensure NKP is upgraded to a minimum version of 2.12: The NKP Ultimate license implies a recent version, and the course does not indicate that version 2.12 is specifically required for this functionality. The issue is configuration-related, not version-related.

In an air-gapped NKP deployment, the Konvoy bootstrap image (used to create the bootstrap cluster) must be available locally on the bastion host or in a private registry. The NKPA course specifies that after extracting the NKP Air-Gapped Bundle, the bootstrap image (e.g., konvoy-bootstrap-image-.tar) is a tarball that needs to be loaded into the Docker daemon on the bastion host before creating the bootstrap cluster.

The most viable command isdocker load -i konvoy-bootstrap-image-<version>.tar(Option A). This command loads the tarball into the local Docker daemon on the bastion host, making the image available for the nkp create bootstrap command to use. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In an air-gapped environment, load the Konvoy bootstrap image on the bastion host using docker load -i to make it available for creating the bootstrap cluster.” After loading, the engineer can optionally tag and push the image to the private registry if needed, but the question focuses on loading the image on the host, which this command accomplishes.

Incorrect Options:

B. docker image tag: This command is syntactically incorrect (version appears twice, and .tar is not part of a tag). Tagging is a subsequent step after loading, not the primary action to load the image.

C. nkp push bundle: This is not a valid command for loading an image; it’s closer to a bundle management action, but the syntax is incorrect.

D. nkp load image: There is no nkp load image command in NKP; loading images is done via docker load.

TheSecure Tunnelfeature in NKP relies on HTTPS (TCP port 443) to establish secure, encrypted connections between the attached cluster and the management cluster, enabling fleet management even in restricted network environments.

Exact extract:

“Secure Tunnel uses TCP/443 (HTTPS) for establishing a secure connection between the attached cluster and NKP.”

TheNKPA 6.10 documentationand Nutanix Best Practices recommend using workspaces to segment cluster deployments and their associated infrastructure providers, as well as to manage access control through RBAC. The typical workflow is:

Create an NKP workspace dedicated to the R&D environment.

Create an infrastructure provider (e.g., vSphere, AHV) scoped to that workspace.

Create an NKP group for the R&D team and assign admin roles to this group within the workspace.

Deploy workload clusters in this workspace, leveraging the scoped infrastructure provider.

This ensures that:

The R&D team has full administrative control over their resources.

Clusters and infrastructure are logically isolated in the R&D workspace.

RBAC policies are applied cleanly within the workspace context.

According to theNKPA 6.10 documentationunder the “Preparing for FIPS Compliance” section, the first step for enabling FIPS in an NKP environment is to ensure that the underlying operating system (OS) or OS images are correctly configured for FIPS mode. The Nutanix Kubernetes Platform can only leverage FIPS-compliant cryptographic modules if the underlying OS is already configured for FIPS operation.

Specifically, the documentation states:

"Before enabling FIPS in NKP, ensure that the OS or OS images are prepared and configured to operate in FIPS mode, following the vendor’s guidelines. Once the OS is in FIPS mode, the NKP cluster components can be provisioned with FIPS support."

This foundational step is critical to ensure cryptographic consistency and compliance throughout the NKP stack.

The NKPA course details the default node preparation process for NKP cluster nodes, which involves creating a machine image that is compliant with Cluster API (CAPI) standards. The primary tool used in this process isPacker, which automates the creation of machine images by provisioning a base OS image (e.g., Ubuntu or Rocky Linux) with the necessary components for Kubernetes, such as kubeadm, containerd, and other dependencies.

Packer ensures the image is CAPI-compliant by installing the required Kubernetes binaries, configuring the container runtime, and setting up networking and storage components. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In the default node preparation process for NKP, Packer is used to build a CAPI-compliant OS image, installing Kubernetes components and dependencies for use as an NKP node.” This process is typically orchestrated by NKP Image Builder (NIB) or Kubernetes Image Builder (KIB), both of which rely on Packer for image creation.

Incorrect Options:

B. Ansible is used to make the OS image CAPI-compliant: Ansible is used by KIB/NIB to apply configurations during the Packer build process, but Packer is the primary tool for creating the image. Ansible alone does not make the image CAPI-compliant.

C. Goss is used to harden the OS image: Goss is a validation tool that can be used for image hardening, but it is not part of the default NKP node preparation process. Hardening is an optional step.

D. Terraform is utilized to clone an existing OS image: Terraform is for infrastructure provisioning, not image creation or cloning. Packer handles image creation in NKP.

According to theNKPA 6.10 documentation, thePre-provisioned infrastructure provider (CAPPP)requires the user to provide aninventory fileof the servers that will become the cluster nodes. This inventory file contains connection information (IP addresses, credentials, etc.) for each pre-provisioned node, enabling the Cluster API to connect and configure these servers directly during cluster creation.

The NKPA course explains that upgrading an NKP license to the Ultimate tier unlocks advanced features such as fleet management, air-gapped deployments, and additional platform services (e.g., monitoring, logging, backup/restore). These services are deployed on the Management cluster and require sufficient resources to operate effectively. A key prerequisite is tosize the Control Plane nodes appropriately to support the installation of default platform services(Option C).

The Control Plane nodes in the NKP Management cluster run critical components like the API server, controller manager, and Kommander, as well as platform services such as Prometheus, Grafana Loki, and Velero. The Ultimate license increases resource demands due to the expanded functionality, and undersized Control Plane nodes can lead to performance issues or failed deployments. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Before upgrading to an NKP Ultimate license, ensure the Control Plane nodes of the Management cluster are sized appropriately (e.g., sufficient CPU, memory, and storage) to support the additional default platform services enabled by the license.” For example, Control Plane nodes might need to be scaled to at least 4 vCPUs and 16 GB RAM, depending on the workload.

Incorrect Options:

A. Size the Sidecar containers appropriately: Sidecar containers are typically used for specific workloads (e.g., logging agents), not for platform services deployment, and are not a licensing prerequisite.

B. Size the ETCD nodes appropriately: While etcd is part of the Control Plane, the course refers to the Control Plane nodes as a whole, not etcd specifically, as the sizing requirement.

D. Size the Worker nodes appropriately: Worker nodes run user workloads, not the platform services, which are deployed on the Control Plane in the Management cluster.

Attaching an existing Amazon EKS cluster to NKP for fleet management involves integrating the cluster into NKP’s management plane, which requires specific preparatory steps. The NKPA course outlines that the first step is tocreate a service account with cluster-admin permissionsin the EKS cluster. This service account is used by NKP to authenticate and manage the cluster, enabling operations like monitoring, scaling, and application deployment.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide explains: “To attach an external Kubernetes cluster, such as Amazon EKS, to NKP, a service account with cluster-admin role bindings must be created to allow NKP to interact with the cluster’s API server.” The service account is configured with a token that NKP uses to authenticate requests. The NKPA course provides detailed steps, including creating the service account, assigning the cluster-admin ClusterRole, and generating a token for NKP integration. This step is critical to ensure NKP has the necessary permissions to manage the EKS cluster.

Incorrect Options:

A. Configure a ConfigMap according to EKS configuration: While ConfigMaps may be used for specific configurations, they are not the first step for attaching an EKS cluster. The NKPA course prioritizes service account creation.

C. Configure HAProxy to get connected to EKS clusters: HAProxy is a load balancer, not required for attaching EKS clusters to NKP. EKS uses AWS-native load balancers, and NKP connects via the Kubernetes API.

D. Deploy cert-manager in the EKS clusters: Cert-manager is used for certificate management, not a prerequisite for attaching EKS clusters. The NKPA course does not list it as a required step.

The NKPA course explains that NKP uses Grafana Loki as part of its logging stack to implement a multi-tenant logging system, allowing teams to access their logs securely within their respective namespaces. The exhibit indicates two namespaces, tenant-innovation and tenant-analytics, each with a ConfigMap for logging configuration. The requirement is to set a retention period of 30 days for tenant-innovation and 7 days for tenant-analytics.

The correct YAML output (Option A) configures Loki’s retention period using ConfigMaps in the appropriate namespaces:

For tenant-innovation, the ConfigMap logging-innovation-config in the tenant-innovation namespace sets retention_period: 30d.

For tenant-analytics, the ConfigMap logging-analytics-config in the tenant-analytics namespace sets retention_period: 7d.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In NKP, configure multi-tenant logging with Grafana Loki by creating a ConfigMap per namespace, specifying retention periods under loki.structuredConfig.limits_config.retention_period (e.g., 30d for 30 days, 7d for 7 days).” The d suffix denotes days, aligning with the requirement for 30 days and 7 days retention periods.

Incorrect Options:

B: The second ConfigMap incorrectly uses the tenant-innovation namespace instead of tenant-analytics, breaking the multi-tenant isolation.

C: The retention periods are set to 30h and 7h (hours), not 30d and 7d (days), which does not meet the requirement.

D: Both ConfigMaps use a generic tenant namespace, which does not match the specific namespaces (tenant-innovation, tenant-analytics) shown in the exhibit.

Comprehensive and Detailed Explanation From General Kubernetes Knowledge:

Since this question involves AWS EKS and Azure AKS specifics outside the NKP context, and web search is unavailable, I will rely on general Kubernetes knowledge as of my last update. Using a custom image for EKS and AKS worker nodes means replacing the default, optimized images provided by AWS and Azure, which are pre-configured with components tailored for their managed Kubernetes services.

The primary functionality lost by using a custom image in both EKS and AKS isbuilt-in autoscaling and security capabilities(Option C):

Autoscaling: Both EKS and AKS rely on their default node images to integrate with their native autoscaling mechanisms, such as the EKS Cluster Autoscaler (which uses AWS Auto Scaling Groups) and AKS Cluster Autoscaler (which integrates with Azure Virtual Machine Scale Sets). Custom images may lack the necessary agents or configurations (e.g., AWS SSM Agent, Azure VM extensions) to communicate with these autoscaling services, requiring manual configuration.

Security Capabilities: Default images include pre-configured security features, such as AWS’s integration with IAM roles for service accounts (IRSA) and Azure’s integration with Azure Active Directory (AAD) for RBAC. Custom images may not include these integrations, potentially breaking security features like automatic credential rotation or managed identity support unless manually configured.

Incorrect Options:

A. Native monitoring tools, logging, and alerting: Monitoring and logging (e.g., AWS CloudWatch, Azure Monitor) are managed at the control plane level, not the node image level, so these features are generally unaffected by custom images.

B. Cluster networking and load balancing: Networking (e.g., AWS VPC CNI, Azure CNI) and load balancing (e.g., AWS ALB, Azure Load Balancer) are configured by the control plane and CNI plugins, not the node image.

D. Ability to use GPUs and persistent storage: GPU support and persistent storage (e.g., EBS, Azure Disk) depend on drivers and CSI plugins, which can be installed on custom images without losing functionality.

The exhibit shows an NKP UI message stating “No insights identified,” indicating that NKP Insights, the platform’s predictive analytics and observability feature, is not active. The NKPA course explains that NKP Insights is a platform application that provides anomaly detection and alerting for Kubernetes clusters but requires deployment and configuration to generate insights.

The correct approach (Option C) involves two steps:

Create a persistent volume claim (PVC) and assign it to nkp-insights: NKP Insights requires persistent storage to save logs, metrics, and historical data for analysis. The course specifies that a PVC must be created to provide this storage, ensuring the application can retain data for generating insights.

Install nkp-insights with nkp create appdeployment nkp-insights --app nkp-insights-1.2.2 --workspace kommander-workspace: This command deploys the NKP Insights application across all clusters in the specified workspace (kommander-workspace). The --app flag specifies the application version, and the deployment ensures that insights are generated for all clusters in the workspace.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To enable NKP Insights, create a PersistentVolumeClaim for storage and deploy the application using nkp create appdeployment nkp-insights --app --workspace to begin generating insights across clusters.” This aligns with the need to control alerts across all company clusters, as NKP Insights provides centralized observability.

Incorrect Options:

A. Acquire the NKP Insights Add-on license: NKP Insights is a platform application included in higher-tier licenses (e.g., NKP Ultimate), not a separate add-on. The course does not indicate a separate license requirement.

B. Install nkp-insights in every cluster with kubectl apply: This method is manual and inefficient. NKP’s appdeployment command automates deployment across all clusters in a workspace.

TheKonvoy Image Builderrequires a64-bit Linux or MacOS environment(x86_64 architecture) to build and customize the OS images.

The Nutanix Kubernetes Platform (NKP) is designed to simplify the deployment and management of Kubernetes clusters on Nutanix infrastructure, including on-premises AHV-based clusters in dark site environments with no Internet connectivity. The requirements specified in the question—dark site, Nutanix-provided Rocky Linux VM image, and AHV-based cluster—point to a deployment scenario where the environment must be self-contained and rely on Nutanix-specific tools and resources to meet the air-gapped constraints.

According to the Nutanix Kubernetes Platform Administration (NKPA) course, deploying NKP in a dark site environment requires specific prerequisites to ensure all necessary components, such as container images, dependencies, and configuration files, are available without Internet access. The course emphasizes the use of anAir-Gapped Bundleand anexisting local container registryas critical components for such deployments.

Air-Gapped Bundle (Option B):

The NKPA course explains that for dark site deployments, Nutanix provides anAir-Gapped Bundle, which is a comprehensive package containing all the software components, container images, and dependencies required to deploy and manage an NKP cluster without Internet connectivity. This bundle includes the Kubernetes binaries, NKP platform applications (e.g., Rook Ceph, monitoring tools), and other necessary artifacts.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide specifically states: “For air-gapped environments, the Nutanix Air-Gapped Bundle is required to provide all dependencies, including container images and installation files, to deploy NKP clusters.” This bundle is typically downloaded from the Nutanix Support Portal in an Internet-connected environment and then transferred to the dark site for deployment.

The bundle ensures that the Nutanix-provided Rocky Linux VM image, which serves as the base operating system for the Kubernetes nodes, can be provisioned with all required software components. The NKPA course further notes that the Air-Gapped Bundle is tailored for AHV-based clusters, ensuring compatibility with the Nutanix hypervisor.

Existing Local Container Registry (Option C):

In a dark site environment, a local container registry is a prerequisite to store and distribute container images required by the NKP cluster. The NKPA course highlights that NKP relies on container images for Kubernetes components, platform applications, and user workloads. In an air-gapped setup, these images cannot be pulled from public registries like Docker Hub or Quay.io.

The course instructs administrators to set up a local container registry (e.g., Harbor, Nexus, or a Nutanix-managed registry) and populate it with the container images included in the Air-Gapped Bundle. The Nutanix Cloud Bible reinforces this, stating: “In air-gapped deployments, a local container registry must be pre-configured to host all required images, which are provided as part of the Nutanix Air-Gapped Bundle.”

The local container registry ensures that the Kubernetes nodes, running on the Nutanix-provided Rocky Linux VM image, can access the necessary images during cluster bootstrapping and operation. The NKPA course provides guidance on configuring the registry and integrating it with the NKP deployment process.

Incorrect Options:

Konvoy Image Builder (Option A):

Konvoy Image Builder is a tool associated with D2iQ’s Konvoy platform, used to create custom machine images for Kubernetes deployments. While it can be used to build images for Kubernetes nodes, it is not a Nutanix-specific tool nor a prerequisite for NKP deployments. The NKPA course and NCP-CN 6.10 Study Guide do not mention Konvoy Image Builder, as NKP uses the Nutanix-provided Rocky Linux VM image, which is pre-configured for AHV-based clusters. This option is irrelevant to the Nutanix ecosystem.

Self-managed AWS cluster (Option D):

A self-managed AWS cluster is unrelated to the requirements of deploying NKP on an AHV-based cluster in a dark site. The question specifies an AHV-based cluster, which is Nutanix’s Acropolis Hypervisor running on-premises, not a cloud-based AWS environment. The NKPA course focuses on Nutanix infrastructure (AHV, Prism Central) for NKP deployments and does not include AWS as a supported platform for this scenario. This option is incorrect as it contradicts the deployment environment.

Deployment Context:

The Nutanix-provided Rocky Linux VM image is a pre-configured operating system image optimized for NKP deployments on AHV. The NKPA course notes that this image includes the necessary kernel settings, drivers, and configurations to run Kubernetes nodes efficiently on Nutanix infrastructure.

The AHV-based cluster requirement indicates that the deployment leverages Nutanix’s hypervisor, managed through Prism Central, to provision and manage the Kubernetes nodes. The Air-Gapped Bundle and local container registry ensure that all software components are available in the dark site, aligning with the NKPA course’s guidelines for air-gapped deployments.

The Kubernetes Image Builder (KIB) is used to create CAPI-compliant machine images for NKP cluster nodes, often leveraging tools likePackerto build AMIs for AWS. When the KIB process fails, troubleshooting requires detailed logs to identify the root cause. The NKPA course recommends increasing the verbosity of the KIB command to capture detailed output, including AWS CLI commands and their responses.

The correct troubleshooting step is torerun the KIB command with the verbosity level set to debug. This is typically done using the --verbose or -v flag (e.g., -v debug) to enable debug-level logging, which includes all AWS CLI commands, their outputs, and errors, written to a log file for review. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To troubleshoot KIB failures, rerun the command with debug verbosity (-v debug) to log all operations, including AWS CLI interactions, to an exported log file for detailed analysis.” This approach helps pinpoint issues like permission errors, misconfigurations, or failures in image bundle uploads.

Incorrect Options:

A. Rerun with pause parameter: KIB does not support a pause parameter for step-by-step review, as per the NKPA course.

C. Instruct Packer not to delete the cloned AMI: While preserving the AMI can help, the course prioritizes debug logging for initial troubleshooting. Packer’s --on-error=abort flag exists, but it’s less direct than debug logs.

D. Instruct Ansible not to delete the cloned AMI: KIB primarily uses Packer, not Ansible, for AMI creation, making this option incorrect.

When deploying NKP to AWS, the bootstrap process requires AWS credentials to interact with AWS APIs for provisioning resources like EC2 instances. The NKPA course specifies that the nkp CLI supports the --aws-profile flag to specify a custom AWS profile for authentication. This profile, defined in the AWS credentials file (~/.aws/credentials), contains the access key and secret key for the desired AWS account.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To deploy NKP on AWS with custom credentials, use the --aws-profile= flag during the nkp create bootstrap command to reference a specific AWS profile.” This approach leverages the AWS CLI’s profile management, ensuring secure and flexible credential handling. For example, the command would be nkp create bootstrap --aws-profile=my-profile --kubeconfig bootstrap-cluster.conf.

Incorrect Options:

B. --cloud-credentials=<my-profile></my-profile>: This flag is not used by the nkp CLI. The NKPA course specifies --aws-profile for AWS.

C. --with-aws-bootstrap-credentials=true: This flag does not exist in the NKPA documentation for NKP bootstrap.

D. --aws-access-key=<aws access="" key=""> --aws-secret-key=<aws secret="" key=""></aws></aws>: While these flags may be used in some tools, the NKPA course recommends using --aws-profile to avoid hardcoding sensitive credentials.

The Nutanix Kubernetes Platform (NKP) integratesVelero, an open-source tool, for backup and restore operations as part of its Day 2 operations. The NKPA course explains that after configuring a Backup Storage Location (e.g., an AWS S3 bucket) and creating a backup, administrators can view details of the backup using the Velero CLI. The correct command to view the details of a backup named testbackup isvelero backup describe testbackup. This command provides a detailed description of the backup, including its status, resources included, and storage location.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To inspect a Velero backup in NKP, use the velero backup describe command to display detailed information about the backup, such as its creation time, expiration, and included resources.” The backup name (testbackup) is specified as created by the team, and no prefix like aws-velero- is indicated in the question, making option C the correct choice.

Incorrect Options:

A. kubectl get backupstoragelocations -n ${testbackup} -o yaml: This command retrieves Backup Storage Location objects, not backup details. The namespace ${testbackup} is also incorrect, as Velero resources are typically in a specific namespace (e.g., velero).

B. velero backup describe aws-velero-testbackup: The backup name is testbackup, not aws-velero-testbackup. The NKPA course does not indicate any prefix for the backup name.

D. kubectl get backupstoragelocations -n ${WORKSPACE_NAMESPACE} -o yaml: This retrieves Backup Storage Locations, not the backup itself, and does not provide backup details.

The NKPA course details that NKP Platform Applications, such asGrafana Logging,Grafana Loki, andProject Logging, are deployed to Kubernetes clusters to provide monitoring and logging capabilities. To ensure these components are automatically deployed to new workload clusters in a workspace, the administrator must enable them in theApplication sectionunder the workspace configuration in the NKP UI.

The course explains that the Application section allows administrators to select and configure platform applications that should be applied to all clusters within a workspace. By enabling Grafana Logging, Grafana Loki (for log aggregation), and Project Logging (for project-specific log management), these components are automatically deployed as part of the cluster provisioning process. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To deploy platform applications like Grafana Loki and logging components to new clusters, configure them in the Application section of the workspace settings in the NKP UI.”

Incorrect Options:

A. Enable them in the Insights section under workspace: The Insights section is for analytics and monitoring dashboards, not for deploying logging components.

B. Enable them in the Projects section under workspace: Projects are sub-divisions within workspaces for resource allocation, not for configuring platform applications.

C. Enable them in the Clusters section under workspace: The Clusters section is for managing cluster settings, not for enabling platform applications.

The NKPA course details the process of creating an NKP cluster on vSphere using the NKP CLI, including the configuration of multiple node pools with specific worker node counts and CPU settings. The correct approach involves creating the cluster with the initial node pool and then adding additional node pools separately.

The steps inOption Aalign with this process:

nkp create cluster vsphere --worker-replicas 6 --worker-cpus 10: This command creates the NKP cluster on vSphere with the first node pool, consisting of 6 worker nodes, each with 10 CPUs.

nkp create nodepool vsphere --worker-replicas 3 --worker-cpus 8: This adds the second node pool to the cluster with 3 worker nodes, each with 8 CPUs.

nkp create nodepool vsphere --worker-replicas 3 --worker-cpus 6: This adds the third node pool with 3 worker nodes, each with 6 CPUs.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To create an NKP cluster with multiple node pools on vSphere, use nkp create cluster vsphere to define the first node pool, then add additional node pools with nkp create nodepool vsphere, specifying --worker-replicas and --worker-cpus for each pool.” This method ensures precise control over each node pool’s configuration.

Incorrect Options:

B: The second nkp create nodepool command uses --replicas and --cpus, which are not the correct flags. The NKPA course specifies --worker-replicas and --worker-cpus.

C: The --node-pools, --worker-replicas 6,3,3, and --worker-cpus 10,8,6 flags are not supported in a single nkp create cluster command. Node pools must be created separately.

D: There is no nkp create nodepools command; the correct command is nkp create nodepool. Additionally, --replicas and --cpus are incorrect flags.

When an attached cluster (e.g., an external cluster like EKS) is stuck in a 'deleting' state in the NKP UI, it indicates an issue with the reconciliation process in the NKP management cluster. The NKPA course explains that attached clusters are represented in NKP as KommanderCluster custom resources in the management cluster. To resolve a stuck deletion, the engineer must manually delete the KommanderCluster resource using kubectl in the context of the NKP management cluster.

The correct command iskubectl delete kommandercluster, executed in the context of the NKP management cluster (not the attached cluster). For example: kubectl delete kommandercluster -n . The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “If an attached cluster is stuck in a ‘deleting’ state, delete the corresponding KommanderCluster resource in the NKP management cluster using kubectl delete kommandercluster to remove it from management.” This ensures the cluster is fully detached and removed from the UI.

Incorrect Options:

A. kubectl delete cluster: There is no cluster resource type in this context; the correct resource is kommandercluster.

B. nkp delete kommandercluster: The nkp CLI does not have a delete kommandercluster subcommand.

D. nkp delete cluster in the attached cluster: This command is for deleting NKP-managed clusters, not detaching external clusters, and it should be run from the management cluster context.

To create a FIPS-compliant NKP deployment in an air-gapped environment, the following must be done:

Verify the OS (RHEL) itself is in FIPS mode.

When building the image,include both the offline fips and fips overridesto ensure the image and components are built in compliance.

When deploying the cluster, includeFIPS-specific referencesfor both Kubernetes and etcd components.

Exact extract:

“For FIPS deployments, ensure the OS is in FIPS mode, and include both offline fips and fips overrides during image creation to ensure compliant images and deployment.”

The scenario describes an isolated environment in Antarctica, implying an air-gapped NKP deployment where the bastion host serves as the primary management point for deploying and managing NKP clusters without Internet access. The NKPA course outlines the essential tools that must be installed on a bastion host to facilitate NKP deployment and management in such environments.

The required programs arekubectlandnkp:

kubectl: This is the Kubernetes command-line tool used to interact with Kubernetes clusters, essential for managing cluster resources, debugging, and applying configurations during and after deployment.

nkp: The NKP CLI (nkp) is the primary tool for deploying, managing, and scaling NKP clusters, including creating bootstrap clusters, deploying clusters, and managing platform applications. In an air-gapped setup, the nkp CLI is critical for executing deployment commands using the Air-Gapped Bundle.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For an air-gapped NKP deployment, ensure the bastion host has kubectl and the nkp CLI installed to manage the deployment process and interact with the resulting Kubernetes clusters.” These tools are sufficient for the engineer to deploy and operate NKP in an isolated environment.

Incorrect Options:

A. awscli and nkp: The awscli is specific to AWS environments, but the question does not specify AWS infrastructure. Additionally, in an isolated environment, awscli is less relevant without Internet access.

B. oc and kubectl: oc is the OpenShift CLI, not used for NKP deployments. NKP uses nkp CLI instead.

C. oc and az: az is the Azure CLI, and oc is for OpenShift—neither is relevant to NKP deployment.

TheNKPA 6.10 documentationconfirms thatVelerois the built-in backup and recovery solution provided as part of the NKP platform. It provides cluster-level and namespace-level backup, restore, and migration capabilities.

Exact extract from the documentation:

“Velero is the integrated, out-of-the-box backup and restore solution in NKP. It supports scheduled backups, disaster recovery, and application migration workflows.”

In an air-gapped NKP environment with no Internet access, a bastion host is a critical component for secure management. The NKPA course defines the primary purpose of a bastion host asproviding a secure point for creating and operating NKP clusters. The bastion host acts as a jump server, allowing administrators to securely access the isolated environment, manage cluster deployments, and perform operations like cluster creation, scaling, and upgrades without exposing the environment to external threats.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In a dark site NKP deployment, a bastion host serves as a secure entry point for administrators to create, manage, and operate NKP clusters, ensuring isolation from external networks.” The bastion host is configured with SSH keys and tools like the NKP CLI to facilitate secure interactions with the cluster infrastructure.

Incorrect Options:

A. To store and manage sensitive data: The bastion host is not a storage system; its role is access and management, not data storage.

C. To serve as a load balancer: A bastion host does not perform load balancing; that role is handled by Kubernetes components like MetalLB or cloud-native load balancers.

D. To act as a firewall: While a bastion host enhances security, it is not a firewall. Firewalls are separate components in the network architecture.

The error states:

pgsql

Copy

error upgrading CAPI components: unable to upgrade CAPI components: deployment "capp-controller-manager" is not ready after 10m0s: failed to connect to the management cluster: context deadline exceeded

This clearly points to connectivity issues between the VM (or nodes) and themanagement cluster, typically caused byregistry communication issuesin air-gapped or private environments. When the VM cannot connect to the registry to pull required images or configuration, the CAPI (Cluster API) components cannot be initialized, causing a timeout.

Key Reference:

Nutanix Kubernetes Platform Administration (NKPA) 6.10 – “Air-Gapped and Registry Communication Issues”

NCP-CN 6.10 Study Guide – “Cluster API Upgrade Process and Network Prerequisites”

=======