NCP-CN Nutanix Certified Professional - Cloud Native (NCP-CN-6.10) Questions and Answers

The documentation confirms that when a new license is activated to upgrade to a higher tier, users must log out and log back in for the license changes to take effect. This ensures that updated entitlements are loaded into the UI and CLI environment.

Exact extract from documentation:

“After applying a new license for a higher-tier product, log out and log back in to see and activate the newly available features.”

For creating custom images for vSphere (and other supported platforms), Konvoy Image Builder (KIB) is the officially supported tool for NKP. It can create images with custom configurations, package versions, and pre-bundled artifacts.

Key Reference:

“Konvoy Image Builder (KIB) is the Nutanix-recommended tool for building NKP cluster node images for vSphere, AWS, Azure, and other environments.”

Attaching an existing Amazon EKS cluster to NKP for fleet management involves integrating the cluster into NKP’s management plane, which requires specific preparatory steps. The NKPA course outlines that the first step is to create a service account with cluster-admin permissions in the EKS cluster. This service account is used by NKP to authenticate and manage the cluster, enabling operations like monitoring, scaling, and application deployment.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide explains: “To attach an external Kubernetes cluster, such as Amazon EKS, to NKP, a service account with cluster-admin role bindings must be created to allow NKP to interact with the cluster’s API server.” The service account is configured with a token that NKP uses to authenticate requests. The NKPA course provides detailed steps, including creating the service account, assigning the cluster-admin ClusterRole, and generating a token for NKP integration. This step is critical to ensure NKP has the necessary permissions to manage the EKS cluster.

Incorrect Options:

A. Configure a ConfigMap according to EKS configuration: While ConfigMaps may be used for specific configurations, they are not the first step for attaching an EKS cluster. The NKPA course prioritizes service account creation.

C. Configure HAProxy to get connected to EKS clusters: HAProxy is a load balancer, not required for attaching EKS clusters to NKP. EKS uses AWS-native load balancers, and NKP connects via the Kubernetes API.

D. Deploy cert-manager in the EKS clusters: Cert-manager is used for certificate management, not a prerequisite for attaching EKS clusters. The NKPA course does not list it as a required step.

According to the NKPA 6.10 documentation, the critical system components for NKP nodes are:

kubelet

containerdThese components are deployed in the standard Linux path: /var/lib.

Exact extract from the documentation:

“The kubelet and containerd services require disk space in /var/lib on the host operating system. It’s essential to allocate sufficient storage in /var/lib to accommodate these core Kubernetes components.”

The NKPA course highlights that NKP Insights is the platform’s integrated solution for observability and analytics, providing predictive analytics to detect current and future anomalies in Kubernetes clusters. NKP Insights leverages machine learning to analyze metrics, logs, and events, identifying performance issues and potential failures proactively. After deploying a new cluster, the administrator can enable NKP Insights as a platform application in the workspace to meet the predictive analytics requirement.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP Insights provides predictive analytics and anomaly detection for Kubernetes clusters, enabling administrators to monitor and optimize cluster performance.” This is deployed via the NKP UI or CLI by enabling the Insights application in the workspace.

Incorrect Options:

B. NCM Intelligent Ops: Nutanix Cloud Manager (NCM) Intelligent Ops is for broader infrastructure management, not Kubernetes-specific analytics.

C. Nutanix Pulse: Pulse is a telemetry service for Nutanix support, not for analytics.

D. NKP AI Navigator: This is not a recognized NKP component in the NKPA documentation.

To create a FIPS-compliant NKP deployment in an air-gapped environment, the following must be done:

Verify the OS (RHEL) itself is in FIPS mode.

When building the image, include both the offline fips and fips overrides to ensure the image and components are built in compliance.

When deploying the cluster, include FIPS-specific references for both Kubernetes and etcd components.

Exact extract:

“For FIPS deployments, ensure the OS is in FIPS mode, and include both offline fips and fips overrides during image creation to ensure compliant images and deployment.”

As per the NKPA 6.10 documentation and cluster autoscaler behavior, when nodes are scaled down in NKP (or any CAPI-managed environment), the node is deleted from the infrastructure provider (vSphere, AWS, Nutanix, etc.). This effectively removes it from both the cluster and the underlying hypervisor or cloud provider, thus freeing up resources and reducing costs.

The NKP documentation recommends using a combination of RBAC assignments and exported manifests to manage access across multiple clusters. By exporting the role assignments to YAML, the engineer can consistently apply these settings across the different environments, ensuring the new team has the necessary resources and limits. This approach is especially useful for environments with multiple clusters and standardized configurations.

The NKPA course explains that NKP’s monitoring stack includes Prometheus for metrics collection and storage, and Fluent Bit for log collection and forwarding. To retain system resource utilization data over several months, the company must focus on Prometheus, as it is responsible for storing time-series metrics data, such as CPU, memory, and network utilization, which are critical for long-term trend analysis.

To handle the increased workload from the online retail application, the Platform Engineer should adjust Prometheus by increasing its container resource limits and memory settings to ensure it can process and store more metrics, and increasing its storage to retain data for several months. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For long-term metrics retention in NKP, scale the Prometheus deployment by increasing its resource limits (CPU and memory) and expanding its persistent storage to accommodate larger time-series data.” This involves editing the Prometheus deployment’s resource settings (e.g., via kubectl edit deployment) and updating the PersistentVolumeClaim (PVC) to allocate more storage.

Incorrect Options:

A. Adjust the number of replicas for Fluent Bit: Fluent Bit handles logs, not metrics. Increasing replicas does not address long-term metrics storage.

B. Adjust the number of replicas for Prometheus: Increasing replicas improves availability but does not directly address storage or resource needs for metrics retention.

C. Adjust the resource settings for Fluent Bit: Fluent Bit is for log collection, not metrics storage, and is not relevant for this use case.

The NKPA 6.10 documentation clarifies that when creating a workload cluster using the nkp create cluster command, specifying the target workspace (namespace) is critical for properly associating the workload cluster with that workspace in the NKP UI. If the --namespace parameter is omitted, the cluster is provisioned in the default workspace, not in the intended workspace (in this case, code-green).

Key documentation excerpt:

“If you do not specify the workspace (namespace) using the --namespace parameter when creating a cluster, the cluster will be created in the default workspace. It will not appear in custom workspaces until manually assigned.”

Comprehensive and Detailed Explanation:

The correct procedure for deleting an NKP cluster involves using the nkp delete cluster command with the appropriate cluster name and namespace. This ensures that not only the Kubernetes resources but also the corresponding NKP resources (e.g., nodepools, Kommander integration) are deleted cleanly and consistently. Simply deleting the VMs does not clean up the associated NKP management objects. This approach is detailed in the NKP documentation for cluster lifecycle management, emphasizing the need to use the provided CLI commands for full removal.

Comprehensive and Detailed Explanation From General Kubernetes Knowledge:

Since this question involves AWS EKS and Azure AKS specifics outside the NKP context, and web search is unavailable, I will rely on general Kubernetes knowledge as of my last update. Using a custom image for EKS and AKS worker nodes means replacing the default, optimized images provided by AWS and Azure, which are pre-configured with components tailored for their managed Kubernetes services.

The primary functionality lost by using a custom image in both EKS and AKS is built-in autoscaling and security capabilities (Option C):

Autoscaling: Both EKS and AKS rely on their default node images to integrate with their native autoscaling mechanisms, such as the EKS Cluster Autoscaler (which uses AWS Auto Scaling Groups) and AKS Cluster Autoscaler (which integrates with Azure Virtual Machine Scale Sets). Custom images may lack the necessary agents or configurations (e.g., AWS SSM Agent, Azure VM extensions) to communicate with these autoscaling services, requiring manual configuration.

Security Capabilities: Default images include pre-configured security features, such as AWS’s integration with IAM roles for service accounts (IRSA) and Azure’s integration with Azure Active Directory (AAD) for RBAC. Custom images may not include these integrations, potentially breaking security features like automatic credential rotation or managed identity support unless manually configured.

Incorrect Options:

A. Native monitoring tools, logging, and alerting: Monitoring and logging (e.g., AWS CloudWatch, Azure Monitor) are managed at the control plane level, not the node image level, so these features are generally unaffected by custom images.

B. Cluster networking and load balancing: Networking (e.g., AWS VPC CNI, Azure CNI) and load balancing (e.g., AWS ALB, Azure Load Balancer) are configured by the control plane and CNI plugins, not the node image.

D. Ability to use GPUs and persistent storage: GPU support and persistent storage (e.g., EBS, Azure Disk) depend on drivers and CSI plugins, which can be installed on custom images without losing functionality.

Continuous Deployment (CD) is the practice of automatically deploying new software releases across environments after a successful build and testing phase. In the context of NKP, enabling CD ensures that software changes are consistently and reliably rolled out to all clusters associated with a project, ensuring operational uniformity and rapid feature adoption.

The NKPA 6.10 documentation confirms that Velero is the built-in backup and recovery solution provided as part of the NKP platform. It provides cluster-level and namespace-level backup, restore, and migration capabilities.

Exact extract from the documentation:

“Velero is the integrated, out-of-the-box backup and restore solution in NKP. It supports scheduled backups, disaster recovery, and application migration workflows.”

The NKPA course recommends using a S3-compatible API for backup and restore operations in production NKP environments, as it integrates with Velero, NKP’s backup and restore tool. Velero supports S3-compatible storage (e.g., AWS S3, Nutanix Objects, or MinIO) as a backup storage location, allowing persistent data, including volumes and cluster resources, to be backed up and restored during disaster recovery scenarios. This approach ensures compatibility with cloud-native backup workflows and provides scalability and reliability for production use cases.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For production backup and restore in NKP, use Velero with an S3-compatible API to store backups, ensuring persistent data availability during disaster recovery.” Nutanix Objects, which provides an S3-compatible API, is often used in Nutanix environments for this purpose, but any S3-compatible storage (e.g., an off-site S3 bucket) can be configured.

Incorrect Options:

A. Protection Domain: Protection Domains are a Nutanix AOS feature for VM-level replication, not for Kubernetes backup/restore.

B. Rook Ceph: Rook Ceph provides persistent storage for NKP clusters but is not a backup solution; it can be backed up using Velero with S3 storage.

C. External Storage Class: Storage Classes define how volumes are provisioned, not how they are backed up or restored.

As outlined in the NKPA 6.10 documentation under "Customizing Resource Requests and Limits for Logging," to override the default resource values for the logging operator, a ConfigMap named logging-operator-logging-overrides in the kommander namespace is used. The values.yaml in the ConfigMap should precisely define fluentd resource limits and requests in a valid YAML format.

The correct YAML format is:

yaml

Copy

apiVersion: v1

kind: ConfigMap

metadata:

name: logging-operator-logging-overrides

namespace: kommander

data:

values.yaml: |

fluentd:

resources:

limits:

cpu: 4

memory: 4Gi

requests:

cpu: 4

memory: 4Gi

This ensures that the desired CPU and memory resources are correctly applied for the fluentd daemon, avoiding parsing errors and meeting the high-demand logging needs.

The NKPA course explains that NKP supports auto-scaling for clusters using Cluster API (CAPI), which manages the lifecycle of Kubernetes nodes. When auto-scaling is enabled, NKP monitors cluster workloads and automatically adjusts the number of nodes based on demand. The behavior involves CAPI creating or deleting nodes as needed to scale the cluster up or down, ensuring optimal resource utilization.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP auto-scaling uses Cluster API to dynamically create or delete nodes in response to workload demands, ensuring the cluster scales efficiently.” For example, if the workload increases, CAPI provisions additional worker nodes; if demand decreases, CAPI deletes nodes to reduce costs.

Incorrect Options:

A. CPU is hot-added or hot-removed: Hot-adding/removing CPU is not a Kubernetes auto-scaling behavior; scaling involves adding/removing nodes.

B. Memory is hot-added or hot-removed: Similar to CPU, memory scaling at the node level is not supported in this context.

C. Power-On Status/Mode of a node is changed: Auto-scaling does not involve changing node power states; it adds or removes nodes.

The NKPA course explains that deleting a workspace in NKP, especially after all associated clusters have been removed, is a straightforward process through the NKP UI. The correct method is to navigate to the Global view in the top menu bar, select Workspaces from the menu, locate the target workspace, click the three-dot button next to it, and select Delete. This action removes the workspace and its associated configurations from NKP, ensuring a clean environment after the project is finished.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To delete an empty workspace in NKP, go to the Global view in the UI, select Workspaces, click the three-dot menu for the workspace, and choose Delete.” The course confirms that a workspace must be empty (no clusters or resources) before it can be deleted, which aligns with the scenario where the three clusters have already been removed.

Incorrect Options:

A & B. Run kubectl delete workspace: Both options are syntactically similar, but kubectl delete workspace is not a valid command in NKP. Workspaces are managed through the NKP UI or CLI (nkp), not directly via kubectl.

D. Ask a workspace user to delete the workspace: Workspace users typically lack permissions to delete workspaces; this action is reserved for administrators via the Global view.

NKP uses Helm and Flux for application deployment, where applications are managed as HelmReleases, a custom resource that defines Helm chart deployments. The NKPA course explains that to validate the status of HelmReleases, administrators can use the kubectl command to query these resources. The correct command is kubectl get helmreleases -n ${PROJECT_NAMESPACE}, which lists all HelmReleases in the specified project namespace, showing their status (e.g., Ready, Failed) and other details like chart version and reconciliation status.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To check the status of HelmReleases in NKP, use kubectl get helmreleases -n to view the current state of application deployments managed by Flux.” This command helps the operations team verify that applications are running correctly and identify any issues in production.

Incorrect Options:

A. kubectl get namespaces: This lists namespaces, not HelmReleases or their status.

C. kubectl edit helmreleases -n ${PROJECT_NAMESPACE}: This edits HelmRelease resources, not displays their status.

D. kubectl apply -f fluent-bit-overrides.yaml: This applies a configuration for Fluent Bit, unrelated to HelmRelease status.

The NKPA course explains that NKP uses Grafana Loki as part of its logging stack to implement a multi-tenant logging system, allowing teams to access their logs securely within their respective namespaces. The exhibit indicates two namespaces, tenant-innovation and tenant-analytics, each with a ConfigMap for logging configuration. The requirement is to set a retention period of 30 days for tenant-innovation and 7 days for tenant-analytics.

The correct YAML output (Option A) configures Loki’s retention period using ConfigMaps in the appropriate namespaces:

For tenant-innovation, the ConfigMap logging-innovation-config in the tenant-innovation namespace sets retention_period: 30d.

For tenant-analytics, the ConfigMap logging-analytics-config in the tenant-analytics namespace sets retention_period: 7d.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In NKP, configure multi-tenant logging with Grafana Loki by creating a ConfigMap per namespace, specifying retention periods under loki.structuredConfig.limits_config.retention_period (e.g., 30d for 30 days, 7d for 7 days).” The d suffix denotes days, aligning with the requirement for 30 days and 7 days retention periods.

Incorrect Options:

B: The second ConfigMap incorrectly uses the tenant-innovation namespace instead of tenant-analytics, breaking the multi-tenant isolation.

C: The retention periods are set to 30h and 7h (hours), not 30d and 7d (days), which does not meet the requirement.

D: Both ConfigMaps use a generic tenant namespace, which does not match the specific namespaces (tenant-innovation, tenant-analytics) shown in the exhibit.

According to the NKPA 6.10 documentation and Nutanix licensing details, NKP Starter is bundled with the NCI Starter entitlement. This basic licensing tier includes essential capabilities for deploying and managing Kubernetes clusters within a Nutanix environment.

Key reference:

“NKP Starter is included with NCI Starter, providing foundational Kubernetes cluster lifecycle management features for small-scale or starter deployments.”

As per the NKPA 6.10 documentation, the correct approach for deleting an entire NKP-managed cluster (including nodes and deployed applications) is to use the nkp delete cluster command with the cluster name and --kubeconfig parameter. The --self-managed flag ensures the deletion of resources provisioned by the cluster.

Exact extract:

“Use nkp delete cluster --cluster-name= --self-managed --kubeconfig= to delete a cluster and its associated resources.”

When mirroring the NKP bundle to a private registry, the recommended method is to use the nkp bundle push or similar commands with the --to-registry option, specifying the target registry along with the credentials (--to-registry-username and --to-registry-password).

Key reference from documentation:

“Use the --to-registry flag along with --to-registry-username and --to-registry-password to push the NKP bundle to a private registry.”

When attaching an Amazon EKS cluster to NKP for fleet management, persistent volume (PV) errors during application deployments often indicate issues with storage configuration. The NKPA course identifies a common cause: the absence of a default StorageClass. Kubernetes requires a default StorageClass to automatically provision PVs for PersistentVolumeClaims (PVCs) when none is specified. Without a default, applications fail to bind PVCs, resulting in deployment errors.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For attached EKS clusters, ensure a default StorageClass is configured to support dynamic provisioning of persistent volumes. Review existing StorageClasses and set one as default using the storageclass.kubernetes.io/is-default-class annotation.” The engineer should run kubectl get storageclass to list available StorageClasses, verify their configurations, and set one as default by patching it with kubectl patch storageclass -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'. In EKS, the default StorageClass is typically backed by Amazon EBS (e.g., gp2 or gp3).

Incorrect Options:

A. The storage appliance is having issues: This assumes a hardware issue, which is not indicated by PV errors. The NKPA course suggests checking Kubernetes configurations first.

B. There is no compatible storage: EKS supports EBS and EFS, which are compatible with NKP. The issue is likely configuration, not compatibility.

D. There could be a misconfiguration in the ConfigMap: ConfigMaps are not directly related to PV provisioning. The NKPA course points to StorageClass issues for PV errors.

The NKPA course details NKP’s monitoring stack for collecting and analyzing metrics across attached and managed clusters, which is critical for troubleshooting issues like out-of-memory errors. The engineer needs to collect centralized metrics and set up alerting to identify performance issues. The correct approach is to use Prometheus for metrics collection and Thanos Query for alerting (Option C).

Utilize Prometheus to collect and present centralized metrics on NKP attached and managed clusters: Prometheus is NKP’s default metrics collection tool, deployed as a platform application. It scrapes metrics (e.g., CPU, memory usage) from nodes, pods, and services across all clusters in a workspace, centralizing them for analysis. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Prometheus is used in NKP to collect and present centralized metrics from attached and managed clusters, enabling detailed performance analysis.” This is ideal for identifying differences in memory usage causing the out-of-memory errors.

Configure Thanos Query to monitor and send out alerts based on the metric thresholds that have been configured within it: Thanos Query, part of NKP’s monitoring stack, aggregates Prometheus metrics across clusters and provides a unified query interface. It also integrates with Alertmanager to send alerts based on configured thresholds (e.g., memory usage > 90%). The NKPA course notes: “Use Thanos Query to monitor metrics across NKP clusters and configure alerts with Alertmanager to notify engineers of performance issues like out-of-memory errors.” This setup helps the engineer proactively address the issue.

Incorrect Options:

A & B. Utilize Fluentd and Fluent Bit: Fluentd and Fluent Bit are logging tools in NKP, used for collecting logs, not metrics. Metrics collection requires Prometheus.

D. Utilize Thanos to collect and present centralized metrics: Thanos does not collect metrics directly; it extends Prometheus by providing long-term storage and query aggregation. Prometheus is the primary collection tool.

The NKPA 6.10 documentation outlines that in air-gapped environments where default pod network CIDR conflicts exist, the cluster manifest (created via the nkp create cluster command) should be updated to specify an alternate, non-conflicting pod CIDR block range before deployment.

The primary benefit of a private registry is to ensure security and privacy for container images, especially when dealing with sensitive data and compliance requirements (such as financial or government use cases). While secure connections to public registries like DockerHub or GitHub container registries are possible, using a private registry ensures full control over image access and auditing.

Key reference:

“Private registries ensure images remain within the security and compliance boundaries of the enterprise, avoiding potential risks associated with public SaaS registries.”

According to the NKPA 6.10 documentation under “Air-Gapped Preparation with Konvoy Image Builder,” the konvoy-image upload command uploads essential artifacts to the target servers to prepare them to serve as cluster nodes. These artifacts include:

Container runtime (containerd)

OS bundle

Kubernetes components

It does not involve user creation or OS hardening scripts (those are separate, client-driven processes).

Key reference from documentation:

“The konvoy-image upload command uploads the required artifacts to the target server(s) to prepare them for Kubernetes deployment in air-gapped environments. This includes the container runtime, OS bundle, and Kubernetes binaries.”

The NKPA course explains that NKP provides a role-based access control (RBAC) system to manage permissions within its platform, in addition to Kubernetes-native RBAC. For a development team needing limited permissions to perform specific tasks (deploying applications, scaling deployments, viewing logs and metrics) within a specific namespace, the appropriate access type in the NKP GUI is an NKP Role.

NKP Roles are predefined or custom roles within the NKP platform that map to Kubernetes RBAC permissions but are managed through the NKP UI for ease of use. They allow granular control over actions within a workspace or namespace, ensuring the team can perform their tasks (e.g., deploy, scale, get logs) without having access to other environments or cluster-wide resources. For example, an NKP Role like “Developer” or a custom role can be configured to grant edit permissions in the team’s namespace while restricting access elsewhere. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In the NKP GUI, configure an NKP Role to grant limited permissions to a development team, allowing actions like deploying applications and viewing logs within their namespace while preventing unauthorized changes in other environments.”

Incorrect Options:

B. Cluster Role: A Kubernetes Cluster Role grants permissions across all namespaces, which is too broad for the team’s limited access requirement.

C. Cluster Admin: This grants full administrative access to the entire cluster, far exceeding the team’s needs and violating the principle of least privilege.

D. Kommander Role: Kommander is a management component in NKP, but “Kommander Role” is not a specific access type in the NKP GUI for this purpose.