NCP-MCA Nutanix Certified Professional - Multicloud Automation (NCP-MCA 6.10) Exam Questions and Answers

Nutanix Data Protection (Leap) and Flow Security policies rely on Categories to dynamically assign policies to entities.6

In this scenario, the administrator likely set up the Protection Policy to target the Protection: Silver category (standard practice for tiered Service Level Agreements, e.g., Gold, Silver, Bronze). While Environment: Prod is used for the Security Policy (isolation), the Protection Policy specifically requires the protection category to function as intended in a tiered architecture.

If the blueprint (Marketplace item) only assigned Environment: Prod, the VM is missing the critical tag (Protection: Silver) required to associate it with the 1-hour snapshot schedule. To fix this, the blueprint must be updated to assignbothcategories (Environment: Prod AND Protection: Silver) to the VM during provisioning.

To automate a remediation action (like restarting a VM) based on a specific performance threshold (like CPU usage > 90%), the administrator must useIntelligent Operations (X-Play)with an event-driven trigger.

Alert-Based Trigger:The administrator first ensures there is an Alert Policy in Prism Central for "VM High CPU" configured with a threshold of 90%.

Playbook Configuration:The administrator then creates a Playbook and selects theAlerttrigger (orAlerts Matching Criteriatrigger). They link this trigger to the specific CPU alert policy.

Action:The administrator adds theVM Reboot(or Power Cycle) action to the Playbook.

Result:As soon as the system detects the CPU exceeding 90%, the Alert fires, which immediately triggers the Playbook to reboot the VM without human intervention.

Options A (Scheduled) and C (Manual) do not meet the requirement of "whenever it exceeds," which implies real-time reaction. Option B is incorrect because Project Quotas manage resource allocation limits, not runtime performance monitoring or remediation.

The requirement to restrict VMs to specific physical hosts for licensing purposes is addressed usingVM-Host Affinity Policiesin Nutanix AHV, which relies onCategories. The complete configuration workflow is:

Categorization (Step 1):The administrator must create specific categories to tag the entities. One category (e.g., License:Oracle) is assigned to the specificHosts(the licensed ones). Another category (e.g., App:Database) is created for theVMs.

Affinity Policy (Step 2):An Affinity Policy is created in Prism Central that strictly enforces that any VM with the App:Database category must run on hosts with the License:Oracle category.

Blueprint Assignment (Step 3):In the Self-Service Blueprint, the administrator configures the VM service to automatically apply the App:Database category upon creation.

When the blueprint is deployed, the VM is created with the category, and the AHV scheduler immediately respects the Affinity Policy, ensuring the VM only starts on the licensed hosts.

Options A and C are incomplete (Categories alone do not enforce placement), and Option B (Playbook migration) is a reactive "fix" rather than a proactive placement constraint, which risks non-compliance at startup.

The scenario describes a "Zero Trust" style Security Policy (Flow Network Security) where all traffic is blocked unless explicitly allowed by a rule matching a Category.

The Rule:The policy specifically states that SSH (port 22) traffic is allowedonlyfor VMs tagged with the category AppType: Admin-VM.

The Issue:The deployed VM cannot be accessed via SSH. This indicates that the VM does not match the allow rule.

The Fix:The Blueprint used to deploy these Administrator VMs must be updated toassign the AppType: Admin-VM categoryto the VM service definition.

Once the VM is deployed with this tag, the Flow Security Policy will recognize it and permit the inbound SSH traffic. Assigning Web-Servers (Option B) would open port 443, not 22.

In Nutanix Self-Service (Calm) Projects, the "Allow Collaboration" setting controls the visibility and management of entities shared among project members.

Allow Collaboration Enabled:This allows any group member to see the VMs, applications, scheduler jobs, and other objects created by other members of the group. With the appropriate role permissions, they can also modify these shared entities.

Allow Collaboration Disabled:Project users can manageonlythe objects that they strictly created themselves. They cannot view or edit objects created by other users, even if they are in the same project.

To modify a Scheduler Job created by another user, "Allow Collaboration" must be enabled for that Project.

In Self-Service, anOperatorrole can:

Create blueprints

Modify blueprints

Add tasks (shell, PowerShell, script, package installs, etc.)

Use project-provided resources (images, networks, credentials)

To deploy a Linux VM with NGINX:

Asingle-VM blueprintis sufficient.

Developer must selectLinux substrate.

Installation of NGINX occurs througha shell taskin the blueprint’s package or service.

No additional permissions are required for an Operator to perform these actions.

Therefore, the correct answer isC.

The feature within Nutanix Self-Service (Calm) designed specifically for publishing blueprints to end-users is theMarketplace.

Marketplace:This component acts as an app store for the organization. Administrators and developers create Blueprints and thenpublishthem to the Marketplace.

Process:The "Marketplace and Application Management" capability encompasses the workflow of submitting a blueprint for approval, versioning it, and making it visible to users based on their Project entitlements.

Consumption:Once published, users do not access the raw blueprint design canvas; instead, they access the Marketplace Item to launch (consume) the application.

While "Unified Multi-Cloud Orchestration" describes the platform's broad goal, and "DSL" is a method for creating code-based blueprints, "Marketplace" is the specific functional area for publishing and consumption.

To automate a notification based on a specific change in the environment (such as a VM powering off), the administrator should leverageIntelligent Operations (X-Play)by creating an event-driven Playbook.

Event Trigger:The "VM Power Off" or "Power State Change" is a system-generatedEvent. X-Play allows administrators to select this specific event as aTrigger. This ensures the automation runs in real-time immediately when the state change occurs, rather than waiting for a schedule (as in Option A).

Action (Slack):X-Play includes a nativeSlackaction (or "Send to Slack"). The administrator configures this action with the Slack Webhook URL and the desired message content.

Why not others?

Option Ais reactive and delayed (polling every 6 hours).

Option Bonly runs once during the initial deployment of the blueprint, not continuously during the VM's lifecycle.

Option Csuggests a Webhook trigger, which requires anexternalsystem to invoke the Playbook. Here, the event originatesinternallywithin Nutanix, so an Event Trigger is the correct choice.

For users to successfully deploy Marketplace Blueprints to a specific infrastructure, the Project must have a configuredEnvironment.

The Gap:Merely adding the Account and whitelisting the Cluster in the Project settings (the "Infrastructure" tab) onlyauthorizesaccess. It does not tell the Self-Service enginehowto use that infrastructure (e.g., which Networks to attach, which Storage Containers to use, or what sizing policies to apply).

The Solution:The administrator must go to theEnvironmentstab within the Project andCreate a New Environmentmapped to the new Account and Cluster.

Marketplace Logic:Marketplace blueprints are typically "Environment Agnostic." When a user launches one, they are prompted to select a destination Environment. If no Environment exists for the new cluster, the user cannot select it as a target for deployment.

To satisfy specific ordering requirements around IP assignment (before VM existence) and Security Group assignment (after VM existence but before use), the administrator usesPre-createandPost-createtasks.

Pre-Create Task (IP Address):This task executesbeforethe VM provisioning call is made to the provider. The developer uses this phase (e.g., an HTTP task or Script) to request a specific IP from an external IPAM solution. The IP is stored in a variable and passed to the VM configuration.

VM Provisioning:The VM is created (using the IP from step 1) but is configured in the blueprint to stay in aPowered Offstate initially.

Post-Create Task (Security Group):This task executesimmediately afterthe VM resource is created (so the VM UUID/NIC exists) but before the application logic starts. The developer uses this phase to make an API call (e.g., to Flow or NSX) to place the VM into the required Security Group.

Power On:A subsequent task (or manual action) powers on the VM, ensuring it boots up with the correct IP and within the correct security boundary.

Option C is the only combination that covers both the "Before Creation" and "After Creation" phases required.

When creating a variable in a Nutanix Self-Service Blueprint or Runbook, the administrator must select aData Type. The standard supported data types areString,Integer,Date,Time, andDateTime.

String (Single-line):This is the fundamental text data type (typically just labeled "String" in the UI). It is used for standard alphanumeric inputs.

Input Options:While a String variable can be configured with an attribute to accept "Multi-line" input (useful for SSH keys or scripts), the base data type itself isString(which defaults to single-line).

Invalid Options:"Multi-line integer" is not a valid type. "Year Month Day" is a format description, not the name of theDatedata type. Therefore,Single-line string(representing the standard String type) is the correct available option among the choices.

Nutanix Disaster Recovery usesProtection Policiesto automate replication. These policies are applied to VMs dynamically based onCategories. To protecteveryVM from both blueprints described, the administrator must select a category that iscommon to bothsets of VMs.

Blueprint 1 Categories:OSType: Windows, AppType:IIS

Blueprint 2 Categories:OSType: Windows, Environment:Dev

Commonality:The category OSType: Windows is assigned in both blueprints.

Configuration:By creating a Protection Policy that targets the category OSType: Windows, any VM deployed fromeitherblueprint will automatically inherit this tag. Consequently, the Disaster Recovery engine will immediately detect the new VM and begin replicating it according to the policy (Asynchronous, 1 hour) without manual intervention.

Options B and D would only protect a subset of the VMs (only IIS servers or only Dev workstations, respectively).

InIntelligent Operations (X-Play) Playbooks, the syntax for string interpolation (using parameters) differs from Self-Service (Calm).

Playbook Syntax:X-Play uses thedouble curly bracesyntax {{ ... }} to reference parameters.

Example:To reference the name of the entity that triggered the playbook, the correct parameter string is {{trigger[0].source_entity_info.name}} or {{trigger[0].alert_entity_info.name}} depending on the trigger type.

Contrast:@@{...}@@ (Option B) is the syntax used inSelf-Service (Calm)macros, not X-Play Playbooks.

Comprehensive and Detailed Explanation

Nutanix Calm supports OS customization throughGuest Customization, which:

AppliesSysprepfor Windows

Injects configuration files

Sets hostnames, time zones, networking, and more

Runs scripts post-deployment

Sysprep is specifically executed duringWindows Guest Customization.

Therefore,Option C: Guest Customizationis correct.

Nutanix Self-Service defines several user roles, each with specific permissions.

Documentation describes theConsumerrole as:

Allowed todeploy applications from the Marketplace or assigned blueprints

Allowed to performday-2 operations(power actions, snapshots, etc.)

Restricted from modifying blueprints, environments, or project configurations

Ideal for end users who need access to deploy and manage their workloadswithout administrator capabilities

This matches exactly what the DevOps team requires.

Why the other roles are incorrect

Developer (A):Can modify blueprints and environments — too much privilege.

Project Admin (C):Full control over project resources — far more access than needed.

Operator (D):Used for automation and operational oversight, not end-user VM deployment.

Thus,Consumer (B)is the correct and intended role.

To configure a Playbook to run with the permissions of a specific user rather than the default system context, the creator uses theExecute on behalf offeature.

Context:By default, Playbooks in Intelligent Operations (X-Play) may run with system-level privileges. However, for audit compliance or specific access control requirements (e.g., when an action involves an API call that requires specific user credentials or a ticket creation that needs a specific "Requester"), the administrator can configure the execution context.

Configuration:In the Playbook settings menu, the"Execute on behalf of"option allows the administrator to select a specific Prism Central user. When the Playbook is triggered, all actions within it are executed and logged as if that specific user had performed them manually.

To scale out a Self-Service (formerly Calm) deployment from a single Self-Service VM (SSVM) to a multi-node cluster, the administrator must follow a migration-style procedure rather than an in-place expansion. According to the Self-Service Administration and Operations Guide section onSetting up Scale-Out Self-Service VM:

Backup:The process involves destructive cluster commands, so the administrator must first take a backup of the existing Self-Service data.

Deploy New VMs:The administrator must deploythree new Self-Service VMsusing the provided OVA/template. This ensures a clean, uniform environment for the new cluster. (Adding nodes to an existing, potentially drifted single node is not the standard procedure).

Restore and Cluster:The administrator must then run the specific cluster creation commands (such as cluster create with the IPs of the three new nodes) andrestorethe Self-Service data and configuration from the backup to the new cluster to retain all projects, blueprints, and users.

While the exact order of "Restore" and "Cluster Create" involves technical nuance (creating the service capabilities then populating the data), the key differentiator is that the administrator must deploythree new SSVMs(Migrate) rather than just adding two to the existing one, and must explicit perform arestoreoperation to migrate the data.

Nutanix Self-Service governance supportsApproval Policiesthat enforce control over resource consumption and automation actions. Nutanix documentation states that approval policies:

Apply toblueprint deployments,runbook executions,day-2 actions, orresource scale-up requests.

Requireexplicit authorizationfrom a designated approver before the action proceeds.

Provide governance to ensure resource usage aligns with organizational policies.

Thus, Approval Policies existspecifically to require authorization before a user-triggered task is executed, makingOption C correct.

Options A, B, and D are unrelated to approval workflows.

In Nutanix Intelligent Operations (X-Play), a Playbook action can have a status of"Skipped"in the execution history. This status is specific and distinct from "Failed."

Conditional Execution:Administrators can configureConditionson individual Playbook actions (e.g., "Only run this step if the Alert Severity == Critical" or "Only if entity name contains 'Prod'").

The Cause:If the Playbook triggers successfully but the specific criteria for the notification step are not met during execution, X-Playskipsthat specific action while effectively completing the Playbook run.

If the service were down (Option B) or the configuration invalid (Option A), the step would typically report a"Failed"status, not "Skipped."

In Nutanix Self-Service (Calm), a Quota Policy limits the total infrastructure resources that can be consumed by a Project.5

When configuring a Project, the administrator sets limits for the following specific resources:

vCPUs:The total number of virtual CPUs allocated to VMs in the project.

Memory:The total amount of RAM (in GiB) allocated to VMs.

Disk:The total storage capacity (in GiB) allocated to VMs.

These quotas are enforced during the provisioning process. If a user attempts to launch a blueprint that would cause the project to exceed these defined limits (vCPU, Memory, or Disk), the deployment will fail. Quotas do not monitor IOPs, NIC counts, or the number of blueprints stored.

TheLibraryin Nutanix Self-Service (formerly Calm) serves as a central repository for reusable automation assets that can be shared across multiple Blueprints and Projects. According to the Self-Service Administration Guide, the Library specifically contains:

Tasks (Scripts):The "Task Library" allows administrators to save Shell, PowerShell, Python (eScript), or HTTP tasks. These published tasks can then be imported into any blueprint, ensuring code reusability and standardization.

Variable Types (Variables):The Library also hostsVariable Types(often simply referred to as user-defined variables in the context of the library). Administrators can create and save complex variable definitions (such as lists or static values) in the Library to be reused in different blueprints without redefining them every time.

Endpoints(Option C) are configured in the global Settings or Project settings, not within the Library tab.Apps and Blueprints(Options A and D) have their own dedicated "Apps" and "Blueprints" tabs in the navigation bar.

To configure access to a new cloud target (such as Oracle Cloud, AWS, Azure, or GCP) within Nutanix Self-Service (formerly Calm), the administrator must define the connection in theProviderssection.

Providers (Settings):This is the foundational configuration area where connection details, API endpoints, and authentication credentials for external infrastructure are defined. Before any Project, Environment, or Blueprint can utilize a new cloud, the "Account" or "Provider" definition must be created here.

Workflow:The administrator navigates to theProviders(or "Cloud Providers") tab, selects the provider type (using a plugin or generic provider if Oracle Cloud is not natively listed in the version), and inputs the necessary region and credential information.

Differentiation:

Environments (B)are subsets of a provider assigned to a specific Project.

Marketplace (A)is for publishing applications, not configuring infrastructure connections.

ThePolicy Engineis the core component in Prism Central that enables governance and scheduling capabilities for Self-Service.

Requirement:According to the Administration Guide, thePolicy Enginemust be enabled to useQuotas,Approvals, andSchedulerfeatures.

Function:The Scheduler relies on the Policy Engine to enforce timing and execution rules for Application Actions and Runbooks. Without this engine running, the Scheduler tab and functionality are unavailable.

When configuring aNutanix(AHV) provider account within Self-Service (formerly Calm) to deploy infrastructure, the fundamental artifact required for VM provisioning is anAHV Image.

AHV Image:Nutanix AHV uses theImage Serviceto manage disk images (typically in QCOW2 or ISO format) that serve as the base for virtual machines. Before a Blueprint can be designed or deployed on a Nutanix account, a validDisk Imagemust be uploaded to the Prism Central Image Service. This image is then referenced in the Blueprint's VM configuration (Substrate) as the "Disk Image" source.

Contrast with other Providers:

VMware Template (Option B):This is the required artifact for theVMware vSphereprovider.

VHD (Option A):Typically associated with Hyper-V or Azure.

OVA (Option C):An export format, not a direct provisioning source for the Nutanix provider within Self-Service.

Therefore, ensuring anAHV Imageexists and is available on the cluster is the specific pre-configuration requirement for the Nutanix provider.

To create or configure aCustom Providerin Nutanix Self-Service (Calm), the administrator typically defines the provider's schema (endpoints, variables, and actions) using theSelf-Service DSL(Domain Specific Language) or by constructing a definition file.

YAML Definition:The standard workflow for creating complex custom providers involves defining the provider logic in Python (via the DSL) and compiling it into aYAMLfile, or writing the YAML definition directly.

Import/Update:This YAML file is then uploaded to the Self-Service interface to create or update the Provider definition. This allows the administrator to extend Self-Service capabilities to any infrastructure or service that has an API, beyond the native supported providers.

Note:While the question option phrasing ("Update the blueprint...") may be imprecise, the action of uploading aYAML fileis the specific mechanism associated with defining Custom Providers and DSL-based constructs in Nutanix Self-Service.

Creating and managingPlaybookswithin the Intelligent Operations (X-Play) feature of Prism Central requires an administrative role with sufficient privileges to define system-wide automation rules.

Prism Admin:ThePrism Admin(or Super Admin) role is explicitly required to create, edit, enable, and manage Playbooks. This role grants full control over the Intelligent Operations module.

Prism Viewer (A):This role has read-only access and can view Playbooks but cannot create or modify them.

Self-Service Admin (D):This role is specific to the Self-Service (Calm) application and its blueprints/projects, not the X-Play automation engine in Prism Central.

To ensure a Playbook executes at a specific resource threshold (95% Memory), the administrator must link the Playbook to anAlert Policydefined with that specific threshold.

Relationship between Alerts and Playbooks:In Nutanix Intelligent Operations (X-Play), Playbooks are typically event-driven. The most common trigger is theAlerttrigger. The Playbook itself does not define the threshold (e.g., "95%"); rather, it waits for an Alert to fire.

Configuration:The administrator must configure a specific Alert Policy (e.g., "Critical Memory Usage") in Prism Central to trigger when Memory Usage exceeds 95%.

The Solution:By selecting"Change Trigger to be based off Critical Memory Usage Alert"(Option B), the administrator ensures the Playbook reacts specifically to the alert that corresponds to the 95% threshold. If the system was previously alerting at 100%, it implies the Playbook was linked to a different or default policy. Switching the trigger to the correct "Critical" policy (configured for 95%) solves the issue.

Autopilot (Option A):Autopilot is used totuneinfrastructure limits (like adding CPU/Memory) based on KPI targetsaftera playbook runs; it does not trigger the initial remediation playbook itself.