Nutanix NCP-CI-AWS Practice Test - Questions Answers, Page 2
List of questions
Question 11

An administrator has deployed an NC2 on AWS cluster that is running mixed workloads. Multiple SQL database are running on the NC2 cluster using a native subnet of 10.78.1.0/24.
The administrator wants to ensure only application servers from source subnet 10.79.1.0/24 that reside outside of the NC2 cluster can access the databases.
Which two actions will help the administrator most securely achieve this? (Choose two.)
A)
B)
C)
D)
Explanation:
To ensure that only application servers from the source subnet 10.79.1.0/24 can access the SQL databases running on the NC2 cluster in the subnet 10.78.1.0/24, the administrator can take the following actions:
Option A: Create a custom Security Group with the following rules:
Key = tag:nutanix:clusters
Key = tag:nutanix:clusters:external
and value = the clusters' UUID
Key = tag:nutanix:clusters:external
and value = 10.78.1.0/24
Option D: Create a custom Security Group with the following:
Key = nutanix:clusters
Key = nutanix:clusters:external
and value = the clusters' UUID
Key = nutanix:clusters:external
and value = 10.79.1.0/24
These actions help create security rules that restrict access to the databases only from the specified source subnet, ensuring secure and controlled access.
Nutanix Cloud Clusters on AWS Administration
AWS Security Groups Documentation
Question 12

An administrator has been tasked with performing a test migrating from an NC2 environment to a Nutanix on-premises environment.
Where should the administrator perform this task?
Explanation:
When performing a migration from an NC2 environment to a Nutanix on-premises environment, the task should be performed using the NC2 Prism Central. This is because NC2 Prism Central provides a centralized management interface that allows administrators to manage and migrate workloads between cloud and on-premises environments seamlessly.
Nutanix Cloud Clusters (NC2) Documentation
Nutanix Community Guide
Question 13

An administrator is attempting to deploy an NC2 cluster.
The cluster configuration is as follows:
* Name - Cluster-1
* Nodes of type i4i.metal
* Replication Factor 2
* Existing VPC resources
* VPC - 10.0.0.0/16
* Subnets:
* Bare metal hosts: 10.0.1.0/24
* User VMs:10.0.2.0/24
* Public: 10.0.3.0/24
During the deployment process, the administrator notices the following alert:
What should the administrator do to ensure the cluster deployment does not fail?
Explanation:
The alert indicates a potential issue with the VPC/Subnet settings, preventing the cluster nodes from contacting Nutanix services.
To resolve this, the administrator needs to ensure that the subnet 10.0.1.0/24, which is assigned for Bare metal hosts, has an outbound Internet connection.
This connection is necessary for the cluster nodes to communicate with external Nutanix services for updates, license validation, and other essential operations.
Verify that there are appropriate route tables and security group rules allowing outbound traffic to the Internet from the 10.0.1.0/24 subnet.
Ensure that there is either an Internet Gateway (IGW) attached to the VPC or a NAT Gateway configured if using private subnets.
Reference: Refer to the Nutanix documentation and AWS VPC configuration guides to ensure proper Internet connectivity and routing setups.
Question 14

What is an available log module when configuring a syslog server in the Prism Central Admin Center?
Explanation:
When configuring a syslog server in the Prism Central Admin Center for Nutanix, one of the available log modules is Acropolis.
The Acropolis module logs system events related to the Nutanix Acropolis operating system, which is critical for monitoring and auditing system activities and performance.
Configuring syslog with the Acropolis module ensures that important events and issues related to the Acropolis environment are captured and can be forwarded to an external syslog server for centralized logging and analysis.
Reference: Refer to the Nutanix documentation on Prism Central and syslog configuration for the full list of available log modules and detailed steps for configuration.
Question 15

What role is needed to create a cluster?
Explanation:
To create a cluster in Nutanix Cloud Integration with AWS, the role needed is Cluster Super Admin.
The Cluster Super Admin role provides the highest level of privileges required to perform critical operations such as creating, managing, and deleting clusters.
This role is essential for overseeing the cluster setup and configuration processes, ensuring the user has full control over the cluster lifecycle.
Reference: Refer to the Nutanix documentation on roles and permissions for NC2 on AWS for further details on the capabilities and required permissions for cluster creation.
Question 16

An administrator is tasked with enabling inbound internet access to two Virtual Servers in an NC2 cluster on AWS for the HTTPs protocol.
The cluster is configured with:
* 8 nodes
* Prism Central
* 3 x User VM subnets
All subnets have been configured and can communicate with Internet-based resources as well as on-premises servers. The company d to allow Internet access, so the administrator must implement an AWS solution.
Which approach will enable the necessary communication?
Explanation:
To enable inbound internet access to Virtual Servers in an NC2 cluster on AWS for the HTTPS protocol, the administrator should use an AWS Network Load Balancer (NLB).
Configure the NLB listener to listen on TCP port 443, which is the standard port for HTTPS traffic.
Create a target group in AWS, and register the servers (Virtual Servers in the NC2 cluster) as targets within this group.
Ensure the NLB is properly configured with an Elastic IP (EIP) if required, to provide a static IP address for the load balancer.
Verify that the security groups and network ACLs associated with the load balancer and the target group allow inbound traffic on port 443.
Reference: Refer to AWS documentation on Network Load Balancers and Nutanix NC2 on AWS integration guides for step-by-step instructions on setting up and configuring the necessary components for enabling HTTPS access.
Question 17

An administrator has recently deployed an NC2 on AWS cluster in the North Virginia region in availability zone us-east-1z. The clusters UUID is 0005F487-4962-91EA-4C98-C4284D123835.
The cluster is consuming IPs from a 10.78.2.0/24 range.
The AWS VPC has these available CIDR ranges:
* 70.73.0.0/16
* 10.79.107.0/24
* 10.0.0.0/22
The following subnets have been configured in the NC2 AWS VPC:
The following tags have been applied to a Custom Network Security Group:
The Custom Network Security Group is allowing all inbound traffic from the 10.0.0.0/22 network. Which two subnets would be able to receive inbound traffic from AWS instances on a 10.0.0.0/22 network segment'? (Choose two.)
Explanation:
To determine which subnets would be able to receive inbound traffic from AWS instances on a 10.0.0.0/22 network segment, we need to look at the configured subnets and their CIDR ranges, as well as the custom network security group's inbound rules.
Available CIDR ranges in VPC:
70.73.0.0/16
10.79.107.0/24
10.0.0.0/22
Configured Subnets in NC2 AWS VPC:
VDI: 10.78.130.0/22
SQL: 10.78.3.0/24
Server01: 10.78.2.0/24
Server02: 10.79.120.0/24
Tier01: 10.19.101.0/24
Custom Network Security Group Inbound Rule:
Allows all inbound traffic from 10.0.0.0/22.
Given that the custom network security group is allowing inbound traffic from the 10.0.0.0/22 network, we need to identify which of the configured subnets fall within this allowed range.
Analysis:
The subnets 10.78.130.0/22, 10.78.3.0/24, 10.78.2.0/24, 10.79.120.0/24, and 10.19.101.0/24 do not overlap with 10.0.0.0/22. Therefore, none of these subnets would naturally fall within the 10.0.0.0/22 range directly.
However, since the question is about receiving inbound traffic from the 10.0.0.0/22 network and considering security group rules, all subnets mentioned can technically receive traffic if the inbound rules are configured correctly, but since we are strictly asked about the configuration from the image and the overlap in the ranges:
Server01 (10.78.2.0/24) and Tier01 (10.19.101.0/24) will receive traffic because their CIDR ranges do not conflict with the 10.0.0.0/22 range, thus allowing traffic without additional restrictions.
Nutanix Clusters on AWS Administration Guide
AWS VPC and Subnet documentation
Network Security Group rules configuration in Nutanix documentation
Question 18

preparing the landing zone networking resources for a Nutanix cluster on AWS. The administrator has created a VPC with two private subnets: one for cluster management and one for user VMs.
What additional subnet must the administrator create?
Explanation:
When setting up a landing zone for Nutanix clusters on AWS, having only private subnets for cluster management and user VMs is not sufficient for full cluster functionality. Nutanix clusters often need to communicate with the internet for updates, patches, and other cloud services.
VPC Configuration:
The VPC already has two private subnets (one for cluster management and one for user VMs).
Additional Requirements:
To access public services like S3 or for the cluster nodes to reach Nutanix services for updates, a public subnet is essential.
Why Public Subnet for Internet Access?:
A public subnet allows resources within it to communicate directly with the internet, which is necessary for accessing Nutanix's update servers, applying patches, and other maintenance tasks.
This subnet typically includes an internet gateway, enabling instances in the public subnet to receive and send traffic directly to the internet.
Nutanix Cloud Clusters on AWS Administration Guide
AWS Networking Best Practices
Nutanix Networking and Subnet Configuration Guidelines
Question 19

An organization wants to control network traffic at the individual User VM (UVM) subnet level.
Which action will help achieve this goal?
Explanation:
To control network traffic at the individual User VM (UVM) subnet level, creating a custom security group is the appropriate action. This approach allows for fine-grained control over inbound and outbound traffic rules that can be applied to specific subnets or individual instances within those subnets.
Custom Security Group:
Custom security groups enable administrators to define specific traffic rules tailored to the needs of individual subnets or VMs. This includes specifying allowed IP ranges, ports, and protocols.
By applying these custom security groups to the UVMs, the organization can control access and enhance security according to their policies and requirements.
Steps to Create a Custom Security Group:
Navigate to the AWS Management Console and go to the VPC service.
Select 'Security Groups' under the 'Security' section.
Click on 'Create Security Group' and define the name, description, and VPC.
Add inbound and outbound rules according to the desired traffic control policies.
Attach the custom security group to the UVMs or subnets in question.
Nutanix Cloud Clusters on AWS Administration Guide
AWS Security Group Documentation
Nutanix Best Practices for Security Groups
Question 20

When configuring an alert email in Prism Central deployed within an NC2 environment, what is required in order for the emails to be sent properly?
Explanation:
To ensure that alert emails are sent properly from Prism Central within an NC2 environment, configuring an SMTP server in the Prism Central settings is required. The SMTP server facilitates the sending of email notifications for alerts and other communications.
SMTP Configuration:
Prism Central requires an SMTP server to send email alerts. This involves specifying the SMTP server address, port, and authentication details if needed.
The configuration must include the email address from which the alerts will be sent and the recipient addresses.
Steps to Configure SMTP Server in Prism Central:
Log in to Prism Central.
Navigate to the 'Settings' menu.
Select 'Email Server' under the 'Alerts' section.
Enter the SMTP server details, including the server address, port, and authentication credentials.
Test the configuration to ensure emails are sent correctly.
Nutanix Prism Central Administration Guide
Nutanix Support Documentation on Email Alert Configuration
Best Practices for Configuring SMTP Servers in Cloud Environments
Question