Nutanix security hardening guidance explains that SSH Whitelisted Addresses control which client IPs are allowed to reach the CVM over SSH. If IP restriction is enabled and the new jump box is not on the allowlist, the SSH connection is expected to be refused. In that locked-down state, the correct recovery path is to access the CVM through a local or serial console and update the whitelist to include the new jump box IP. That makes C the correct answer. ( portal.nutanix.com , portal.nutanix.com )

Cluster Lockdown disabling password-based SSH is not the same setting as the SSH allowlist. Prism Central security views can help with visibility, but the key documented mechanism is the whitelist itself. Restarting the CVM does not reset the hardened configuration. Nutanix’s intent is that trusted-source access must be explicitly permitted, and once it is blocked, you need console-level access to make the change safely.