Pass the Nutanix Nutanix Certified Professional (NCP) NCP-CI-AWS Questions and answers with CertsForce

The clusters that are to be protected must be registered with the same instance of Prism Central (Answer C):

For Cluster Protect to function correctly, all clusters intended for protection must be registered under the same Prism Central instance. This ensures consistent management and coordination of protection policies and operations across clusters.

The Cluster Protect feature requires AOS version 6.7 or higher (Answer D):

Cluster Protect is a feature that is available starting from AOS version 6.7. To utilize this feature, ensure that the Nutanix clusters are running this version or a newer one.

Nutanix Cluster Protection Documentation

Nutanix AOS Release Notes

When selecting the NC2 subscription plan from the Nutanix Billing portal, the available options include:

Pay-as-you-Go (PayG): A flexible payment option where users are billed based on their actual usage, providing cost efficiency for variable workloads.

Bring your own License (BYOL): Allows users to utilize existing Nutanix licenses they have purchased, offering a cost-effective way to leverage existing investments in Nutanix software.

Refer to the Nutanix billing and subscription documentation for detailed descriptions of subscription plans and their benefits.

Hibernation is a key cost-optimization feature of NC2 that allows bare-metal nodes to be powered down while preserving the cluster ' s data state in cloud storage. For this functionality to be supported, the data must reside in a specific storage architecture. Only Volumes-only containers support the hibernate and resume feature in NC2 on AWS. These containers are specifically engineered to allow the Nutanix Distributed Storage Fabric (DSF) to safely offload data and metadata to Amazon S3 during the hibernation process and successfully re-integrate it into new bare-metal instances upon resumption. Standard storage containers or AES-optimized containers do not currently support the data mobility and offloading workflows required to preserve cluster state when the physical compute nodes are completely de-provisioned from the AWS environment.

To protect workloads on an NC2 cluster on AWS, deploying strategies that ensure high availability and disaster recovery are essential. The two valid options are:

Create a Second NC2 Cluster in a Different Availability Zone:

High Availability: Deploying a second NC2 cluster in a different availability zone ensures that workloads can be quickly recovered in case of an availability zone failure.

Disaster Recovery: This setup enables asynchronous replication between clusters, providing a robust disaster recovery solution.

Use an Existing On-Prem Nutanix Cluster as a Disaster Recovery Target:

Hybrid DR: Leveraging an existing on-premises Nutanix cluster for disaster recovery provides a cost-effective and efficient DR solution.

Replication: Set up replication policies to ensure data is consistently copied from the NC2 cluster on AWS to the on-premises cluster.

Why Not Other Options:

One-node cluster in another availability zone: Not a valid DR solution as a single-node cluster cannot provide the required resilience and high availability.

Deploy a cluster across two availability zones: While this can enhance availability, it is not a typical approach for Nutanix clusters which are designed to operate within a single availability zone for simplicity and performance reasons.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Disaster Recovery Best Practices

AWS Availability Zones and Disaster Recovery Documentation

To ensure that only application servers from the source subnet 10.79.1.0/24 can access the SQL databases running on the NC2 cluster in the subnet 10.78.1.0/24, the administrator can take the following actions:

Option A: Create a custom Security Group with the following rules:

Key = tag:nutanix:clusters

Key = tag:nutanix:clusters:external

and value = the clusters ' UUID

Key = tag:nutanix:clusters:external

and value = 10.78.1.0/24

Option D: Create a custom Security Group with the following:

Key = nutanix:clusters

Key = nutanix:clusters:external

and value = the clusters ' UUID

Key = nutanix:clusters:external

and value = 10.79.1.0/24

These actions help create security rules that restrict access to the databases only from the specified source subnet, ensuring secure and controlled access.

Nutanix Cloud Clusters on AWS Administration

AWS Security Groups Documentation

When extending a Layer 2 subnet from on-premises to NC2 on AWS, the default gateway often remains at the on-premises location.

For Virtual Machines (VMs) running on the NC2 cluster in AWS to communicate with resources outside their immediate subnet, their traffic must be directed back through the tunnel to the on-premises gateway. This is achieved by configuring arouting policyon the NC2 cluster with aForward action. This policy identifies traffic destined for the gateway and encapsulates it via the VTEP (VXLAN Tunnel Endpoint) using port 4789. Without this forward action policy, the AWS-based VMs would attempt to find a local gateway within the AWS VPC, resulting in a loss of connectivity for any North-South traffic.

To create a cluster in Nutanix Cloud Integration with AWS, the role needed is Cluster Super Admin.

The Cluster Super Admin role provides the highest level of privileges required to perform critical operations such as creating, managing, and deleting clusters.

This role is essential for overseeing the cluster setup and configuration processes, ensuring the user has full control over the cluster lifecycle.

Refer to the Nutanix documentation on roles and permissions for NC2 on AWS for further details on the capabilities and required permissions for cluster creation.

Traffic from the on-premises network is not permitted by VM and Management security groups:

Ensure that the security groups assigned to the VMs and management interfaces in AWS allow inbound traffic from the on-premises network. Without appropriate security group rules, the traffic will be blocked.

The AWS VPC traffic is blocked by a firewall in the on-premises network:

Check if the firewall on the on-premises network is configured to allow traffic from the AWS VPC. Firewalls may have restrictive rules that block incoming traffic, preventing communication.

Refer to AWS documentation on security groups and firewalls and Nutanix documentation on configuring networking for NC2 clusters.

To manually create an AWS VPC with Public access to Prism Element for testing purposes, the following components must be created:

VPC: A Virtual Private Cloud to provide an isolated network for the resources.

Delegated Subnets: Subnets within the VPC to segment the network and allocate IP ranges.

Route Tables: To define routing rules for the subnets to ensure proper traffic flow.

NAT Gateway: To enable instances in the private subnets to access the internet.

Internet Gateway: To allow direct internet access to instances in the public subnets.

Load Balancer: To distribute traffic across multiple instances for improved availability and redundancy.

Refer to the AWS documentation on VPC creation and Nutanix documentation on network setup for Prism Element access.

Flow Virtual Networking (FVN)provides an advanced software-defined networking layer that supports three specific types of connectivity models for NC2 clusters. First,NAT (Network Address Translation)networks allow User VMs to access external resources (like the internet) using the gateway ' s IP, providing a layer of security. Second,No-NATnetworks allow for transparent routing between the Nutanix overlay and on-premises or other VPC environments, preserving the original VM IP addresses. Third,L2 Stretchednetworks (Subnet Extensions) use VXLAN tunnels to extend a single broadcast domain from an on-premises data center to the cloud cluster. These three types allow administrators to tailor their network architecture based on the specific security and connectivity requirements of each workload hosted in the cloud.