Free Nutanix Certified Professional NCP-CI-AWS Ultimate Study Guide (Updated 77 Questions)
Get to the Top with NCP-CI-AWS Practice Exam Questions
Nutanix NCP-CI-AWS Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 22
An administrator is tasked with deploying a VM in an NC2 cluster on AWS that needs to by accessed by resources within the on-premises datacenter.
The cluster has the following characteristics:
* 8 nodes
* Resides in the us-east-1a Availability Zone
* Contains 13 Subnets
* Has access to a Direct Connect connection
* Subnet that the User VM (UVM) is being deployed to:UserVM_subnet
There are multiple VMs within the cluster and the UserVM_subnet has access to the on-premises resources.
The administrator deploys the machine, but communication is not possible.
What is the most likely resolution for this situation?
- A. The AWS User Management Security Group requires the new application's ports adding to and traffic
- B. The AWS Internal Management Security Group requires the new application's ports adding to outbound traffic.
- C. The AWS UVM Security Group requires the new application's ports adding to inbound traffic.
- D. The AWS IGW requires the new application's ports adding to inbound traffic.
Answer: C
Explanation:
For a VM deployed in an NC2 cluster on AWS to be accessed by resources within the on-premises datacenter, the security group associated with the User VM (UVM) subnet must allow inbound traffic on the specific ports required by the application.
If the security group rules do not permit inbound traffic on these ports, the communication will fail, even if other network configurations are correct.
The administrator should ensure that the UVM Security Group includes rules to allow inbound traffic for the application's required ports, facilitating proper communication between the VM and on-premises resources.
Reference:
Refer to the AWS documentation on security group configurations and Nutanix NC2 documentation for details on configuring network access and security group rules.
NEW QUESTION # 23
An administrator has deployed NC2 on AWS. The cluster deployment completed successfully.
After deployment, the administrator created a subnet in AWS, added it as a network in Prism Element, deployed Prism Central using the newly-configured network, and registered the cloud cluster with it.
The on-premises network and AWS are connected via a Site-to-Site VPN. Cluster nodes, CVM, and Prism Central can communicate with each other, but cannot be accessed from the on-premises network.
What two issues might be the cause of this problem? (Choose two.)
- A. The AWS VPC traffic is blocked by a firewall in the on-premises network.
- B. The AHV firewall is blocking traffic from the on-premises network.
- C. Traffic from the on-premises network is not permitted by VM and Management security groups.
- D. AWS Direct Connect must be used to establish connection between AWS and on-premises
Answer: A,C
Explanation:
Traffic from the on-premises network is not permitted by VM and Management security groups:
Ensure that the security groups assigned to the VMs and management interfaces in AWS allow inbound traffic from the on-premises network. Without appropriate security group rules, the traffic will be blocked.
The AWS VPC traffic is blocked by a firewall in the on-premises network:
Check if the firewall on the on-premises network is configured to allow traffic from the AWS VPC. Firewalls may have restrictive rules that block incoming traffic, preventing communication.
Reference:
Refer to AWS documentation on security groups and firewalls and Nutanix documentation on configuring networking for NC2 clusters.
NEW QUESTION # 24
Which two features or services can an administrator ensure are protected by cluster protect within an NC2 environment? (Choose two.)
- A. Nutanix Files
- B. Flow Network Security
- C. VM Templates
- D. Virtual Machine Disks
Answer: A,D
Explanation:
Within an NC2 environment, the Cluster Protect feature can ensure the protection of:
Nutanix Files: This provides file services within the Nutanix ecosystem, and Cluster Protect can safeguard the data stored in Nutanix Files.
Virtual Machine Disks: This ensures that the data stored on virtual machine disks is protected, providing backup and recovery options for the virtual machines running within the cluster.
Reference:
Nutanix Cloud Clusters on AWS Administration
Nutanix AOS 6.7 Documentation
NEW QUESTION # 25
An administrator needs the permissions to create and manage multiple organizations and clusters in NC2, as well as manage user access for the entire company.
What role should be assigned to meet the minimum requirements of this task?
- A. Customer Security Administrator
- B. Cluster Administrator
- C. Customer Administrator
- D. Organization Administrator
Answer: C
Explanation:
The role of "Customer Administrator" in Nutanix Cloud Integration with AWS (NC2) is designed to meet the requirements of creating and managing multiple organizations and clusters, as well as managing user access for the entire company.
Roles and Permissions:
Customer Administrator: This role has the broadest set of permissions, allowing the user to create and manage organizations, clusters, and user access across the entire company. It encompasses administrative control over multiple aspects of the NC2 environment.
Capabilities:
Organization Management: Ability to create and manage multiple organizations.
Cluster Management: Full control over creating, configuring, and managing clusters.
User Access Management: Manage user roles and permissions, ensuring that the right individuals have access to the necessary resources.
Why Not Other Roles:
Organization Administrator: Limited to managing organizations but not clusters and user access at the company level.
Customer Security Administrator: Focuses on security aspects, lacking broader administrative capabilities.
Cluster Administrator: Limited to managing clusters without the ability to manage organizations and user access comprehensively.
Reference:
Nutanix Cloud Clusters on AWS Administration Guide
Nutanix Role-Based Access Control Documentation
NEW QUESTION # 26
To deploy NC2 in AWS using an existing VPC, which two AWS resources should be configured beforehand? (Choose two.)
- A. NAT Gateway
- B. Placement Group
- C. Bare-metal EC2 Instance
- D. Public and Private Subnets
Answer: A
Explanation:
To deploy NC2 in AWS using an existing VPC, the following AWS resources should be configured beforehand:
NAT Gateway: This allows instances in the private subnet to connect to the internet or other AWS services, while preventing the internet from initiating connections with those instances.
Public and Private Subnets: These are necessary to segregate the network traffic. Public subnets provide a direct route to the internet gateway, while private subnets are used for internal resources that do not need direct access to the internet.
Reference:
Nutanix Cloud Clusters on AWS Deployment Guide
Nutanix Support & Insights
NEW QUESTION # 27
An administrator is experiencing problems with several operations, including VM IP address assignment validations, VM power-on and VM power-off operations.
Whenever a related operation is performed, an alert is generated in the NC2 console indicating that the Cloud API endpoints are unavailable.
The issue was further investigated and it was determined that NC2 is unable to make API calls to the underlying cloud infrastructure due to network connectivity misconfigurations.
Which two connectivity misconfigurations could be causing this issue? (Choose two.)
- A. AWS VPC endpoints are used for connectivity to AWS services.
- B. Route tables for cloud subnets contain incorrect route entries.
- C. IAM roles and policies are incorrectly configured.
- D. Subnets are connected to the Internet via NAT gateways.
Answer: B,C
Explanation:
Route tables for cloud subnets contain incorrect route entries:
If the route tables associated with the cloud subnets contain incorrect route entries, the NC2 cluster might not be able to reach the necessary AWS services or endpoints. Correct route entries are crucial for ensuring proper communication between the NC2 cluster and the underlying AWS infrastructure.
IAM roles and policies are incorrectly configured:
Incorrectly configured IAM roles and policies can prevent NC2 from making API calls to AWS services. These roles and policies must be properly set up to allow the necessary permissions for NC2 to interact with AWS resources and perform required operations.
Reference:
Refer to the AWS documentation on route table configuration and IAM roles and policies, and Nutanix documentation on NC2 cloud connectivity and permissions.
NEW QUESTION # 28
Which service enables the monitoring of key metrics on various AWS services, inducing EC2, EBS, and VPC for an NC2 cluster deployments?
- A. AWS CloudTrail
- B. Amazon inspector
- C. AWS CloudFormation
- D. Amazon CloudWatch
Answer: D
Explanation:
Amazon CloudWatch is the service that enables the monitoring of key metrics on various AWS services, including EC2, EBS, and VPC, for NC2 cluster deployments.
Amazon CloudWatch:
Amazon CloudWatch provides monitoring for AWS cloud resources and applications. It collects and tracks metrics, collects and monitors log files, and sets alarms.
Specifically, for NC2 deployments, CloudWatch can be used to monitor key metrics such as CPU utilization, disk I/O, network I/O for EC2 instances, EBS volume performance, and VPC network traffic.
Features:
Metrics Monitoring: Collects and visualizes operational data in the form of metrics, including utilization, performance, and health.
Logs Monitoring: Collects log data, monitors it in real-time, and triggers alarms based on predefined thresholds.
Alarms: Notifies when operational performance thresholds are breached.
Integration with NC2:
By setting up CloudWatch, administrators can ensure they have visibility into the performance and health of their Nutanix clusters on AWS, aiding in proactive management and troubleshooting.
Reference:
Amazon CloudWatch Documentation
Nutanix Cloud Clusters on AWS Administration Guide
AWS Monitoring Best Practices
NEW QUESTION # 29
An administrator needs to create user VM subnets for multiple NC2 clusters in AWS.
What would be the best approach to take?
- A. Create guest-VM VNets for each cluster.
- B. Use the cluster management subnet dedicated to each cluster.
- C. Create guest-VM subnets for each cluster.
- D. Create guest-VM subnets to be shared by all clusters.
Answer: C
Explanation:
When creating user VM subnets for multiple NC2 clusters in AWS, the best approach is to create guest-VM subnets for each cluster. This ensures that each cluster has its own dedicated subnets, which simplifies network management and avoids potential IP conflicts.
Advantages of Dedicated Subnets:
Isolation: Each cluster operates in its own subnet, providing better isolation and security.
Management: Easier to manage and troubleshoot network issues when each cluster has its own subnets.
Scalability: More scalable as each subnet can be managed and expanded independently.
Steps to Create Guest-VM Subnets:
Identify the IP range for each subnet.
In the AWS VPC console, create a new subnet for each cluster using the identified IP ranges.
Associate the new subnets with the respective clusters during or after the cluster deployment process.
Why Not Shared Subnets:
Shared subnets could lead to IP conflicts and make network management more complex, especially as the number of clusters grows.
Reference:
Nutanix Cloud Clusters on AWS Administration Guide
AWS VPC Subnet Creation Documentation
NEW QUESTION # 30
An administrator planned to create a new NC2 cluster and chose the existing AWS VPC infrastructure in the workflow. The administrator needs two private subnets to complete the configuration.
- A. For private NAT and Elastic IP management
- B. For DNS and NJP management
- C. For user VMs and cluster management
- D. For Prism Element and Prism Central management
Answer: C
Explanation:
When creating a new NC2 cluster using an existing AWS VPC infrastructure, two private subnets are needed. These subnets are used as follows:
One private subnet for user VMs, which houses the virtual machines that users interact with.
Another private subnet for cluster management, which is used for internal cluster operations and management tasks, ensuring that management traffic is isolated from user traffic for security and performance reasons.
Reference:
Nutanix Support & Insights
Nutanix Cloud Clusters on AWS Administration
NEW QUESTION # 31
An administrator has recently deployed an NC2 on AWS cluster in the North Virginia region in availability zone us-east-1z. The clusters UUID is 0005F487-4962-91EA-4C98-C4284D123835.
The cluster is consuming IPs from a 10.78.2.0/24 range.
The AWS VPC has these available CIDR ranges:
* 70.73.0.0/16
* 10.79.107.0/24
* 10.0.0.0/22
The following subnets have been configured in the NC2 AWS VPC:
The following tags have been applied to a Custom Network Security Group:
The Custom Network Security Group is allowing all inbound traffic from the 10.0.0.0/22 network. Which two subnets would be able to receive inbound traffic from AWS instances on a 10.0.0.0/22 network segment"? (Choose two.)
- A. SQL
- B. Tier01
- C. VDl
- D. Server01
Answer: B,D
Explanation:
To determine which subnets would be able to receive inbound traffic from AWS instances on a 10.0.0.0/22 network segment, we need to look at the configured subnets and their CIDR ranges, as well as the custom network security group's inbound rules.
Available CIDR ranges in VPC:
70.73.0.0/16
10.79.107.0/24
10.0.0.0/22
Configured Subnets in NC2 AWS VPC:
VDI: 10.78.130.0/22
SQL: 10.78.3.0/24
Server01: 10.78.2.0/24
Server02: 10.79.120.0/24
Tier01: 10.19.101.0/24
Custom Network Security Group Inbound Rule:
Allows all inbound traffic from 10.0.0.0/22.
Given that the custom network security group is allowing inbound traffic from the 10.0.0.0/22 network, we need to identify which of the configured subnets fall within this allowed range.
Analysis:
The subnets 10.78.130.0/22, 10.78.3.0/24, 10.78.2.0/24, 10.79.120.0/24, and 10.19.101.0/24 do not overlap with 10.0.0.0/22. Therefore, none of these subnets would naturally fall within the 10.0.0.0/22 range directly.
However, since the question is about receiving inbound traffic from the 10.0.0.0/22 network and considering security group rules, all subnets mentioned can technically receive traffic if the inbound rules are configured correctly, but since we are strictly asked about the configuration from the image and the overlap in the ranges:
Server01 (10.78.2.0/24) and Tier01 (10.19.101.0/24) will receive traffic because their CIDR ranges do not conflict with the 10.0.0.0/22 range, thus allowing traffic without additional restrictions.
Reference:
Nutanix Clusters on AWS Administration Guide
AWS VPC and Subnet documentation
Network Security Group rules configuration in Nutanix documentation
NEW QUESTION # 32
An administrator has deployed an NC2 on AWS cluster and doesn't have connectivity back to the on-premises environment yet. The administrator wants to SSH into a CVM to edit a security setting and has deployed a Jump Host into an existing public subnet.
What action must the administrator still take to gain access to the CVM?
- A. Edit the UVM security group to allow SSH from the Jump Host IP and remove Cluster Lockdown.
- B. Create Custom Network Security Group at the subnet level and add the IP address of the Jump Host
- C. Edit the User Management Network Security Group to allow SSH from the Jump Host IP.
- D. Edit the CVM iptables to allow SSH.
Answer: C
Explanation:
To SSH into a Controller VM (CVM) in an NC2 on AWS cluster without on-premises connectivity, the administrator needs to ensure that the security settings allow SSH access from the Jump Host. This involves editing the User Management Network Security Group to permit SSH traffic from the Jump Host IP.
Deploy Jump Host:
Ensure the Jump Host is deployed in a public subnet with an Elastic IP (EIP) assigned for external access.
Edit User Management Network Security Group:
Locate the security group associated with the user management network.
Modify the inbound rules to allow SSH (port 22) from the Jump Host's IP address. This ensures that the Jump Host can establish an SSH connection to the CVM.
Steps to Edit Security Group:
Navigate to the EC2 dashboard in the AWS Management Console.
Select "Security Groups" under the "Network & Security" section.
Find and select the appropriate security group.
Edit the inbound rules to add a new rule:
Type: SSH
Protocol: TCP
Port Range: 22
Source: Custom IP (enter the Jump Host's public IP address)
Additional Configuration:
Ensure that the CVM itself allows SSH connections and that no internal firewall rules block the traffic.
Reference:
Nutanix Cloud Clusters on AWS Administration Guide
AWS Security Group Documentation
Nutanix Best Practices for Secure Access
NEW QUESTION # 33
An organization wants to control network traffic at the individual User VM (UVM) subnet level.
Which action will help achieve this goal?
- A. Modify the internal management security group.
- B. Modify the user management security group.
- C. Modify the default UVM security group.
- D. Create a custom security group.
Answer: D
Explanation:
To control network traffic at the individual User VM (UVM) subnet level, creating a custom security group is the appropriate action. This approach allows for fine-grained control over inbound and outbound traffic rules that can be applied to specific subnets or individual instances within those subnets.
Custom Security Group:
Custom security groups enable administrators to define specific traffic rules tailored to the needs of individual subnets or VMs. This includes specifying allowed IP ranges, ports, and protocols.
By applying these custom security groups to the UVMs, the organization can control access and enhance security according to their policies and requirements.
Steps to Create a Custom Security Group:
Navigate to the AWS Management Console and go to the VPC service.
Select "Security Groups" under the "Security" section.
Click on "Create Security Group" and define the name, description, and VPC.
Add inbound and outbound rules according to the desired traffic control policies.
Attach the custom security group to the UVMs or subnets in question.
Reference:
Nutanix Cloud Clusters on AWS Administration Guide
AWS Security Group Documentation
Nutanix Best Practices for Security Groups
NEW QUESTION # 34
The cluster is configured as follows:
* 8 nodes
* Prism Central Deployed
* Files Deployed
Following the deployment, the administrator experiences network connectivity issues.
Which reason explains the connectivity issues?
- A. The 192.168.5.0/24 range is reserved for internal cluster usage.
- B. The 192.168.5.0/24 range does not have enough IP addresses available.
- C. The 192.168.5.0/24 range is reserved by IANA,
- D. The 192.168.5.0/24 range is not a valid CIDR range.
Answer: A
Explanation:
The 192.168.5.0/24 range is often reserved for internal cluster communication within Nutanix deployments.
Using this CIDR range for other purposes could lead to network conflicts and connectivity issues, as it might interfere with the internal operations and communication channels of the Nutanix cluster.
Ensuring that the CIDR range is not overlapping with any reserved ranges is crucial for maintaining proper network connectivity and cluster functionality.
Reference:
Refer to the Nutanix documentation on network configuration and best practices for NC2 deployments to confirm reserved IP ranges and their appropriate use.
NEW QUESTION # 35
An administrator has deployed an NC2 on AWS cluster that is running mixed workloads. Multiple SQL database are running on the NC2 cluster using a native subnet of 10.78.1.0/24.
The administrator wants to ensure only application servers from source subnet 10.79.1.0/24 that reside outside of the NC2 cluster can access the databases.
Which two actions will help the administrator most securely achieve this? (Choose two.)
- A.
- B.
- C.
- D.
Answer: A,B
Explanation:
To ensure that only application servers from the source subnet 10.79.1.0/24 can access the SQL databases running on the NC2 cluster in the subnet 10.78.1.0/24, the administrator can take the following actions:
Option A: Create a custom Security Group with the following rules:
Key = tag:nutanix:clusters
Key = tag:nutanix:clusters:external
and value = the clusters' UUID
Key = tag:nutanix:clusters:external
and value = 10.78.1.0/24
Option D: Create a custom Security Group with the following:
Key = nutanix:clusters
Key = nutanix:clusters:external
and value = the clusters' UUID
Key = nutanix:clusters:external
and value = 10.79.1.0/24
These actions help create security rules that restrict access to the databases only from the specified source subnet, ensuring secure and controlled access.
Reference:
Nutanix Cloud Clusters on AWS Administration
AWS Security Groups Documentation
NEW QUESTION # 36
An administrator is planning an NC2 deployment and wants to connect to AWS Services privately from the corporate VPC without going through the public internet.
Which connectivity solution should the administrator use?
- A. Gateway Endpoint
- B. Site-to-Site VPN
- C. Point-to-Site VPN
- D. VTEP Gateways
Answer: A
Explanation:
Gateway Endpoint:
A Gateway Endpoint in AWS allows you to connect to supported AWS services privately without going through the public internet. This setup provides secure and efficient connectivity directly from the corporate VPC to the required AWS services.
Gateway Endpoints support services such as Amazon S3 and DynamoDB and are ideal for scenarios where private connectivity to these services is needed.
Reference:
Refer to the AWS documentation on VPC endpoints, specifically Gateway Endpoints, and the Nutanix documentation on configuring private connectivity for NC2 deployments.
NEW QUESTION # 37
An administrator is seeking help with an ongoing NC2 issue. After reaching out to Nutanix support, the administrator is introduced to NC2 specialist who can help troubleshoot the problem.
- A. Confirm the Support Authorization on the organization is set to Full Access.
- B. Ensure the specialist is assigned the RBAC role with proper permissions.
- C. Add the specialist as an admin user to the organizations.
- D. Provide the specialist with the administrator's login credentials.
Answer: A,B
Explanation:
Ensure the specialist is assigned the RBAC role with proper permissions (Answer A):
Role-Based Access Control (RBAC) ensures that the specialist has the necessary permissions to troubleshoot and manage the NC2 environment. This avoids unnecessary privilege escalations and maintains security.
Confirm the Support Authorization on the organization is set to Full Access (Answer C):
Setting the Support Authorization to Full Access allows the Nutanix support specialist to have the required access to investigate and resolve issues in the environment. This is essential for effective troubleshooting.
Reference:
Nutanix RBAC Documentation
Nutanix Support Access Guide
NEW QUESTION # 38
A company needs to create virtual interfaces directly to public AWS S3 services. The company also wants to bypass any internet service providers in the network path.
Which method will best satisfy this requirement?
- A. SSH
- B. VPN
- C. Bastion Host
- D. Direct Connect
Answer: D
Explanation:
AWS Direct Connect allows companies to create private, dedicated connections between their data centers and AWS. This bypasses the internet and provides a more reliable and faster network connection directly to AWS services, including S3.
Reference:
AWS Direct Connect Documentation
AWS S3 Access over Direct Connect
NEW QUESTION # 39
......
Pass Nutanix NCP-CI-AWS exam - questions - convert Tets Engine to PDF: https://pass4sure.actualpdf.com/NCP-CI-AWS-real-questions.html
