NCP-CI-AWS Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam Questions and Answers

AWS supports EC2 bare-metal instances in regions with at least 3 partitions. Partitions in AWS provide high availability and fault tolerance by distributing instances across different hardware to minimize the impact of hardware failures.

AWS EC2 Bare Metal Instances Documentation

AWS Regions and Availability Zones

The role of " Customer Administrator " in Nutanix Cloud Integration with AWS (NC2) is designed to meet the requirements of creating and managing multiple organizations and clusters, as well as managing user access for the entire company.

Roles and Permissions:

Customer Administrator: This role has the broadest set of permissions, allowing the user to create and manage organizations, clusters, and user access across the entire company. It encompasses administrative control over multiple aspects of the NC2 environment.

Capabilities:

Organization Management: Ability to create and manage multiple organizations.

Cluster Management: Full control over creating, configuring, and managing clusters.

User Access Management: Manage user roles and permissions, ensuring that the right individuals have access to the necessary resources.

Why Not Other Roles:

Organization Administrator: Limited to managing organizations but not clusters and user access at the company level.

Customer Security Administrator: Focuses on security aspects, lacking broader administrative capabilities.

Cluster Administrator: Limited to managing clusters without the ability to manage organizations and user access comprehensively.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Role-Based Access Control Documentation

Multi-Cloud Snapshot Technology (MST) allows Nutanix clusters to protect data by taking snapshots directly to cloud object storage, such as Amazon S3.

When an administrator initiates a recovery from these snapshots, the process is managed throughPrism Central (PC), which serves as the orchestration layer for disaster recovery. Specifically, the execution and progress of the recovery are tracked under theRecovery Planssection within the Data Protection menu. Recovery Plans define the order of VM power-ons, IP address changes, and script executions. By monitoring this section, administrators can verify the status of each step, ensure that the RTO (Recovery Time Objective) is being met, and troubleshoot any failures during the restoration of workloads from the cloud snapshots.

AHV (Answer A):

AHV (Acropolis Hypervisor) can be upgraded using Lifecycle Manager (LCM). LCM simplifies the upgrade process and ensures that all components are updated in a coordinated manner.

BIOS (Answer C):

BIOS upgrades can also be performed using LCM. This helps in maintaining hardware compatibility and performance by ensuring that the latest firmware is installed.

Nutanix Lifecycle Manager (LCM) Documentation

Nutanix AHV Upgrade Guide

Nutanix BIOS Upgrade Documentation

NC2 on AWS allows for the dynamic addition ofAmazon EBS volumesto bare-metal nodes to expand the cluster ' s storage capacity beyond the local NVMe drives. According to Nutanix architectural guidelines, once these EBS volumes are attached and integrated into the storage pool, the capacitycan only be increased. Reducing the storage capacity by removing or shrinking attached EBS volumes is not a supported operation because it would risk data loss and disrupt the Distributed Storage Fabric (DSF) which expects consistent disk availability. Therefore, administrators should carefully size their initial EBS requirements, knowing that they can scale up to meet demand but cannot scale back the capacity of individual existing volumes without a complex data migration or cluster redeployment.

Before accessing the Nutanix Cloud Clusters (NC2) console, the first step is to create a My Nutanix account.

This account serves as the primary gateway for managing and accessing Nutanix services, including NC2.

Once the account is created, users can log in to the Nutanix portal, where they can manage their subscriptions, start trials, and access various Nutanix services, including the NC2 console.

Refer to the Nutanix documentation on getting started with NC2 and the My Nutanix account creation process.

To create a CloudFormation stack, the AWSCloudFormationFullAccess role is required.

This role grants the necessary permissions to create, update, and delete CloudFormation stacks, which are essential for deploying and managing AWS infrastructure using CloudFormation templates.

CloudFormation stacks are often used to automate the deployment of complex infrastructures, including those required for NC2 on AWS.

Proper permissions ensure that the deployment process is seamless and adheres to the security and operational policies of the organization.

Refer to the AWS IAM documentation for details on the AWSCloudFormationFullAccess role and Nutanix documentation on prerequisites for deploying NC2 on AWS.

When a " boot timeout " alert occurs during a cluster expansion, it often indicates that the NC2 console requested a new instance from AWS, but the instance failed to reach a " healthy " state within the allotted time. While networking can be a factor, common " hard " stops at the AWS API level includeService QuotasandInstance Limits. AWS accounts have default limits on the number of bare-metal instances (like i3.metal or i4i.metal) that can be active in a single region. If the expansion request exceeds thevCPU quotaor the specificinstance type limit, AWS will deny the request or fail to provision the hardware. Administrators must verify these quotas in the AWS Service Quotas console and request an increase to support the additional nodes required for the Nutanix cluster.

For environments requiring highly flexible and complex network addressing,Flow Virtual Networking (FVN)is the superior choice over standard native AWS networking. Native AWS networking is often restricted by the CIDR blocks of the VPC, and managing non-contiguous ranges across multiple subnets can become administratively burdensome.FVNuses an overlay architecture (Geneve) that abstracts the User VM networking from the physical AWS VPC infrastructure. This allows administrators to define virtual networks and subnets using any IP range, including multiplenon-contiguous CIDR ranges, without being constrained by the primary VPC address space. This flexibility is essential for large-scale deployments or multi-tenant environments where overlapping or non-standard IP schemes must be supported seamlessly.

Given the company ' s large spend commitments as part of an AWS Enterprise Discount Program (EDP) totaling $15 million, purchasing Nutanix licenses through the AWS Marketplace ensures that the costs contribute to the EDP commitment.

This approach integrates the Nutanix license costs into the overall AWS spend, thereby maximizing the benefits of the EDP.

Purchasing directly from Nutanix or leveraging existing licenses might not count towards the AWS EDP commitment, and trial licenses are typically for evaluation purposes and do not contribute to the committed spend.

Refer to the Nutanix and AWS documentation on licensing and marketplace purchases, and EDP program details.

In a Layer 2 stretched environment where the default gateway resides on-premises, a " Forward policy " is used to route traffic from the cloud back to the data center. If the on-premises data center goes completely offline, the on-premises gateway is no longer reachable, which would halt all North-South communication for the VMs failed over to AWS. To restore full service, the administrator must not only failover the VMs to the NC2 cluster but also remove the Forward policy on the on-premises cluster (or specifically update the routing logic to ensure the AWS cluster takes over gateway duties). This allows the cloud cluster to stop attempting to tunnel traffic to the missing on-premises gateway and instead utilize local cloud-based exit points for network traffic, restoring external connectivity.

For mission-critical workloads, the Recovery Time Objective (RTO) is a primary concern.

Multicloud Snapshot Technology (MST)coupled with aPilot Light Deploymentprovides the necessary infrastructure to support an automated recovery plan. In a Pilot Light scenario, a small, " always-on " version of the Nutanix cluster (usually the minimum number of nodes) is maintained in AWS to host Prism Central and handle background replication tasks. Because the management layer is already active, recovery plans can be fully automated to power on VMs and adjust networking instantly upon failure. In contrast, a " Zero Compute " deployment lacks an active management interface, requiring manual intervention to provision a cluster before recovery can begin, which significantly increases RTO and prevents full automation.

After the NC2 free trial expires, to continue using all features of NC2 on existing clusters, the administrator needs to switch to a paid subscription plan.

A paid subscription ensures uninterrupted access to the full range of features and support for NC2 clusters.

Without switching to a paid plan, the features might be limited, and support may not be available, impacting the cluster ' s operations and management.

Refer to the Nutanix billing and subscription documentation for details on switching from a trial to a paid plan and the benefits associated with paid subscriptions.

The exhibit indicates a replication operation with specific details about the protection domain, remote site, and snapshot. Key points to note are:

Bytes Completed: 0 bytes completed.

Complete Percent: 0.0%

Paused: false

Aborted: false

Given these details:

No ongoing replication: The operation has started, but there is no progress in terms of bytes completed or percentage completed. Since the status shows 0 bytes and 0 percent completed, it indicates that no data has been replicated yet.

Nutanix Protection Domain and Replication Documentation

Nutanix Best Practices for Monitoring Replication

Successful onboarding of an AWS environment into the Nutanix Cloud Clusters ecosystem requires a precise set of administrative permissions to be present on the account used for initial configuration. Specifically, the AWS user must haveCreateRoleFullAccessto allow the automated scripts to generate the necessary service-linked roles. Additionally, the user must possessIAMFullAccessto manage identity policies andAWSCloudFormationFullAccessto execute the deployment templates. This specific combination ensures that the NC2 portal can correctly configure the " Cross-Account Role " which serves as the primary communication bridge between the Nutanix management plane and the AWS infrastructure APIs. Failing to provide any of these three core permissions will result in an " Insufficient Permissions " alert during the cloud account registration process.

The administrator has not created the necessary Security Group:

The error message indicates that the creation of network interfaces in a shared subnet requires specifying a security group. This means that the necessary security group has not been created or assigned to the network interfaces.

Creating the appropriate security group and ensuring it is associated with the network interfaces during cluster deployment should resolve this issue.

Refer to AWS documentation on security groups and network interface configuration and Nutanix documentation on prerequisites for deploying NC2 clusters in an existing AWS VPC.

For AOS software support related to NC2, the appropriate entity to contact is Nutanix. Nutanix provides comprehensive support for their software, including the Acropolis Operating System (AOS) used in NC2 deployments.

Support Scope:

Nutanix offers support for the deployment, configuration, and management of NC2 clusters, including any issues related to AOS software.

This includes troubleshooting, updates, and technical assistance.

Why Not Other Options:

Internal IT Operations team: Typically handles internal issues but does not have the specialized knowledge or resources for AOS software support.

Partner: May provide support but would ultimately escalate issues to Nutanix for software-specific concerns.

Public Cloud Vendor: Manages infrastructure-related issues but does not provide support for Nutanix AOS software.

Nutanix Support Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for AOS Support

When creating user VM subnets for multiple NC2 clusters in AWS, the best approach is to create guest-VM subnets for each cluster. This ensures that each cluster has its own dedicated subnets, which simplifies network management and avoids potential IP conflicts.

Advantages of Dedicated Subnets:

Isolation: Each cluster operates in its own subnet, providing better isolation and security.

Management: Easier to manage and troubleshoot network issues when each cluster has its own subnets.

Scalability: More scalable as each subnet can be managed and expanded independently.

Steps to Create Guest-VM Subnets:

Identify the IP range for each subnet.

In the AWS VPC console, create a new subnet for each cluster using the identified IP ranges.

Associate the new subnets with the respective clusters during or after the cluster deployment process.

Why Not Shared Subnets:

Shared subnetscould lead to IP conflicts and make network management more complex, especially as the number of clusters grows.

Nutanix Cloud Clusters on AWS Administration Guide

AWS VPC Subnet Creation Documentation

Gateway Endpoint:

A Gateway Endpoint in AWS allows you to connect to supported AWS services privately without going through the public internet. This setup provides secure and efficient connectivity directly from the corporate VPC to the required AWS services.

Gateway Endpoints support services such as Amazon S3 and DynamoDB and are ideal for scenarios where private connectivity to these services is needed.

Refer to the AWS documentation on VPC endpoints, specifically Gateway Endpoints, and the Nutanix documentation on configuring private connectivity for NC2 deployments.

To achieve anRTO (Recovery Time Objective)as low as15 minutesusing Multicloud Snapshot Technology, aPilot Light Deploymentis essential. In this model, a minimal Nutanix cluster is always active in the cloud. This active presence ensures that the Prism Central management layer is ready to receive recovery commands and that the storage containers are already mounted. Because the " compute " is already provisioned, the recovery process simply involves hydrating the snapshots from the S3 bucket and powering on the VMs according to the Recovery Plan. A " Zero Compute " model would exceed this RTO because the time required to provision new bare-metal instances from AWS and initialize the Nutanix software can take significantly longer than 15 minutes.

Bare-metal EC2 instances are a specialized resource in AWS, and their availability can sometimes be limited within a specific region or Availability Zone. If an administrator attempts to expand an NC2 cluster and the requested instance types are out of stock at the AWS level, the NC2 console will attempt to provision the nodes but will eventually reach aretry limit and fail. The portal does not indefinitely hold the cluster in maintenance mode. Instead, the administrator is responsible for verifying node availability through the AWS Service Health Dashboard or AWS support. If the desired instance type (e.g., i3.metal) is unavailable, the administrator may need to consider expanding into a different Availability Zone or choosing a different supported instance type to satisfy the expansion requirement.

When performing a migration from an NC2 environment to a Nutanix on-premises environment, the task should be performed using the NC2 Prism Central. This is because NC2 Prism Central provides a centralized management interface that allows administrators to manage and migrate workloads between cloud and on-premises environments seamlessly.

Nutanix Cloud Clusters (NC2) Documentation

Nutanix Community Guide

To backup Prism Central configuration data to an Amazon S3 bucket, thepcdr-clicommand with theprotectparameter is used. This parameter is specifically designed for creating protection policies and backing up Prism Central data.

Nutanix Prism Central Documentation

Nutanix pcdr-cli Command Reference

When connectivity is required between two separate AWS VPCs—one hosting native EC2 instances and the other hosting an NC2 cluster—and advanced overlay networking (FVN) is not in use, the most straightforward solution is VPC Peering. Configuring VPC Peering in Amazon Web Services allows for the routing of traffic between the two VPCs using private IP addresses as if they were on the same network. This method requires the least administrative effort because it does not require the deployment of new software overlays like FVN or the management of a complex Transit Gateway. Administrators simply need to establish the peering connection and update the route tables in both VPCs to allow traffic to flow between the respective CIDR ranges, providing secure, high-performance connectivity.

Hibernation is a key cost-optimization feature of NC2 that allows bare-metal nodes to be powered down while preserving the cluster ' s data state in cloud storage. For this functionality to be supported, the data must reside in a specific storage architecture. Only Volumes-only containers support the hibernate and resume feature in NC2 on AWS. These containers are specifically engineered to allow the Nutanix Distributed Storage Fabric (DSF) to safely offload data and metadata to Amazon S3 during the hibernation process and successfully re-integrate it into new bare-metal instances upon resumption. Standard storage containers or AES-optimized containers do not currently support the data mobility and offloading workflows required to preserve cluster state when the physical compute nodes are completely de-provisioned from the AWS environment.

To enable inbound internet access to Virtual Servers in an NC2 cluster on AWS for the HTTPS protocol, the administrator should use an AWS Network Load Balancer (NLB).

Configure the NLB listener to listen on TCP port 443, which is the standard port for HTTPS traffic.

Create a target group in AWS, and register the servers (Virtual Servers in the NC2 cluster) as targets within this group.

Ensure the NLB is properly configured with an Elastic IP (EIP) if required, to provide a static IP address for the load balancer.

Verify that the security groups and network ACLs associated with the load balancer and the target group allow inbound traffic on port 443.

Refer to AWS documentation on Network Load Balancers and Nutanix NC2 on AWS integration guides for step-by-step instructions on setting up and configuring the necessary components for enabling HTTPS access.

AVTEP (VXLAN Tunnel Endpoint) Gatewayshowing a status of " Down " indicates a connectivity or configuration failure within the control plane. In an NC2 environment, the gateway relies on consistent communication withPrism Central (PC)for management and synchronization, as well asNTP and DNSfor time-sync and name resolution. If the route tables in the AWS VPC are missing the necessary entries to reach these management services, the VTEP gateway will fail to initialize or maintain its heartbeat, resulting in a " Down " status. While on-premises reachability is important for traffic flow, the failure to create the extension entirely usually points to these missing internal routes that prevent the Nutanix software components from coordinating correctly within the cloud environment.

In an NC2 on AWS environment, licensing Microsoft Windows Server workloads can be complex due to cloud mobility rights.

If an organization does not have existing licenses with Software Assurance to support " Bring Your Own License " (BYOL) on cloud hardware, they must acquire licenses through the cloud provider. The most integrated and efficient way to achieve this for Nutanix clusters is to select theLicense Includedoption during the host provisioning process in the NC2 console. By purchasing nodes with licenses included, the cost of the Windows Server OS is bundled with the instance hourly rate provided by AWS. This ensures full compliance with Microsoft licensing terms without requiring a separate purchase through external marketplaces or resellers for the cloud-resident VMs.

AHV Metro Availability provides a synchronous replication solution for zero-RPO disaster recovery.

For this to function correctly within an NC2 on AWS environment, the clusters must be architected to survive anAvailability Zone (AZ)failure while maintaining the extremely low latency required for synchronous operations. The supported configurations include havingtwo NC2 clusters running in the same AWS region but in different AZs, ensuring that if one zone goes offline, the other can immediately take over. Additionally, asingle-node NC2 clustercan be used as a target in a different AZ within the same region for specific low-footprint synchronous requirements. Deploying across different regions is not suitable for Metro Availability due to the high latency of inter-region traffic, which would exceed the requirements for synchronous data writes.

In an NC2 architecture usingFlow Virtual Networking (FVN)for centralized routing, the goal is to allow User VMs to communicate with external networks using their original, non-NATed IP addresses. To achieve this when connected to an AWS Transit Gateway, the routing infrastructure must be manually updated. First, astatic route must be added to the cluster ' s AWS VPC route tableto direct traffic destined for non-AWS prefixes toward the Transit Gateway. Second, astatic route must be added to the Transit Gateway ' s own route tableto ensure it knows that traffic for the Nutanix overlay CIDR should be sent back to the Cluster AWS VPC. This bidirectional static routing ensures that traffic can flow seamlessly between the Nutanix overlay and on-premises or other VPC environments without the need for address translation.

When deploying a new NC2 cluster on AWS, especially when moving to specialized hardware like EC2 dedicated hosts, two critical external factors must be verified: subscription status and AWS resource limits. First, the administrator must ensure that theNC2 subscriptionis active and has sufficient credits or a valid payment method to support the new deployment. Second, AWS imposes default limits on the number ofvCPUsand specific instance types that can be provisioned in a region. Since dedicated hosts consume a large number of vCPUs, the deployment will fail if the AWS account quota is exceeded. Verifying and, if necessary, requesting a quota increase from AWS is a mandatory step to ensure the underlying infrastructure is available for the Nutanix software.

The Nutanix NC2 portal uses a hierarchical structure consisting of Customers, Organizations, andWorkspacesto manage resources. A common point of confusion for administrators is that clusters are localized to specific Workspaces. If an administrator logs into the portal and finds their cluster " missing, " the most likely cause is that they are currently viewing a differentworkspacethan the one where the cluster was provisioned. The NC2 console requires users to select the correct context to view their resources. Checking the workspace selector in the portal interface usually resolves this visibility issue, as the account and overall portal permissions are already verified by the successful login.

When managing Nutanix licenses for NC2, administrators can reserve capacity from their existing licenses to ensure dedicated resource availability for cloud deployments.

This reserved capacity is flexible; it is not tied to a single cluster but can cover the usage of all NC2 clusters operating within the same workspace, simplifying license management across multiple deployments. Furthermore, these reservations are not permanent. If a company decides to shift workloads back to their data center, an administrator can unreserve the license by updating the reserved capacity to zero in the Nutanix portal, making that capacity available again for on-premises cluster consumption. This provides a seamless way to manage hybrid cloud licensing costs.

Flow Virtual Networking (FVN)usesGeneve encapsulation, which adds 58 bytes of overhead to every packet. On a standard 1,500-byte network, the effective MTU for the payload is reduced to1442 bytes. While Nutanix attempts to communicate this to User VMs (UVMs) via DHCP, some operating systems or static configurations ignore these advertisements. If a UVM sends a full 1,500-byte packet, the encapsulated packet (1,558 bytes) will be dropped by the AWS physical network. To resolve this, the administrator mustenable jumbo MTU on the UVMs(typically 9,001 bytes in AWS). By allowing the UVM to process larger packets or properly fragment them, the AHV host can successfully encapsulate and transmit the traffic over the underlying AWS infrastructure without fragmentation errors or packet loss.

For a new NC2 on AWS deployment where workload VMs have low storage and memory requirements but high CPU frequency ( > 3.0 GHz) requirements, and the goal is to minimize the number of CPU cores to reduce application licensing costs, thei3.metalinstance type is the most suitable.

i3.metal:

High CPU Frequency: i3.metal instances offer high-frequency Intel Xeon processors (up to 3.1 GHz) which meet the high CPU frequency requirement.

Low Storage and Memory: These instances come with a balanced amount of storage and memory, suitable for workloads with low requirements in these areas.

Minimized CPU Cores: i3.metal instances have fewer CPU cores compared to other high-frequency instances like i4i.metal, making them ideal for minimizing application licensing costs.

Other Instance Types:

z1d.metal: While also offering high CPU frequency, these instances typically come with a higher core count and more memory, which may not be optimal for minimizing licensing costs.

i4i.metal: Designed for I/O intensive applications with higher core counts.

m5d.metal: Balanced instance type but with more cores and not as high CPU frequency as required.

AWS EC2 Instance Types Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Instance Selection

With the Nutanix AOS Pro licensing, several advanced features and add-on products become available. Specifically, in the AWS cluster deployment wizard, the following add-ons are available:

Files:

Nutanix Files provides a software-defined, scale-out file storage solution that simplifies the management and scaling of unstructured data.

Advanced Replication:

Advanced Replication features in Nutanix include synchronous and asynchronous replication capabilities, allowing for robust disaster recovery and data protection solutions.

DARE (Data-At-Rest Encryption):

DARE ensures that all data stored on Nutanix clusters is encrypted, providing a higher level of security for sensitive information.

These features are included in the AOS Pro licensing tier, offering enhanced data management, protection, and security capabilities.

Nutanix Licensing Guide

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Advanced Features

When opting for a native networking deployment (Standard AWS Networking), the architectural requirements differ from an overlay-based setup.

This configuration typically requiresone private management subnetto house the bare-metal hosts and Controller VMs (CVMs). To facilitate outbound communication and administrative access,two public subnetsare required—one for the NAT Gateway to provide internet access to the private nodes, and another to host resources like the Prism load balancer. Finally,one or more User VM (UVM) subnetsare created to host the actual workloads. Unlike Flow Virtual Networking, which uses a single transit VPC, native networking relies on these multiple standard AWS subnets to segregate management, public-facing, and workload traffic within the VPC.

In the NC2 console, an organization is used to segregate clusters based on specific requirements. This segregation allows administrators to manage clusters more effectively by grouping them according to business units, projects, or other criteria. This organizational structure helps in maintaining clear boundaries and applying specific policies or permissions to different clusters within the same NC2 environment.

Nutanix Cloud Clusters on AWS Administration

Nutanix Certified Professional - Cloud Integration - AWS

Traffic from the on-premises network is not permitted by VM and Management security groups:

Ensure that the security groups assigned to the VMs and management interfaces in AWS allow inbound traffic from the on-premises network. Without appropriate security group rules, the traffic will be blocked.

The AWS VPC traffic is blocked by a firewall in the on-premises network:

Check if the firewall on the on-premises network is configured to allow traffic from the AWS VPC. Firewalls may have restrictive rules that block incoming traffic, preventing communication.

Refer to AWS documentation on security groups and firewalls and Nutanix documentation on configuring networking for NC2 clusters.