NCP-CN Nutanix Certified Professional - Cloud Native (NCP-CN-6.10) Questions and Answers

Comprehensive and Detailed Explanation From General Kubernetes Knowledge:

Since this question involves AWS EKS and Azure AKS specifics outside the NKP context, and web search is unavailable, I will rely on general Kubernetes knowledge as of my last update. Using a custom image for EKS and AKS worker nodes means replacing the default, optimized images provided by AWS and Azure, which are pre-configured with components tailored for their managed Kubernetes services.

The primary functionality lost by using a custom image in both EKS and AKS isbuilt-in autoscaling and security capabilities(Option C):

Autoscaling: Both EKS and AKS rely on their default node images to integrate with their native autoscaling mechanisms, such as the EKS Cluster Autoscaler (which uses AWS Auto Scaling Groups) and AKS Cluster Autoscaler (which integrates with Azure Virtual Machine Scale Sets). Custom images may lack the necessary agents or configurations (e.g., AWS SSM Agent, Azure VM extensions) to communicate with these autoscaling services, requiring manual configuration.

Security Capabilities: Default images include pre-configured security features, such as AWS’s integration with IAM roles for service accounts (IRSA) and Azure’s integration with Azure Active Directory (AAD) for RBAC. Custom images may not include these integrations, potentially breaking security features like automatic credential rotation or managed identity support unless manually configured.

Incorrect Options:

A. Native monitoring tools, logging, and alerting: Monitoring and logging (e.g., AWS CloudWatch, Azure Monitor) are managed at the control plane level, not the node image level, so these features are generally unaffected by custom images.

B. Cluster networking and load balancing: Networking (e.g., AWS VPC CNI, Azure CNI) and load balancing (e.g., AWS ALB, Azure Load Balancer) are configured by the control plane and CNI plugins, not the node image.

D. Ability to use GPUs and persistent storage: GPU support and persistent storage (e.g., EBS, Azure Disk) depend on drivers and CSI plugins, which can be installed on custom images without losing functionality.

The NKPA course explains that NKP uses Grafana Loki as part of its logging stack to implement a multi-tenant logging system, allowing teams to access their logs securely within their respective namespaces. The exhibit indicates two namespaces, tenant-innovation and tenant-analytics, each with a ConfigMap for logging configuration. The requirement is to set a retention period of 30 days for tenant-innovation and 7 days for tenant-analytics.

The correct YAML output (Option A) configures Loki’s retention period using ConfigMaps in the appropriate namespaces:

For tenant-innovation, the ConfigMap logging-innovation-config in the tenant-innovation namespace sets retention_period: 30d.

For tenant-analytics, the ConfigMap logging-analytics-config in the tenant-analytics namespace sets retention_period: 7d.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In NKP, configure multi-tenant logging with Grafana Loki by creating a ConfigMap per namespace, specifying retention periods under loki.structuredConfig.limits_config.retention_period (e.g., 30d for 30 days, 7d for 7 days).” The d suffix denotes days, aligning with the requirement for 30 days and 7 days retention periods.

Incorrect Options:

B: The second ConfigMap incorrectly uses the tenant-innovation namespace instead of tenant-analytics, breaking the multi-tenant isolation.

C: The retention periods are set to 30h and 7h (hours), not 30d and 7d (days), which does not meet the requirement.

D: Both ConfigMaps use a generic tenant namespace, which does not match the specific namespaces (tenant-innovation, tenant-analytics) shown in the exhibit.

The NKPA course clarifies that NKP licenses are based on the number ofCPU coresin the infrastructure hosting the Kubernetes clusters. This licensing model applies to both on-premises (e.g., Nutanix AHV) and cloud-based deployments. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP licenses are obtained based on the total number of CPU cores allocated to the clusters managed by the platform.” This core-based licensing ensures flexibility across different infrastructure types while aligning with the resource consumption of Kubernetes workloads.

Incorrect Options:

A. Flash: Flash storage is not a licensing unit for NKP.

B. CPU Sockets: Nutanix licenses for other products may use sockets, but NKP uses cores.

C. TiBs: Terabytes are used for storage licensing, not NKP.

TheNKPA 6.10 documentationconfirms thatworkspacesin NKP are used to logically group and standardize configurations across multiple clusters. By creating aproduction workspaceand adevelopment workspace, the organization can control and enforce standardized configurations and policies for all relevant clusters.

Exact extract:

“Workspaces provide logical separation for resources, configuration, and policy management across multiple clusters, enabling standardized operations.”

According to theNKPA 6.10 documentation, thePre-provisioned infrastructure provider (CAPPP)requires the user to provide aninventory fileof the servers that will become the cluster nodes. This inventory file contains connection information (IP addresses, credentials, etc.) for each pre-provisioned node, enabling the Cluster API to connect and configure these servers directly during cluster creation.

As stated in theNKPA 6.10 documentation, when using external storage (such as AWS S3) withLokifor log storage, AWS credentials must be provided securely. This typically involves creating a KubernetesSecretcontaining the static AWS credentials (access key ID and secret access key), which are referenced in the override ConfigMap to authenticate Loki’s S3 storage backend.

Key reference from documentation:

“For Loki to store logs in an S3 bucket, AWS credentials must be created as a Kubernetes secret and referenced in the storage configuration.”

As per theNKPA 6.10 documentationunder “Day 2 Operations: Managing Applications”, the recommended procedure to enable an application (like NKP Insights) involves accessing the cluster’sApplication Dashboard. The NKP Insights application does not appear in the general category list if the cluster does not have the correct context or if the application category is not globally enabled.

The specific procedure to enable NKP Insights includes:

Navigate to theClusterssection from the left-side menu.

SelectView Detailsfor the target cluster (prod-01 in this case).

In theApplication Dashboardof that specific cluster, locate the NKP Insights application.

Click the three-dot menu (ellipsis) for NKP Insights and selectEnable.

To create a FIPS-compliant NKP deployment in an air-gapped environment, the following must be done:

Verify the OS (RHEL) itself is in FIPS mode.

When building the image,include both the offline fips and fips overridesto ensure the image and components are built in compliance.

When deploying the cluster, includeFIPS-specific referencesfor both Kubernetes and etcd components.

Exact extract:

“For FIPS deployments, ensure the OS is in FIPS mode, and include both offline fips and fips overrides during image creation to ensure compliant images and deployment.”

TheSecure Tunnelfeature in NKP relies on HTTPS (TCP port 443) to establish secure, encrypted connections between the attached cluster and the management cluster, enabling fleet management even in restricted network environments.

Exact extract:

“Secure Tunnel uses TCP/443 (HTTPS) for establishing a secure connection between the attached cluster and NKP.”

In an air-gapped NKP environment with no Internet access, a bastion host is a critical component for secure management. The NKPA course defines the primary purpose of a bastion host asproviding a secure point for creating and operating NKP clusters. The bastion host acts as a jump server, allowing administrators to securely access the isolated environment, manage cluster deployments, and perform operations like cluster creation, scaling, and upgrades without exposing the environment to external threats.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In a dark site NKP deployment, a bastion host serves as a secure entry point for administrators to create, manage, and operate NKP clusters, ensuring isolation from external networks.” The bastion host is configured with SSH keys and tools like the NKP CLI to facilitate secure interactions with the cluster infrastructure.

Incorrect Options:

A. To store and manage sensitive data: The bastion host is not a storage system; its role is access and management, not data storage.

C. To serve as a load balancer: A bastion host does not perform load balancing; that role is handled by Kubernetes components like MetalLB or cloud-native load balancers.

D. To act as a firewall: While a bastion host enhances security, it is not a firewall. Firewalls are separate components in the network architecture.

TheNKPA 6.10 documentationspecifies that when attaching external clusters like AKS (Azure Kubernetes Service) to an NKP management cluster using Kommander, the default kubeconfig provided by AKS is typically not directly usable because it lacks the necessary service account details and permissions for NKP to properly manage the cluster. Therefore, the recommended and required approach is to create a separate service account in AKS with the necessary permissions and generate a kubeconfig file for this service account.

Key reference:

“When importing external clusters, such as AKS, the default kubeconfig might not contain the correct permissions for NKP Kommander. A custom kubeconfig for a service account with cluster-admin privileges should be created and used to attach the cluster to NKP.”

The NKPA course details that backup and restore functionality in NKP is provided through integration with Velero, which supports backing up persistent volumes, cluster resources, and application data to S3-compatible storage. This functionality is considered an advanced feature and is included in higher-tier NKP licenses:NKP UltimateandNKP Pro.

NKP Ultimate: This top-tier license includes all NKP features, such as air-gapped deployments, fleet management, and backup/restore capabilities. It is designed for enterprise-grade environments requiring comprehensive disaster recovery.

NKP Pro: This mid-tier license also includes backup and restore functionality, catering to organizations needing robust data protection but not necessarily all the features of the Ultimate tier (e.g., air-gapped support).

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Backup and restore functionality, powered by Velero, is available in NKP Pro and NKP Ultimate license tiers, enabling protection of persistent volumes and cluster resources.” These licenses provide the necessary tools and support for configuring Velero with S3-compatible storage, scheduling backups, and performing restores in production environments.

Incorrect Options:

A. NKP Starter: The Starter tier is entry-level and does not include advanced features like backup and restore. It focuses on basic cluster management.

B. NKP Essential: This tier, if it exists in NKP’s licensing model, would be a lower tier and unlikely to include backup/restore functionality, as it is not mentioned in the NKPA course.

According to theNKPA 6.10 documentationunder the “Preparing for FIPS Compliance” section, the first step for enabling FIPS in an NKP environment is to ensure that the underlying operating system (OS) or OS images are correctly configured for FIPS mode. The Nutanix Kubernetes Platform can only leverage FIPS-compliant cryptographic modules if the underlying OS is already configured for FIPS operation.

Specifically, the documentation states:

"Before enabling FIPS in NKP, ensure that the OS or OS images are prepared and configured to operate in FIPS mode, following the vendor’s guidelines. Once the OS is in FIPS mode, the NKP cluster components can be provisioned with FIPS support."

This foundational step is critical to ensure cryptographic consistency and compliance throughout the NKP stack.

The NKPA course details that NKP Platform Applications, such asGrafana Logging,Grafana Loki, andProject Logging, are deployed to Kubernetes clusters to provide monitoring and logging capabilities. To ensure these components are automatically deployed to new workload clusters in a workspace, the administrator must enable them in theApplication sectionunder the workspace configuration in the NKP UI.

The course explains that the Application section allows administrators to select and configure platform applications that should be applied to all clusters within a workspace. By enabling Grafana Logging, Grafana Loki (for log aggregation), and Project Logging (for project-specific log management), these components are automatically deployed as part of the cluster provisioning process. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To deploy platform applications like Grafana Loki and logging components to new clusters, configure them in the Application section of the workspace settings in the NKP UI.”

Incorrect Options:

A. Enable them in the Insights section under workspace: The Insights section is for analytics and monitoring dashboards, not for deploying logging components.

B. Enable them in the Projects section under workspace: Projects are sub-divisions within workspaces for resource allocation, not for configuring platform applications.

C. Enable them in the Clusters section under workspace: The Clusters section is for managing cluster settings, not for enabling platform applications.

The kube-prometheus-stack is a key component of NKP’s monitoring stack, providing tools for metrics collection, visualization, and alerting. The NKPA course explains thatAlertmanager, a component of the kube-prometheus-stack, is responsible for handling alerts generated from Prometheus metrics. It aggregates, deduplicates, and routes notifications to the appropriate channels (e.g., email, Slack, PagerDuty), ensuring that the Platform Engineer stays informed of critical events and anomalies in the NKP cluster, such as node failures, resource exhaustion, or application errors.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Alertmanager in the kube-prometheus-stack processes alerts from Prometheus, enabling administrators to stay informed of cluster events through configured notification channels.” By configuring Alertmanager with appropriate routing rules and receivers, the engineer can receive real-time notifications about cluster events, driving proactive management and productivity.

Incorrect Options:

A. prometheus-operator: The operator manages Prometheus and related resources but does not directly handle event notifications.

B. service monitors: Service monitors define how Prometheus scrapes metrics, not how events are communicated.

D. node-exporter: Node-exporter collects node-level metrics, not event notifications.

According to theNKPA 6.10 documentation, theFIPS Compliant Build featureis exclusively available forEnterprise tierlicensing. This ensures compliance with NIST security standards and provides hardened cryptographic capabilities throughout the Kubernetes cluster stack.

Exact extract from documentation:

“The FIPS-compliant build feature is included in the NKP Enterprise tier, enabling deployments in environments that require strict security compliance.”

For creating custom images for vSphere (and other supported platforms),Konvoy Image Builder(KIB) is the officially supported tool for NKP. It can create images with custom configurations, package versions, and pre-bundled artifacts.

Key Reference:

“Konvoy Image Builder (KIB) is the Nutanix-recommended tool for building NKP cluster node images for vSphere, AWS, Azure, and other environments.”

The exhibit shows a YAML manifest for a NodeGroup resource that has autoscaler-related annotations:

yaml

Copy

cluster.x-k8s.io/cluster-api-autoscaler-node-group-min-size: "3"

cluster.x-k8s.io/cluster-api-autoscaler-node-group-max-size: "15"

According to theNKPA 6.10 documentation, these annotations configure theminimumandmaximumnumber of nodes for the autoscaler in the specified NodeGroup. The autoscaler will ensure the number of nodes never goes below the minimum (3) and never exceeds the maximum (15).

Key Reference:

"The cluster-autoscaler will scale the NodeGroup up to the maximum size and down to the minimum size based on workload requirements."

The NKPA course details NKP’s monitoring stack for collecting and analyzing metrics across attached and managed clusters, which is critical for troubleshooting issues like out-of-memory errors. The engineer needs to collect centralized metrics and set up alerting to identify performance issues. The correct approach is to usePrometheusfor metrics collection andThanos Queryfor alerting (Option C).

Utilize Prometheus to collect and present centralized metrics on NKP attached and managed clusters: Prometheus is NKP’s default metrics collection tool, deployed as a platform application. It scrapes metrics (e.g., CPU, memory usage) from nodes, pods, and services across all clusters in a workspace, centralizing them for analysis. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Prometheus is used in NKP to collect and present centralized metrics from attached and managed clusters, enabling detailed performance analysis.” This is ideal for identifying differences in memory usage causing the out-of-memory errors.

Configure Thanos Query to monitor and send out alerts based on the metric thresholds that have been configured within it: Thanos Query, part of NKP’s monitoring stack, aggregates Prometheus metrics across clusters and provides a unified query interface. It also integrates with Alertmanager to send alerts based on configured thresholds (e.g., memory usage > 90%). The NKPA course notes: “Use Thanos Query to monitor metrics across NKP clusters and configure alerts with Alertmanager to notify engineers of performance issues like out-of-memory errors.” This setup helps the engineer proactively address the issue.

Incorrect Options:

A & B. Utilize Fluentd and Fluent Bit: Fluentd and Fluent Bit are logging tools in NKP, used for collecting logs, not metrics. Metrics collection requires Prometheus.

D. Utilize Thanos to collect and present centralized metrics: Thanos does not collect metrics directly; it extends Prometheus by providing long-term storage and query aggregation. Prometheus is the primary collection tool.

For deploying NKP clusters in AWS, setting theAWS_REGIONenvironment variable is a key prerequisite to ensure that the AWS CLI and underlying deployment scripts know which region to target. This is essential for provisioning instances using the specified AMI.

Exact extract:

“Set the AWS_REGION environment variable to the appropriate region prior to deploying clusters to ensure proper interaction with the AWS API.”

As per theNKPA 6.10 documentationunder “Application Backup and Recovery with Velero,” Velero is the out-of-the-box backup and restore solution integrated with NKP. To schedule application backups at a specific frequency (in this case, every six hours, equivalent to four times daily), the recommended approach is to use theVelero CLIto create a backup schedule.

The procedure involves:

Using the Velero CLI to create ascheduled backuptargeting the specificKubernetes namespace(victory-finance) rather than the entire workspace.

Specifying the frequency as --schedule="0 */6 * * *" (every six hours).

Providing the cluster’s kubeconfig for authentication.

Exact extract from the documentation:

“Velero’s CLI can be used to create backup schedules for application-specific workloads. Use the namespace parameter to target the namespace where the applications are deployed, and set the cron-like schedule to the desired frequency.”

TheKonvoy Image Builderrequires a64-bit Linux or MacOS environment(x86_64 architecture) to build and customize the OS images.

As outlined in theNKPA 6.10 documentationunder "Customizing Resource Requests and Limits for Logging," to override the default resource values for the logging operator, a ConfigMap named logging-operator-logging-overrides in the kommander namespace is used. The values.yaml in the ConfigMap should precisely define fluentd resource limits and requests in a valid YAML format.

The correct YAML format is:

yaml

Copy

apiVersion: v1

kind: ConfigMap

metadata:

name: logging-operator-logging-overrides

namespace: kommander

data:

values.yaml: |

fluentd:

resources:

limits:

cpu: 4

memory: 4Gi

requests:

cpu: 4

memory: 4Gi

This ensures that the desired CPU and memory resources are correctly applied for the fluentd daemon, avoiding parsing errors and meeting the high-demand logging needs.

NKP uses Cluster API (CAPI) to provision and manage Kubernetes clusters across supported infrastructures, including Nutanix AHV, vSphere, AWS, and GCP. CAPI components, such as controllers and providers, are deployed to manage the lifecycle of clusters on these platforms. However, when NKP attaches to a managed Kubernetes service like Azure Kubernetes Service (AKS), CAPI components are not deployed because AKS is managed by Azure, and NKP only integrates with the cluster for fleet management, not provisioning.

The NKPA course explains: “For managed Kubernetes services like AKS, NKP attaches the cluster to its management plane without deploying CAPI components, as the underlying infrastructure is managed by the cloud provider.” The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide reinforces this: “CAPI is used for NKP-managed clusters on Nutanix, vSphere, AWS, and GCP, but not for attached managed services like AKS.”

Incorrect Options:

A. vSphere: NKP deploys CAPI components (e.g., CAPV provider) to manage vSphere-based clusters.

B. GCP: NKP deploys CAPI components (e.g., CAPG provider) for GCP-based clusters.

C. Nutanix: NKP deploys CAPI components (e.g., CAPA provider for AHV) for Nutanix AHV clusters.

The Nutanix Kubernetes Platform (NKP) uses workspaces to provide isolated environments for different teams or projects, allowing each team to manage its own clusters, applications, and resources independently. According to the NKPA course, creating a new workspace is a key Day 2 operation to support multi-tenancy and isolated development environments, such as those required for the microservices in this scenario.

The course specifies that to create a new workspace, users must navigate to the workspace selection dropdown list in the top menu bar of the NKP user interface (UI) and selectCreate Workspace. This action opens a form where administrators can define the workspace name, description, and associated resources (e.g., clusters, users, and policies). The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To create a new workspace in NKP, go to the workspace selection dropdown in the UI and select ‘Create Workspace’ to configure an isolated environment for a team or project.” This process ensures that each microservice team has its own isolated environment for development and testing, with access restricted to their specific workspace.

Incorrect Options:

A. From the Cluster selection, select Add Cluster: Adding a cluster creates a new Kubernetes cluster within an existing workspace, not a new workspace. The NKPA course distinguishes between cluster and workspace creation.

C. From the workspace selection dropdown list in the top menu bar, select Add Workspace: The NKPA course and UI use “Create Workspace” as the standard terminology, not “Add Workspace.”

D. From the Administration selection dropdown list in Infrastructure Providers, select Add Infrastructure Provider: This option is for configuring infrastructure providers (e.g., AWS, vSphere) for NKP, not for creating workspaces.

The NKPA course specifies that the Nutanix Image Builder (NIB), used for creating custom machine images for NKP cluster nodes, supports specific Linux distributions that are compatible with Nutanix infrastructure and Kubernetes requirements. For NKP v2.12.x, the supported distributions for NIB areUbuntuandRocky Linux, as these are tested and optimized for NKP deployments, ensuring stability and compatibility with Cluster API (CAPI) and Nutanix AHV.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP Image Builder (NIB) supports Ubuntu and Rocky Linux as base distributions for creating custom images for NKP cluster nodes, ensuring compatibility with Kubernetes and Nutanix infrastructure.” Ubuntu provides a widely-used, well-supported base with long-term support (LTS) versions, while Rocky Linux is a CentOS replacement that Nutanix has adopted for its reliability and enterprise focus, especially after CentOS 8’s end-of-life in 2021.

Incorrect Options:

B. Fedora: Fedora is not a supported distribution for NIB in NKP, as it is more suited for bleeding-edge development rather than production Kubernetes environments.

D. CentOS: CentOS 8 reached end-of-life in December 2021, and Nutanix has shifted to Rocky Linux as its replacement for NKP image building. The course does not list CentOS as a supported option for NIB in NKP v2.12.x.

For deployments in air-gapped environments where there is no external Internet connectivity, the --airgapped parameter is required. This instructs the NKP deployment to rely solely on internal resources, using pre-staged images and local container registries, ensuring that no external network dependencies cause deployment failures.

As per theNKPA 6.10 documentation, the primary requirement for attaching external (self-managed) Kubernetes clusters to NKP isnetwork connectivity. Specifically, theNKP management cluster must be able to communicate with the Kubernetes API serverand relevant services of the target cluster. This allows NKP to collect metrics, perform health checks, and manage the attached cluster through Kommander and associated tools.

Exact extract:

“For attaching existing Kubernetes clusters, ensure the NKP management cluster can reach the Kubernetes API server of the target cluster and that the kubeconfig used has sufficient permissions.”

There is no requirement that the Kubernetes versions be exactly matched or within N-1, nor that an NKP admin account be directly established on the target clusters; the connectivity and valid kubeconfig file are the essential requirements.

The output indicates that an AppDeployment resource named grafana-logging was created in the kommander-default-workspace namespace, which corresponds to an NKP workspace. The NKPA course explains that NKP Platform Applications, such as Grafana Logging, are deployed using the nkp create appdeployment command. This command creates an AppDeployment resource that deploys the specified application (e.g., Grafana Logging) across all clusters in a workspace.

The command inOption A, nkp create appdeployment grafana-logging --app grafana-logging-6.57.4 --workspace default-workspace, matches the output:

grafana-logging is the name of the AppDeployment.

--app grafana-logging-6.57.4 specifies the application and version.

--workspace default-workspace targets the workspace, which corresponds to the namespace kommander-default-workspace in the output (the kommander- prefix is a standard NKP namespace convention).

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To deploy a platform application like Grafana Logging, use nkp create appdeployment <app-name> --app <app-id>- --workspace , which creates an AppDeployment resource in the workspace namespace.” This command aligns with the output provided.

Incorrect Options:

B. export WORKSPACE_NAMESPACE and nkp create package-bundle: There is no nkp create package-bundle command in NKP for deploying applications. The correct command is nkp create appdeployment.

C. kubectl get appdeployment: This retrieves the status of an AppDeployment, not creates it. The output indicates creation, not retrieval.

D. kubectl get helmreleases: This retrieves HelmRelease resources, not AppDeployments, and does not create the Grafana Logging deployment.