Nutanix Certified Professional (NCP) NCP-US-6.10 Question # 1 Topic 1 Discussion

The exhibit shows the output of the `get-smbclient configuration` command on a Nutanix Files system, with the line `RequireSecuritySignature: True` highlighted as a potential cause for the administrator’s inability to browse an SMB share. The setting `RequireSecuritySignature: True` indicates that the SMB client requires security signatures (also known as SMB signing) for all SMB communications, which ensures data integrity and authenticity. A possible cause of the browsing issue related to this setting is that **Kerberos is enabled**, as Kerberos authentication is often required when SMB signing is enforced, especially in Active Directory (AD) environments.

The **Nutanix Unified Storage Administration (NUSA)** course explains that “in Nutanix Files, when `RequireSecuritySignature` is set to True, SMB signing is mandatory, and this often relies on Kerberos authentication to provide the necessary security tokens for signing SMB packets.” Kerberos is the default authentication protocol in AD environments, and Nutanix Files integrates with AD for SMB share access. If the client attempting to browse the share does not support Kerberos or has issues with Kerberos authentication (e.g., misconfigured AD, time sync issues, or lack of domain credentials), the SMB connection may fail, resulting in the inability to browse the share.

The **Nutanix Certified Professional - Unified Storage (NCP-US)** study guide further elaborates that “enabling `RequireSecuritySignature` in Nutanix Files often requires Kerberos authentication to be properly configured, as SMB signing uses Kerberos tickets to secure communication, and mismatches in Kerberos settings can prevent share access.” The administrator should verify that the client is domain-joined, Kerberos is functioning correctly (e.g., by checking time sync between the client, Nutanix Files, and the AD domain controller), and that the necessary Kerberos tickets are available.

The other options are incorrect:

- **AD is enabled**: While AD is typically enabled in environments where SMB signing and Kerberos are used, simply enabling AD does not directly cause the issue. The problem is more specifically tied to Kerberos, which is the authentication mechanism AD uses.

- **TLS is enabled**: TLS (Transport Layer Security) is not directly related to SMB signing. SMB signing operates at the SMB protocol level, while TLS would apply to network-layer encryption, which is not indicated in the configuration output.

- **CHAP is enabled**: CHAP (Challenge-Handshake Authentication Protocol) is used for protocols like iSCSI or PPP, not SMB, and is irrelevant to this issue.

The NUSA course documentation emphasizes that “if `RequireSecuritySignature` is enabled and users cannot browse SMB shares, administrators should check Kerberos authentication settings, as mismatches or failures in Kerberos can prevent successful SMB connections.”