Pass the Nutanix Certified Professional (NCP) NCP-CI-AWS Questions and answers with ValidTests

The exhibit shows two cloud accounts, one for Azure and one for AWS, with their statuses indicated. The AWS cloud account status is marked as "U" (which likely stands for "Unavailable" or "Unreachable"). This indicates that the AWS cloud account configuration is not properly connected or accessible.

Status Check:

The AWS cloud account is marked with an "U" status, meaning it is not active or accessible.

This status prevents the creation of an NC2 cluster because the necessary cloud resources cannot be allocated or managed without a proper connection.

Action:

The best course of action is to create a new cloud account in the organization. This involves setting up the cloud account details correctly and ensuring it is properly configured to communicate with Nutanix and AWS.

Steps to Create a New Cloud Account:

Log in to the Nutanix console.

Navigate to the "Organizations" section.

Select "Add Cloud Account" and provide the required AWS credentials and permissions.

Ensure the new cloud account is active and correctly configured.

References:

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Cloud Account Management

When setting up a landing zone for Nutanix clusters on AWS, having only private subnets for cluster management and user VMs is not sufficient for full cluster functionality. Nutanix clusters often need to communicate with the internet for updates, patches, and other cloud services.

VPC Configuration:

The VPC already has two private subnets (one for cluster management and one for user VMs).

Additional Requirements:

To access public services like S3 or for the cluster nodes to reach Nutanix services for updates, a public subnet is essential.

Why Public Subnet for Internet Access?:

A public subnet allows resources within it to communicate directly with the internet, which is necessary for accessing Nutanix's update servers, applying patches, and other maintenance tasks.

This subnet typically includes an internet gateway, enabling instances in the public subnet to receive and send traffic directly to the internet.

References:

Nutanix Cloud Clusters on AWS Administration Guide

AWS Networking Best Practices

Nutanix Networking and Subnet Configuration Guidelines

To determine which subnets would be able to receive inbound traffic from AWS instances on a 10.0.0.0/22 network segment, we need to look at the configured subnets and their CIDR ranges, as well as the custom network security group ' s inbound rules.

Available CIDR ranges in VPC:

70.73.0.0/16

10.79.107.0/24

10.0.0.0/22

Configured Subnets in NC2 AWS VPC:

VDI: 10.78.130.0/22

SQL: 10.78.3.0/24

Server01: 10.78.2.0/24

Server02: 10.79.120.0/24

Tier01: 10.19.101.0/24

Custom Network Security Group Inbound Rule:

Allows all inbound traffic from 10.0.0.0/22.

Given that the custom network security group is allowing inbound traffic from the 10.0.0.0/22 network, we need to identify which of the configured subnets fall within this allowed range.

Analysis:

The subnets 10.78.130.0/22, 10.78.3.0/24, 10.78.2.0/24, 10.79.120.0/24, and 10.19.101.0/24 do not overlap with 10.0.0.0/22. Therefore, none of these subnets would naturally fall within the 10.0.0.0/22 range directly.

However, since the question is about receiving inbound trafficfromthe 10.0.0.0/22 network and considering security group rules, all subnets mentioned can technically receive traffic if the inbound rules are configured correctly, but since we are strictly asked about the configuration from the image and the overlap in the ranges:

Server01 (10.78.2.0/24)andTier01 (10.19.101.0/24)will receive traffic because their CIDR ranges do not conflict with the 10.0.0.0/22 range, thus allowing traffic without additional restrictions.

Nutanix Clusters on AWS Administration Guide

AWS VPC and Subnet documentation

Network Security Group rules configuration in Nutanix documentation

Within an NC2 environment, the Cluster Protect feature can ensure the protection of:

Nutanix Files: This provides file services within the Nutanix ecosystem, and Cluster Protect can safeguard the data stored in Nutanix Files.

Virtual Machine Disks: This ensures that the data stored on virtual machine disks is protected, providing backup and recovery options for the virtual machines running within the cluster.

Nutanix Cloud Clusters on AWS Administration

Nutanix AOS 6.7 Documentation

When selecting the NC2 subscription plan from the Nutanix Billing portal, the available options include:

Pay-as-you-Go (PayG): A flexible payment option where users are billed based on their actual usage, providing cost efficiency for variable workloads.

Bring your own License (BYOL): Allows users to utilize existing Nutanix licenses they have purchased, offering a cost-effective way to leverage existing investments in Nutanix software.

Refer to the Nutanix billing and subscription documentation for detailed descriptions of subscription plans and their benefits.

When a node is marked as " Condemned, " it indicates that the system has determined that the node is no longer reliable for operations. As part of the automated recovery and protection process, the following action is typically taken:

The node has a power reset sent to it (Answer A):

In most cases, a condemned node undergoes a power reset as an initial recovery attempt. This action attempts to reboot the node to bring it back to a healthy state. If the reset fails, further manual or automated steps may be required to address the hardware or software issue.

Nutanix Cluster Management Documentation

Nutanix Support Knowledge Base

To SSH into a Controller VM (CVM) in an NC2 on AWS cluster without on-premises connectivity, the administrator needs to ensure that the security settings allow SSH access from the Jump Host. This involves editing the User Management Network Security Group to permit SSH traffic from the Jump Host IP.

Deploy Jump Host:

Ensure the Jump Host is deployed in a public subnet with an Elastic IP (EIP) assigned for external access.

Edit User Management Network Security Group:

Locate the security group associated with the user management network.

Modify the inbound rules to allow SSH (port 22) from the Jump Host ' s IP address. This ensures that the Jump Host can establish an SSH connection to the CVM.

Steps to Edit Security Group:

Navigate to the EC2 dashboard in the AWS Management Console.

Select " Security Groups " under the " Network and Security " section.

Find and select the appropriate security group.

Edit the inbound rules to add a new rule:

Type: SSH

Protocol: TCP

Port Range: 22

Source: Custom IP (enter the Jump Host ' s public IP address)

Additional Configuration:

Ensure that the CVM itself allows SSH connections and that no internal firewall rules block the traffic.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Security Group Documentation

Nutanix Best Practices for Secure Access

Nutanix provides a flexible licensing model for NC2, allowing customers to use their existingon-premises licensesthrough reservation. A key benefit of this approach is thatreserved licensed capacity automatically handles incidental overages. If a cluster temporarily scales out and exceeds the reserved capacity, the Nutanix billing system accounts for the excess usage automatically, typically by drawing from the associated Pay-As-You-Go (PAYG) account or consumption credits. This ensures that the cluster remains operational and compliant even during unexpected spikes in demand. Administrators can manage these reservations through the Nutanix portal, allowing them to balance their committed on-premises license spend with the variable needs of their cloud-resident clusters.

When deploying a new NC2 cluster on AWS, especially when moving to specialized hardware like EC2 dedicated hosts, two critical external factors must be verified: subscription status and AWS resource limits. First, the administrator must ensure that theNC2 subscriptionis active and has sufficient credits or a valid payment method to support the new deployment. Second, AWS imposes default limits on the number ofvCPUsand specific instance types that can be provisioned in a region. Since dedicated hosts consume a large number of vCPUs, the deployment will fail if the AWS account quota is exceeded. Verifying and, if necessary, requesting a quota increase from AWS is a mandatory step to ensure the underlying infrastructure is available for the Nutanix software.

To deploy an NC2 cluster using an existing AWS network, the NAT Gateway should be placed in a public subnet. A public subnet is one that has a route to an Internet Gateway, allowing the NAT Gateway to provide outbound internet access for resources in private subnets. The NAT Gateway is used to enable instances in private subnets to access the internet while keeping them secure by not exposing them directly to the public internet.

Nutanix Cloud Clusters (NC2) on AWS Documentation