Pass the Nutanix Certified Professional (NCP) NCP-CI-AWS Questions and answers with ValidTests

The exhibit shows two cloud accounts, one for Azure and one for AWS, with their statuses indicated. The AWS cloud account status is marked as " U " (which likely stands for " Unavailable " or " Unreachable " ). This indicates that the AWS cloud account configuration is not properly connected or accessible.

Status Check:

The AWS cloud account is marked with an " U " status, meaning it is not active or accessible.

This status prevents the creation of an NC2 cluster because the necessary cloud resources cannot be allocated or managed without a proper connection.

Action:

The best course of action is to create a new cloud account in the organization. This involves setting up the cloud account details correctly and ensuring it is properly configured to communicate with Nutanix and AWS.

Steps to Create a New Cloud Account:

Log in to the Nutanix console.

Navigate to the " Organizations " section.

Select " Add Cloud Account " and provide the required AWS credentials and permissions.

Ensure the new cloud account is active and correctly configured.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Cloud Account Management

Nutanix offers two flexible paths for provisioning the underlying AWS networking infrastructure required for an NC2 cluster. The first option is toallow the NC2 portal to automatically deploy the required AWS resources. In this guided workflow, the portal uses predefined CloudFormation templates to create the VPC, subnets, NAT gateways, and routing tables based on the administrator ' s input. The second option is the " Bring Your Own " (BYO) manual workflow, where the administrator uses their own existing AWS networking resources. This is often preferred by large organizations with strict security requirements or pre-existing VPC architectures. Both methods are fully supported, allowing organizations to choose between the speed of automated deployment or the granular control of a manual networking setup.

AWS supports EC2 bare-metal instances in regions with at least 3 partitions. Partitions in AWS provide high availability and fault tolerance by distributing instances across different hardware to minimize the impact of hardware failures.

AWS EC2 Bare Metal Instances Documentation

AWS Regions and Availability Zones

The Nutanix Create Cluster wizard may not support selecting subnets that have both IPv4 and IPv6 CIDR blocks due to compatibility or configuration constraints.

When a subnet with both CIDR blocks is present, it can cause issues in the selection process during cluster creation, as the system might not be able to properly handle or recognize the dual-stack configuration.

Ensuring that the management subnet has only an IPv4 CIDR block, without an IPv6 CIDR block, could resolve this issue and allow for successful selection in the cluster creation wizard.

Refer to the Nutanix and AWS documentation on subnet configuration and requirements for NC2 cluster deployments, specifically addressing IPv4 and IPv6 compatibility and constraints.

AWS Direct Connect allows companies to create private, dedicated connections between their data centers and AWS. This bypasses the internet and provides a more reliable and faster network connection directly to AWS services, including S3.

AWS Direct Connect Documentation

AWS S3 Access over Direct Connect

Selecting the " I want to protect the cluster " option during the initial NC2 deployment wizard enables the underlying support for theCluster Protectfeature but does not fully finalize the protection policies. Once the bare-metal instances are provisioned and the Nutanix software is initialized, the administrator mustconfigure Cluster Protect after the deployment completes. This " Day Two " configuration involves specifying the Amazon S3 bucket that will serve as the backup target, defining the protection frequency (RPO), and selecting the specific User VMs or Prism Central data to be protected. Since the NCI Ultimate license already includes the advanced replication and protection features by default, no additional add-on purchase is required, but the functional setup of the backup policies remains a mandatory post-deployment task.

A standard NC2 deployment typically requires a management subnet and a public subnet for basic internet and console access. However, when moving to aFlow-based deployment(using Flow Virtual Networking), the architecture becomes more complex, requiringManagementandFlow Virtual Networksubnets specifically tailored for the overlay. TheManagement subnetis used for the bare-metal hosts and CVMs to communicate with the NC2 portal and Prism Central. TheFlow Virtual Network subnet(often the Transit VPC subnet) is required to host the distributed gateways that manage encapsulated Geneve traffic. These subnets are essential for segregating the management traffic from the virtualized workload traffic, ensuring that the software-defined overlay has a dedicated and secure path through the AWS VPC infrastructure.

With the Nutanix AOS Pro licensing, several advanced features and add-on products become available. Specifically, in the AWS cluster deployment wizard, the following add-ons are available:

Files:

Nutanix Files provides a software-defined, scale-out file storage solution that simplifies the management and scaling of unstructured data.

Advanced Replication:

Advanced Replication features in Nutanix include synchronous and asynchronous replication capabilities, allowing for robust disaster recovery and data protection solutions.

DARE (Data-At-Rest Encryption):

DARE ensures that all data stored on Nutanix clusters is encrypted, providing a higher level of security for sensitive information.

These features are included in the AOS Pro licensing tier, offering enhanced data management, protection, and security capabilities.

Nutanix Licensing Guide

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Advanced Features

In an NC2 on AWS environment, licensing Microsoft Windows Server workloads can be complex due to cloud mobility rights.

If an organization does not have existing licenses with Software Assurance to support " Bring Your Own License " (BYOL) on cloud hardware, they must acquire licenses through the cloud provider. The most integrated and efficient way to achieve this for Nutanix clusters is to select theLicense Includedoption during the host provisioning process in the NC2 console. By purchasing nodes with licenses included, the cost of the Windows Server OS is bundled with the instance hourly rate provided by AWS. This ensures full compliance with Microsoft licensing terms without requiring a separate purchase through external marketplaces or resellers for the cloud-resident VMs.

To ensure that every NC2 on AWS cluster deployed allows full access from the on-premises CVM subnet efficiently, the administrator should create a custom AWS Network Security Group.

Use a key value oftag:nutanix:clusters:externalfor the security group, and set the inbound allow address to the on-premises subnet.

This approach leverages AWS tags to manage security group rules dynamically and ensures that the necessary access permissions are applied automatically to all clusters with the specified tag.

This method reduces the need for manual configuration of each cluster ' s security group, streamlining the process for a test/dev environment where clusters are frequently created and destroyed.

Refer to the AWS documentation on Network Security Groups and Nutanix documentation on best practices for securing NC2 clusters.