Pass the Nutanix Certified Professional (NCP) NCP-CN Questions and answers with ValidTests

The NKP documentation recommends using a combination of RBAC assignments and exported manifests to manage access across multiple clusters. By exporting the role assignments to YAML, the engineer can consistently apply these settings across the different environments, ensuring the new team has the necessary resources and limits. This approach is especially useful for environments with multiple clusters and standardized configurations.

Comprehensive and Detailed Explanation:

Both the Konvoy Image Builder (KIB) and the Nutanix Image Builder (NIB) are included tools used to create and manage custom OS images suitable for NKP deployments. KIB is responsible for building images that conform to the standards required by Konvoy-based environments, while NIB is designed for direct integration with the Nutanix AHV infrastructure. These tools support automated preparation, hardening, and upload of images to the appropriate repositories.

TheNKPA 6.10 documentationclarifies that when creating a workload cluster using the nkp create cluster command, specifying the target workspace (namespace) is critical for properly associating the workload cluster with that workspace in the NKP UI. If the --namespace parameter is omitted, the cluster is provisioned in the default workspace, not in the intended workspace (in this case, code-green).

Key documentation excerpt:

“If you do not specify the workspace (namespace) using the --namespace parameter when creating a cluster, the cluster will be created in the default workspace. It will not appear in custom workspaces until manually assigned.”

TheKonvoy Image Builderrequires a64-bit Linux or MacOS environment(x86_64 architecture) to build and customize the OS images.

The NKPA course addresses performance issues in NKP clusters, such as high CPU and memory consumption on worker nodes, by recommending scaling options to distribute workloads more effectively. The Kubernetes cluster in the scenario has 4 workers, each with 8 vCPUs and 32 GB RAM, and is running out of resources. The most effective solution is toadd more workersto the cluster to increase overall capacity and balance the load, rather than modifying existing workers or reducing application replicas.

The correct action is toadd one more workerusing the command nkp scale nodepools ${NODEPOOL_NAME} --replicas=5 --cluster-name=${CLUSTER_NAME} -n ${CLUSTER_WORKSPACE} (Option D). This command scales the specified node pool to 5 replicas (from the current 4), adding one additional worker to the cluster. The new worker will have the same configuration (8 vCPUs, 32 GB RAM) as the existing workers, providing additional capacity to alleviate resource contention. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To address performance issues due to resource exhaustion in an NKP cluster, scale out by adding workers using nkp scale nodepools --replicas --cluster-name -n .”

Incorrect Options:

A. Call tech support to investigate: While support can help, the issue is clearly resource exhaustion, which can be resolved by scaling the cluster—a task the Platform Engineer can perform directly.

B. Ask developers to lower application replicas: Reducing replicas may decrease resource usage but could impact application availability or performance, which is not ideal for a development cluster.

C. Add more CPU and memory to workers with nkp scale --cpu 16 --memory 64: The nkp scale command does not support --cpu and --memory flags for resizing existing workers. Resizing VMs typically requires updating the node pool configuration and replacing nodes, which is more complex than adding new workers.

NKP uses Cluster API (CAPI) to provision and manage Kubernetes clusters across supported infrastructures, including Nutanix AHV, vSphere, AWS, and GCP. CAPI components, such as controllers and providers, are deployed to manage the lifecycle of clusters on these platforms. However, when NKP attaches to a managed Kubernetes service like Azure Kubernetes Service (AKS), CAPI components are not deployed because AKS is managed by Azure, and NKP only integrates with the cluster for fleet management, not provisioning.

The NKPA course explains: “For managed Kubernetes services like AKS, NKP attaches the cluster to its management plane without deploying CAPI components, as the underlying infrastructure is managed by the cloud provider.” The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide reinforces this: “CAPI is used for NKP-managed clusters on Nutanix, vSphere, AWS, and GCP, but not for attached managed services like AKS.”

Incorrect Options:

A. vSphere: NKP deploys CAPI components (e.g., CAPV provider) to manage vSphere-based clusters.

B. GCP: NKP deploys CAPI components (e.g., CAPG provider) for GCP-based clusters.

C. Nutanix: NKP deploys CAPI components (e.g., CAPA provider for AHV) for Nutanix AHV clusters.

Attaching an existing Amazon EKS cluster to NKP for fleet management involves integrating the cluster into NKP’s management plane, which requires specific preparatory steps. The NKPA course outlines that the first step is tocreate a service account with cluster-admin permissionsin the EKS cluster. This service account is used by NKP to authenticate and manage the cluster, enabling operations like monitoring, scaling, and application deployment.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide explains: “To attach an external Kubernetes cluster, such as Amazon EKS, to NKP, a service account with cluster-admin role bindings must be created to allow NKP to interact with the cluster’s API server.” The service account is configured with a token that NKP uses to authenticate requests. The NKPA course provides detailed steps, including creating the service account, assigning the cluster-admin ClusterRole, and generating a token for NKP integration. This step is critical to ensure NKP has the necessary permissions to manage the EKS cluster.

Incorrect Options:

A. Configure a ConfigMap according to EKS configuration: While ConfigMaps may be used for specific configurations, they are not the first step for attaching an EKS cluster. The NKPA course prioritizes service account creation.

C. Configure HAProxy to get connected to EKS clusters: HAProxy is a load balancer, not required for attaching EKS clusters to NKP. EKS uses AWS-native load balancers, and NKP connects via the Kubernetes API.

D. Deploy cert-manager in the EKS clusters: Cert-manager is used for certificate management, not a prerequisite for attaching EKS clusters. The NKPA course does not list it as a required step.

The NKPA course emphasizes that NKP supports multi-tenancy through workspaces, each of which can be configured with its own Identity Provider (IdP) for authentication. In this scenario, each group (Fin VD, Fin Insurance, Fin Travel) has its own IdP, and the engineer has created separate workspaces for them. To assign the Tenant Administrators role, the engineer must configure a dedicated IdP for each group’s workspace, enabling users to authenticate via their group-specific IdP and assume the Tenant Administrator role.

The course details that NKP uses Dex as the OIDC provider to integrate with external IdPs. For each workspace, the engineer configures a Dex connector to the group’s IdP, maps the IdP groups to NKP roles (e.g., Tenant Administrator), and assigns permissions via role bindings. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To assign Tenant Administrator roles in NKP, configure a dedicated IdP for each workspace using Dex connectors, mapping IdP groups to the appropriate roles for workspace management.” This ensures that each group’s administrators can access only their designated workspace.

Incorrect Options:

B. Create a role named admin-tenant-X: NKP uses predefined roles like Tenant Administrator, not custom roles with specific naming conventions.

C. Create a role binding and assign it: Role bindings are part of the process, but the primary step is configuring the IdP for authentication, as per the NKPA course.

D. Configure the global Active Directory: The scenario specifies separate IdPs per group, not a global Active Directory for all groups.

According to theNKPA 6.10 documentationunder “Air-Gapped Preparation with Konvoy Image Builder,” the konvoy-image upload command uploads essential artifacts to the target servers to prepare them to serve as cluster nodes. These artifacts include:

Container runtime (containerd)

OS bundle

Kubernetes components

It does not involve user creation or OS hardening scripts (those are separate, client-driven processes).

Key reference from documentation:

“The konvoy-image upload command uploads the required artifacts to the target server(s) to prepare them for Kubernetes deployment in air-gapped environments. This includes the container runtime, OS bundle, and Kubernetes binaries.”

The exhibit shows the NKP UI with a list of clusters, including "arca," "demo," and "production," each with a three-dot menu on the right side. The NKPA course explains that to delete a cluster directly from the NKP UI, the engineer should use theDeleteoption available in the cluster’s three-dot menu. This action initiates the deletion process, removing the cluster from NKP management and freeing up any associated licenses (e.g., CPU core-based licenses, as per NKP licensing).

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To delete a cluster in NKP via the UI, navigate to the cluster list, click the three-dot menu for the target cluster (e.g., demo), and select ‘Delete’ to remove the cluster and its resources.” The UI in the exhibit aligns with this process, showing the three-dot menu next to the "demo" cluster, which includes the Delete option. This is the most straightforward method to delete the demo cluster and reallocate resources to the arca cluster.

Incorrect Options:

A. Download kubeconfig and use kubectl delete cluster: kubectl delete cluster is not a valid command for deleting NKP clusters. NKP uses the nkp CLI or UI for cluster deletion.

C. Select Detach and ask the cluster owner to delete: Detach is for external clusters (e.g., EKS), not NKP-managed clusters like "demo," which is on Nutanix infrastructure. Detaching does not delete the cluster.

D. SSH to kommander cluster and execute kubectl delete cluster: Kommander is a management component, but kubectl delete cluster is not a valid command for NKP cluster deletion.