Pass the Nutanix Certified Professional (NCP) NCP-CN Questions and answers with ValidTests

A bastion host in a dark site environment serves as a secure entry point for managing the NKP deployment, providing access to the cluster infrastructure without direct Internet connectivity. The NKPA course outlines the prerequisites for preparing a Linux VM as a bastion host, focusing on secure access and time synchronization, which are critical for air-gapped Kubernetes deployments.

Get or create SSH Keys (Option B):The bastion host requires SSH keys to enable secure, passwordless access to the NKP cluster nodes and other infrastructure components (e.g., Nutanix AHV hosts). The NKPA course specifies that SSH keys must be generated or obtained and configured on the bastion host to facilitate secure communication during deployment and management tasks. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For a bastion host in an NKP dark site deployment, ensure SSH keys are created or obtained to enable secure access to cluster nodes and infrastructure.” The engineer can generate SSH keys using ssh-keygen and distribute the public key to the target systems.

Enable NTP Service (Option D):Time synchronization is essential in Kubernetes clusters to ensure consistent logging, certificate management, and scheduling. In a dark site with no Internet access, the bastion host must be configured to synchronize time with an internal NTP (Network Time Protocol) server or act as an NTP server itself. The NKPA course emphasizes enabling the NTP service on the bastion host to maintain accurate time across the air-gapped environment. The NCP-CN 6.10 Study Guide notes: “Enable the NTP service on the bastion host to ensure time synchronization in a dark site NKP deployment, as Kubernetes requires accurate time for proper operation.” The engineer can enable NTP using commands like systemctl enable ntpd and configure it to use an internal time source.

Incorrect Options:

A. Install LDAP Server: LDAP is used for centralized authentication, but it is not a requirement for a bastion host in an NKP dark site deployment. The course focuses on SSH access instead.

C. Install Docker: While Docker is needed on Kubernetes nodes for container runtimes, the bastion host’s role is to provide secure access and management, not to run containers.

Comprehensive and Detailed Explanation From Exact Extract of Nutanix Kubernetes Platform Administration (NKPA) Course:

The NKPA course outlines the process of adding GPU-enabled worker nodes to an existing NKP-managed Kubernetes cluster, such as the production cluster in this scenario. The first step in this process is to ensure that a GPU-compatible OS image is available for the new worker nodes, as GPU support requires specific drivers and configurations (e.g., NVIDIA drivers) that are not included in standard OS images.

The correct first step is tocreate a GPU-compatible OS imageusing the command:

text

CollapseWrap

Copy

nkp create image nutanix --gpu \

--gpu-name=${GPU_NAME} \

--cluster=${NUTANIX_CLUSTER_NAME} \

--endpoint=${NUTANIX_PC_ENDPOINT} \

--subnet=${NUTANIX_SUBNET} ubuntu-22.04

(Option D). This command uses the NKP CLI to create a machine image based on Ubuntu 22.04, tailored for Nutanix AHV infrastructure (nutanix) with GPU support enabled (--gpu). The --gpu-name flag specifies the GPU type (e.g., NVIDIA GPU model), and other parameters define the Nutanix cluster, Prism Central endpoint, and subnet for image creation. The resulting image includes the necessary NVIDIA drivers and dependencies, making it suitable for GPU-enabled worker nodes. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Before adding GPU-enabled workers to an NKP cluster on Nutanix, the first step is to create a GPU-compatible OS image using nkp create image nutanix --gpu, ensuring the image includes the required GPU drivers for the target infrastructure.”

This image is then used in subsequent steps (like Option A) to create a node pool with GPU-enabled workers. Without this image, the node pool creation in Option A would fail due to the lack of a suitable --vm-image.

Incorrect Options:

A. Create a nodepool of workers with GPU: This step requires a pre-existing GPU-compatible OS image (specified via --vm-image). Since the question does not indicate that such an image already exists, creating the image (Option D) must happen first.

B. Add the GPU Operator to the new workers: The NVIDIA GPU Operator can be installed to manage GPU resources, but this step occurs after the GPU-enabled workers are added to the cluster, not as the first step.

C. Configure Multi-Instance GPU (MIG): MIG configuration is an advanced GPU setup step that occurs after the workers are added and the GPU Operator is installed, not as the first step.

Continuous Deployment (CD) is the practice of automatically deploying new software releases across environments after a successful build and testing phase. In the context of NKP, enabling CD ensures that software changes are consistently and reliably rolled out to all clusters associated with a project, ensuring operational uniformity and rapid feature adoption.

For deployments in air-gapped environments where there is no external Internet connectivity, the --airgapped parameter is required. This instructs the NKP deployment to rely solely on internal resources, using pre-staged images and local container registries, ensuring that no external network dependencies cause deployment failures.

The Kubernetes Image Builder (KIB) is used to create CAPI-compliant machine images for NKP cluster nodes, often leveraging tools like Packer to build AMIs for AWS. When the KIB process fails, troubleshooting requires detailed logs to identify the root cause. The NKPA course recommends increasing the verbosity of the KIB command to capture detailed output, including AWS CLI commands and their responses.

The correct troubleshooting step is to rerun the KIB command with the verbosity level set to debug. This is typically done using the --verbose or -v flag (e.g., -v debug) to enable debug-level logging, which includes all AWS CLI commands, their outputs, and errors, written to a log file for review. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To troubleshoot KIB failures, rerun the command with debug verbosity (-v debug) to log all operations, including AWS CLI interactions, to an exported log file for detailed analysis.” This approach helps pinpoint issues like permission errors, misconfigurations, or failures in image bundle uploads.

Incorrect Options:

A. Rerun with pause parameter: KIB does not support a pause parameter for step-by-step review, as per the NKPA course.

C. Instruct Packer not to delete the cloned AMI: While preserving the AMI can help, the course prioritizes debug logging for initial troubleshooting. Packer’s --on-error=abort flag exists, but it’s less direct than debug logs.

D. Instruct Ansible not to delete the cloned AMI: KIB primarily uses Packer, not Ansible, for AMI creation, making this option incorrect.

NKP uses Cluster API (CAPI) to provision and manage Kubernetes clusters across supported infrastructures, including Nutanix AHV, vSphere, AWS, and GCP. CAPI components, such as controllers and providers, are deployed to manage the lifecycle of clusters on these platforms. However, when NKP attaches to a managed Kubernetes service like Azure Kubernetes Service (AKS), CAPI components are not deployed because AKS is managed by Azure, and NKP only integrates with the cluster for fleet management, not provisioning.

The NKPA course explains: “For managed Kubernetes services like AKS, NKP attaches the cluster to its management plane without deploying CAPI components, as the underlying infrastructure is managed by the cloud provider.” The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide reinforces this: “CAPI is used for NKP-managed clusters on Nutanix, vSphere, AWS, and GCP, but not for attached managed services like AKS.”

Incorrect Options:

A. vSphere: NKP deploys CAPI components (e.g., CAPV provider) to manage vSphere-based clusters.

B. GCP: NKP deploys CAPI components (e.g., CAPG provider) for GCP-based clusters.

C. Nutanix: NKP deploys CAPI components (e.g., CAPA provider for AHV) for Nutanix AHV clusters.

The Secure Tunnel feature in NKP relies on HTTPS (TCP port 443) to establish secure, encrypted connections between the attached cluster and the management cluster, enabling fleet management even in restricted network environments.

Exact extract:

“Secure Tunnel uses TCP/443 (HTTPS) for establishing a secure connection between the attached cluster and NKP.”

The exhibit shows the NKP UI with a list of clusters, including "arca," "demo," and "production," each with a three-dot menu on the right side. The NKPA course explains that to delete a cluster directly from the NKP UI, the engineer should use the Delete option available in the cluster’s three-dot menu. This action initiates the deletion process, removing the cluster from NKP management and freeing up any associated licenses (e.g., CPU core-based licenses, as per NKP licensing).

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To delete a cluster in NKP via the UI, navigate to the cluster list, click the three-dot menu for the target cluster (e.g., demo), and select ‘Delete’ to remove the cluster and its resources.” The UI in the exhibit aligns with this process, showing the three-dot menu next to the "demo" cluster, which includes the Delete option. This is the most straightforward method to delete the demo cluster and reallocate resources to the arca cluster.

Incorrect Options:

A. Download kubeconfig and use kubectl delete cluster: kubectl delete cluster is not a valid command for deleting NKP clusters. NKP uses the nkp CLI or UI for cluster deletion.

C. Select Detach and ask the cluster owner to delete: Detach is for external clusters (e.g., EKS), not NKP-managed clusters like "demo," which is on Nutanix infrastructure. Detaching does not delete the cluster.

D. SSH to kommander cluster and execute kubectl delete cluster: Kommander is a management component, but kubectl delete cluster is not a valid command for NKP cluster deletion.

According to the NKPA 6.10 documentation under the “Preparing for FIPS Compliance” section, the first step for enabling FIPS in an NKP environment is to ensure that the underlying operating system (OS) or OS images are correctly configured for FIPS mode. The Nutanix Kubernetes Platform can only leverage FIPS-compliant cryptographic modules if the underlying OS is already configured for FIPS operation.

Specifically, the documentation states:

"Before enabling FIPS in NKP, ensure that the OS or OS images are prepared and configured to operate in FIPS mode, following the vendor’s guidelines. Once the OS is in FIPS mode, the NKP cluster components can be provisioned with FIPS support."

This foundational step is critical to ensure cryptographic consistency and compliance throughout the NKP stack.

As per the NKPA 6.10 documentation under “Application Backup and Recovery with Velero,” Velero is the out-of-the-box backup and restore solution integrated with NKP. To schedule application backups at a specific frequency (in this case, every six hours, equivalent to four times daily), the recommended approach is to use the Velero CLI to create a backup schedule.

The procedure involves:

Using the Velero CLI to create a scheduled backup targeting the specific Kubernetes namespace (victory-finance) rather than the entire workspace.

Specifying the frequency as --schedule="0 */6 * * *" (every six hours).

Providing the cluster’s kubeconfig for authentication.

Exact extract from the documentation:

“Velero’s CLI can be used to create backup schedules for application-specific workloads. Use the namespace parameter to target the namespace where the applications are deployed, and set the cron-like schedule to the desired frequency.”