Pass the Nutanix NCM-MCI NCP-MCI-6.10 Questions and answers with ValidTests

https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v6_10:mul-configure-data-in-transit-encryption-pc-t.html

"Ensure that port 2009 is open between the Prism Central instances for the KMS cluster to communicate."This is explicitly stated in the "Firewall rules for Data-in-Transit Encryption" section for Prism Central.

Technical Context:

Port 2009 is used by ZooKeeper (the coordination service for the KMS cluster) in Scale-Out Prism Central deployments.

DiTE in Prism Central relies on a dedicated KMS cluster that synchronizes encryption keys across PC instances using this port.

Firewall blocks on port 2009 break KMS quorum, preventing key exchange and causing DiTE to fail.

To create a custom Intelligent Operations report and run it across multiple Prism Central instances, administrators must export the report configuration from one Prism Central instance and then import it into the others. This process leverages the .rpt file format, which encapsulates the report’s configuration details, including data sources, visualization preferences, and thresholds.

From theNutanix Enterprise Cloud Administration (ECA)course materials:

“Administrators can create custom Intelligent Operations reports in Prism Central and export the configuration as a .rpt file. This exported file can then be imported into other Prism Central instances, ensuring consistency across environments without requiring manual recreation of the report’s details.”

Additionally:

“The export/import feature for reports ensures that custom dashboards and reports can be easily migrated or replicated across multiple Prism Central instances, enabling a standardized approach to monitoring and analytics in a multicloud environment.”

This clearly indicates that the recommended and supported method for sharing or replicating custom reports across multiple Prism Central instances is by exporting and importing the report configurations in .rpt format. This approach avoids the need for manual recreation and ensures that the reports maintain their intended configuration and layout across different instances.

Upgrading an AHV host with GPUs requires that the correct GPU drivers be manually uploaded to LCM, as GPU firmware is not updated automatically.

Option C (Use Direct Uploads to upload appropriate driver bundles) is correct:

LCM does notautomatically fetch GPU drivers.

The administrator mustdownload and manually upload the appropriate firmware bundlebefore upgrading.

Option A is incorrect:

Agent VMs are not requiredfor GPU updates.

Option B is incorrect:

Running LCM indark site mode does not impact GPU firmware updates.

Option D is incorrect:

Updating NCCis a best practice but does not resolve GPU driver issues.

In Nutanix Protection Domain-based replication, both thesourceanddestinationstorage containersmust have the same Replication Factor (RF)to ensure consistent data protection and replication. This is a key requirement for the data’s protection and integrity.

From theNutanix ECAdocumentation:

“Replication and recovery require that the source and destination containers have the same RF setting (either RF2 or RF3). If the RF does not match, replication and recovery points will not be generated in the DR site.”

The other options:

A (NGT): NGT is not required for crash-consistent protection.

C (Windows updates): Updates are not directly relevant to replication consistency.

D (container name): Names can differ; what matters is the container’s RF setting.

Storage Policies in Nutanix are applied through Categories, allowing policy-based automation and enforcement.

Option D (Assign the VM or VG to the same Category as the Storage Policy) is correct:

Nutanixapplies Storage Policies based on VM Categories, enablingflexibility in policy enforcement.

Option A is incorrect:

Storage Policies are not directly assigned at the VM or VG level—they apply through Categories.

Option B is incorrect:

Policies must be assigned toCategories, not directly to individual VMs/VGs.

Option C is incorrect:

Migrating to a storage container does not automatically apply a Storage Policy.

Themost efficient wayto allow team leads to manage aspecific set of VMsis bycreating a Project (Option C)in Prism Central and assigning the team leads to that Project.

Nutanix Projects allow administrators to control VM accessbased on groups and permissions, ensuring that users only manage VMs assigned to their project.

Option A (Role Mapping)applies more broadly to roles but does not restrict access to specific VM groups.

Option B (VPC Admin)is related to network segmentation, not VM access control.

Option D (Security Policies)are used for network and firewall rules, not VM access control.

Understanding the Exhibit & the Alert

The alert states:

"The cluster is using password-based SSH access for the CVM."

"Password-based remote login is enabled on the cluster."

"It is recommended to use key-based SSH access instead of password-based SSH access for better security."

This means that the nutanix user can log in to Controller VMs (CVMs) using a password, which is a security risk.

Corrective Action: Enabling Cluster Lockdown

✅(C) Enable Cluster Lockdown. (Correct Answer)

Cluster Lockdown Mode restricts password-based SSH access and forces key-based authentication.

This prevents users from logging into CVMs using passwords, enhancing cluster security.

To enable Cluster Lockdown:

Go to Prism Central or Prism Element.

Navigate to Settings → Security → Cluster Lockdown.

Enable Cluster Lockdown Mode.

Evaluating the Other Answer Choices

❌(A) Rename the nutanix user. (Incorrect)

The nutanix user is a built-in system account required for cluster operations.

Renaming the user will not prevent SSH access via password.

❌(B) Block port 22 on the CVM firewall. (Incorrect)

Blocking port 22 (SSH) will completely disable SSH access, including key-based authentication.

This may break cluster management and troubleshooting operations.

❌(D) Delete the nutanix user. (Incorrect)

The nutanix user is a critical system account required for cluster functionality.

Deleting the account will cause serious issues with cluster management.

Multicloud Infrastructure References & Best Practices

Nutanix Security Best Practices:

Always use key-based SSH authentication instead of password-based logins.

Enable Cluster Lockdown Mode to enforce security policies.

Regularly audit user access to ensure security compliance.

Cluster Lockdown Benefits:

Prevents unauthorized SSH access via passwords.

Enforces public key authentication, reducing brute-force attack risks.

Strengthens CVM security against potential exploits.

The most efficient way to move a VM’s storage to a container that has different storage optimization policies (like compression) is to perform aVM migrationto the target container. This operation ensures that all the VM’s vDisks are moved to the destination container and allows leveraging the configured optimizations on the Production container.

From theNutanix Enterprise Cloud Administration (ECA)course materials:

“VM migration to another storage container in Nutanix Prism Central is supported and can be performed with minimal disruption. When moving a VM to a new container, it inherits the storage optimization policies of that container, including compression, deduplication, and encryption.”

Furthermore:

“Migrations can be initiated at the VM level in Prism Central or Prism Element. This is the most streamlined method to ensure all vDisks for a VM are moved together, preserving data integrity and performance characteristics.”

Recreating the VM or vDisks would be cumbersome and require manual data copying, introducing potential risks and downtime.