NCP-CI-AWS Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam Questions and Answers

Cluster Protect in an NC2 environment can protect and recover the following services and their associated metadata:

VM Templates: Ensures that templates used for creating virtual machines are backed up and recoverable.

Files: Protects data stored in Nutanix Files, ensuring that file services are backed up and can be restored as needed.

Nutanix Support and Insights

Nutanix Cloud Clusters on AWS Administration

WhenFlow Virtual Networking (FVN)is enabled for an NC2 cluster, Nutanix orchestrates the creation of aTransit VPCto handle traffic between the overlay and external networks. The core subnet created within this Transit VPC is namedoverlay-external-subnet-nonat. This subnet is critical as it serves as the entry and exit point for traffic that should not be subjected to address translation, such as traffic moving between the cloud overlay and an on-premises data center via a Transit Gateway or VPN. While administrators can manually add a NAT-enabled subnet later, the " nonat " variant is the primary default used to ensure that internal corporate communications remain transparent across the hybrid cloud boundary.

Cross Cluster Live Migration allows for the movement of running virtual machines between different Nutanix clusters with zero downtime.

For this feature to be supported in an NC2 on AWS environment, the deployment must utilizeFlow Virtual Networking (FVN). FVN provides the advanced software-defined networking overlay required to maintain consistent network state and connectivity for the VM as it moves between different physical bare-metal hosts in separate clusters. Standard AWS networking lacks the specific overlay capabilities necessary to handle the seamless IP mobility and session persistence required for a live migration between cloud clusters. Therefore, ensuring FVN is correctly configured is a prerequisite for achieving live mobility within the AWS NC2 ecosystem.

Nutanix Cloud Clusters (NC2) on AWS is designed to provide a " cloud-native " resilience experience, meaning it proactively manages the underlying hardware health.

If AWS issues a notification for aSystem Rebootor a hardware-related event on a bare-metal instance, the NC2 console does not simply wait for the reboot to occur. To maintain cluster availability and avoid potential data integrity issues during an uncontrolled hardware event, NC2 triggers anautomated host replacement. The system will provision a new bare-metal instance, integrate it into the cluster, and migrate the data and workloads (using High Availability if necessary) away from the degraded or scheduled-to-reboot host. This automation ensures that the Nutanix cluster remains healthy and functional despite the ephemeral nature of cloud infrastructure hardware.

The Nutanix disaster recovery capabilities include recovery plans that define how entities are recovered in the event of a failure. There is a limit to the number of entities that can be managed within a single recovery plan.

Entity Limit:

According to Nutanix documentation, the maximum number of entities that can be recovered using a single recovery plan is 300. Exceeding this limit will cause issues during the execution of the recovery plan.

Impact of Exceeding the Limit:

If the number of entities in a recovery plan exceeds the supported limit, the recovery process may fail or not execute correctly, as observed in the scenario.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Disaster Recovery Best Practices Documentation

When setting up a landing zone for Nutanix clusters on AWS, having only private subnets for cluster management and user VMs is not sufficient for full cluster functionality. Nutanix clusters often need to communicate with the internet for updates, patches, and other cloud services.

VPC Configuration:

The VPC already has two private subnets (one for cluster management and one for user VMs).

Additional Requirements:

To access public services like S3 or for the cluster nodes to reach Nutanix services for updates, a public subnet is essential.

Why Public Subnet for Internet Access?:

A public subnet allows resources within it to communicate directly with the internet, which is necessary for accessing Nutanix ' s update servers, applying patches, and other maintenance tasks.

This subnet typically includes an internet gateway, enabling instances in the public subnet to receive and send traffic directly to the internet.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Networking Best Practices

Nutanix Networking and Subnet Configuration Guidelines

Traffic from the on-premises network is not permitted by VM and Management security groups:

Ensure that the security groups assigned to the VMs and management interfaces in AWS allow inbound traffic from the on-premises network. Without appropriate security group rules, the traffic will be blocked.

The AWS VPC traffic is blocked by a firewall in the on-premises network:

Check if the firewall on the on-premises network is configured to allow traffic from the AWS VPC. Firewalls may have restrictive rules that block incoming traffic, preventing communication.

Refer to AWS documentation on security groups and firewalls and Nutanix documentation on configuring networking for NC2 clusters.

Deploying NC2 on AWS using Flow Virtual Networking (FVN) requires a specific landing zone architecture to isolate management and user traffic. The minimum configuration requires three distinct subnets. First, one Private Management Subnet is needed for the bare-metal hosts and Controller VMs (CVMs). Second, one Public Subnet is required to host the NAT Gateway, providing the private management nodes with outbound internet access for Nutanix portal communication and updates. Third, one Flow Virtual Networking Subnet (often referred to as the Transit VPC subnet) is required to handle the encapsulation and routing of User VM traffic. This baseline setup ensures that the management plane is secure, the internet-bound traffic is correctly routed, and the FVN overlay has the necessary transit path for workload communication.

Flow Virtual Networking (FVN)introduces a software-defined overlay that requires significant management overhead for handling VPC transit, encapsulation, and complex routing tables. Due to the resource-intensive nature of managing these advanced networking services, Nutanix restricts the supported Prism Central (PC) instance sizes for FVN deployments. OnlyLarge and Extra LargePrism Central instances are supported to ensure there is adequate CPU and memory available to run the virtual routing and gateway components effectively. Smaller PC instances (Small or Medium) lack the necessary performance headroom and may experience latency or management failures when trying to process the continuous network synchronization required by the FVN overlay in a production cloud environment.

Successful onboarding of an AWS environment into the Nutanix Cloud Clusters ecosystem requires a precise set of administrative permissions to be present on the account used for initial configuration. Specifically, the AWS user must haveCreateRoleFullAccessto allow the automated scripts to generate the necessary service-linked roles. Additionally, the user must possessIAMFullAccessto manage identity policies andAWSCloudFormationFullAccessto execute the deployment templates. This specific combination ensures that the NC2 portal can correctly configure the " Cross-Account Role " which serves as the primary communication bridge between the Nutanix management plane and the AWS infrastructure APIs. Failing to provide any of these three core permissions will result in an " Insufficient Permissions " alert during the cloud account registration process.

The error message in the image indicates that the cluster creation failed due to reaching the maximum retries for provisioning cluster nodes. Here are two possible scenarios that could lead to this issue:

Insufficient Permissions (Answer B):

If the AWS user or role used to create the cluster does not have sufficient permissions, it can result in failures during the provisioning process. Proper IAM policies must be attached to ensure that the necessary actions can be performed, such as launching instances, creating VPCs, or managing networking components.

AWS Quota Exceeded/Instance Limit Exceeded (Answer D):

AWS imposes quotas and limits on the number of instances and other resources that can be created within an account. If these quotas are exceeded, new instances cannot be provisioned, causing the cluster creation to fail. This can be resolved by requesting a quota increase from AWS.

Nutanix Knowledge Base Article 9774

AWS Service Quotas

Nutanix NC2 on AWS Documentation

To ensure that every NC2 on AWS cluster deployed allows full access from the on-premises CVM subnet efficiently, the administrator should create a custom AWS Network Security Group.

Use a key value oftag:nutanix:clusters:externalfor the security group, and set the inbound allow address to the on-premises subnet.

This approach leverages AWS tags to manage security group rules dynamically and ensures that the necessary access permissions are applied automatically to all clusters with the specified tag.

This method reduces the need for manual configuration of each cluster ' s security group, streamlining the process for a test/dev environment where clusters are frequently created and destroyed.

Refer to the AWS documentation on Network Security Groups and Nutanix documentation on best practices for securing NC2 clusters.

The steps, in order, to recover a cluster protected using the Cluster Protect feature when the Prism Central instance was not on the failed cluster are as follows:

Step 1: Set the cluster to the Failed state using the NC2 console to start the recovery workflow.

Step 2: Redeploy the cluster using the NC2 console.

Step 3: Redeploy the Multicloud Snapshot Technology.

Step 4: Recover UVM data by running CLI commands.

Set the cluster to the Failed state using the NC2 console to start the recovery workflow: This step involves marking the cluster as failed to initiate the recovery process.

Redeploy the cluster using the NC2 console: Once the cluster is marked as failed, the next step is to redeploy it using the tools available in the NC2 console.

Redeploy the Multicloud Snapshot Technology: After the cluster is redeployed, the Multicloud Snapshot Technology needs to be redeployed to ensure data consistency and availability.

Recover UVM data by running CLI commands: The final step is to recover the User VM (UVM) data by executing the necessary CLI commands to restore the data from the snapshots or backups.

Nutanix Documentation on Cluster Protect and Recovery Processes

Nutanix Support and Insights

Nutanix Cloud Clusters on AWS Administration

Synchronous replication requires extremely low latency (sub-5ms) and a reliable high-speed connection between the primary and secondary storage controllers. While Flow Virtual Networking (FVN) supports various architectures, the most robust and supported way to enable synchronous replication for NC2 clusters in the same region is to ensure thatboth clusters reside within the same AWS VPC. This placement minimizes network hops and avoids the added latency that might be introduced by VPC Peering or a Transit Gateway between separate VPCs. By sharing the same VPC, the clusters can communicate via the same internal AWS network fabric, providing the deterministic performance required for zero-RPO data protection and Metro Availability configurations.

Route tables for cloud subnets contain incorrect route entries:

If the route tables associated with the cloud subnets contain incorrect route entries, the NC2 cluster might not be able to reach the necessary AWS services or endpoints. Correct route entries are crucial for ensuring proper communication between the NC2 cluster and the underlying AWS infrastructure.

IAM roles and policies are incorrectly configured:

Incorrectly configured IAM roles and policies can prevent NC2 from making API calls to AWS services. These roles and policies must be properly set up to allow the necessary permissions for NC2 to interact with AWS resources and perform required operations.

Refer to the AWS documentation on route table configuration and IAM roles and policies, and Nutanix documentation on NC2 cloud connectivity and permissions.

In a Layer 2 stretched environment where the default gateway resides on-premises, a " Forward policy " is used to route traffic from the cloud back to the data center. If the on-premises data center goes completely offline, the on-premises gateway is no longer reachable, which would halt all North-South communication for the VMs failed over to AWS. To restore full service, the administrator must not only failover the VMs to the NC2 cluster but also remove the Forward policy on the on-premises cluster (or specifically update the routing logic to ensure the AWS cluster takes over gateway duties). This allows the cloud cluster to stop attempting to tunnel traffic to the missing on-premises gateway and instead utilize local cloud-based exit points for network traffic, restoring external connectivity.

When selecting the NC2 subscription plan from the Nutanix Billing portal, the available options include:

Pay-as-you-Go (PayG): A flexible payment option where users are billed based on their actual usage, providing cost efficiency for variable workloads.

Bring your own License (BYOL): Allows users to utilize existing Nutanix licenses they have purchased, offering a cost-effective way to leverage existing investments in Nutanix software.

Refer to the Nutanix billing and subscription documentation for detailed descriptions of subscription plans and their benefits.

Configuring a proxy server for NC2 on AWS is a critical security step for organizations requiring centralized traffic inspection. This capability is specific to certain software versions and network architectures.

Support for proxy servers was introduced inAOS 6.7.1.6and requires the deployment to be within a user-created VPC (Bring Your Own VPC), rather than an auto-created VPC managed by Nutanix. It is important to note thatFlow Virtual Networking (FVN), which provides advanced overlay networking capabilities, currently does not support the use of a proxy server for cluster traffic. Therefore, administrators must choose between the advanced features of FVN and the traffic routing control provided by a proxy server based on their specific organizational requirements.

The clusters that are to be protected must be registered with the same instance of Prism Central (Answer C):

For Cluster Protect to function correctly, all clusters intended for protection must be registered under the same Prism Central instance. This ensures consistent management and coordination of protection policies and operations across clusters.

The Cluster Protect feature requires AOS version 6.7 or higher (Answer D):

Cluster Protect is a feature that is available starting from AOS version 6.7. To utilize this feature, ensure that the Nutanix clusters are running this version or a newer one.

Nutanix Cluster Protection Documentation

Nutanix AOS Release Notes

NC2 on AWS allows for the dynamic addition ofAmazon EBS volumesto bare-metal nodes to expand the cluster ' s storage capacity beyond the local NVMe drives. According to Nutanix architectural guidelines, once these EBS volumes are attached and integrated into the storage pool, the capacitycan only be increased. Reducing the storage capacity by removing or shrinking attached EBS volumes is not a supported operation because it would risk data loss and disrupt the Distributed Storage Fabric (DSF) which expects consistent disk availability. Therefore, administrators should carefully size their initial EBS requirements, knowing that they can scale up to meet demand but cannot scale back the capacity of individual existing volumes without a complex data migration or cluster redeployment.

While NC2 bare-metal instances come with high-performance local NVMe storage, many organizations require additional capacity to support large data sets or long-term storage needs. For instance types that support Amazon EBS attachment, theminimum number of additional EBS volumesthat can be added per node is1. Adding even a single EBS volume allows the Nutanix cluster to expand its storage pool beyond the physical limitations of the bare-metal chassis. Administrators can then increase this capacity as needed, although once attached, these volumes typically cannot be removed or decreased. This flexibility is key for scaling storage-intensive applications without necessarily increasing the compute node count, thereby optimizing the overall TCO of the cloud cluster.

Synchronous replication in Nutanix Cloud Clusters (NC2) on AWS requires extremely low latency, typically less than 5ms round-trip time (RTT). To achieve this, clusters must be located within the same AWS region, often within different Availability Zones or the same VPC.

Supported networking configurations for this high-speed data exchange include using standard native AWS networking on both clusters to ensure direct, low-latency communication. Additionally, a hybrid setup where one cluster utilizes native networking and the remote cluster uses Flow Virtual Networking (FVN) is supported, provided the underlying network infrastructure satisfies the latency requirements for synchronous operations. This ensures that data is written to both clusters simultaneously before an acknowledgment is sent to the application, providing zero recovery point objective (RPO).

When deploying Nutanix Cloud Clusters (NC2) on AWS, administrators have two primary workflows: allowing the NC2 portal to automate resource creation or using existing resources. The " Bring Your Own " (BYO) model is characterized by the requirement that the administrator manually prepares the underlying AWS infrastructure before initiating the Nutanix cluster deployment. Specifically, the actions ofcreating an AWS VPCandcreating the required subnets(such as management and User VM subnets) are exclusive to the BYO workflow. In the automated " Nutanix-managed " workflow, the NC2 portal uses CloudFormation to provision these network resources automatically. While setting up IAM users and permissions is necessary for both models to allow the NC2 console to interact with the AWS API, the pre-existence of the VPC and subnet architecture is the defining prerequisite for a BYO deployment.

To control network traffic at the individual User VM (UVM) subnet level, creating a custom security group is the appropriate action. This approach allows for fine-grained control over inbound and outbound traffic rules that can be applied to specific subnets or individual instances within those subnets.

Custom Security Group:

Custom security groups enable administrators to define specific traffic rules tailored to the needs of individual subnets or VMs. This includes specifying allowed IP ranges, ports, and protocols.

By applying these custom security groups to the UVMs, the organization can control access and enhance security according to their policies and requirements.

Steps to Create a Custom Security Group:

Navigate to the AWS Management Console and go to the VPC service.

Select " Security Groups " under the " Security " section.

Click on " Create Security Group " and define the name, description, and VPC.

Add inbound and outbound rules according to the desired traffic control policies.

Attach the custom security group to the UVMs or subnets in question.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Security Group Documentation

Nutanix Best Practices for Security Groups

TheCluster Protectfeature is the native Nutanix solution designed specifically for NC2 on AWS to protect both the cluster data and thePrism Centralmanagement instance. Unlike standard replication, Cluster Protect utilizesAmazon S3 bucketsto store snapshots of the cluster configuration, Prism Central metadata, and User VM data. This is considered the " best way " for native protection because the entire recovery workflow is orchestrated directly from theNC2 console. If a cluster or an entire Availability Zone fails, the administrator can use the NC2 portal to redeploy the cluster and restore the Prism Central instance and data from the S3 bucket, eliminating the need for third-party backup software while maintaining a simple cloud-native recovery path.

For a VM deployed in an NC2 cluster on AWS to be accessed by resources within the on-premises datacenter, the security group associated with the User VM (UVM) subnet must allow inbound traffic on the specific ports required by the application.

If the security group rules do not permit inbound traffic on these ports, the communication will fail, even if other network configurations are correct.

The administrator should ensure that the UVM Security Group includes rules to allow inbound traffic for the application ' s required ports, facilitating proper communication between the VM and on-premises resources.

Refer to the AWS documentation on security group configurations and Nutanix NC2 documentation for details on configuring network access and security group rules.

For VDI workloads that require GPU acceleration, the g4dn.metal nodes are the appropriate choice. These instances are equipped with NVIDIA T4 GPUs, which are well-suited for graphics-intensive applications such as VDI workloads that need GPU acceleration. Other node types like AN36P, m6g.metal, or AN36 do not provide the necessary GPU capabilities.

Nutanix Support and Insights - GPU support in AWS

Before accessing the Nutanix Cloud Clusters (NC2) console, the first step is to create a My Nutanix account.

This account serves as the primary gateway for managing and accessing Nutanix services, including NC2.

Once the account is created, users can log in to the Nutanix portal, where they can manage their subscriptions, start trials, and access various Nutanix services, including the NC2 console.

Refer to the Nutanix documentation on getting started with NC2 and the My Nutanix account creation process.

Given the company ' s large spend commitments as part of an AWS Enterprise Discount Program (EDP) totaling $15 million, purchasing Nutanix licenses through the AWS Marketplace ensures that the costs contribute to the EDP commitment.

This approach integrates the Nutanix license costs into the overall AWS spend, thereby maximizing the benefits of the EDP.

Purchasing directly from Nutanix or leveraging existing licenses might not count towards the AWS EDP commitment, and trial licenses are typically for evaluation purposes and do not contribute to the committed spend.

Refer to the Nutanix and AWS documentation on licensing and marketplace purchases, and EDP program details.

When creating a new NC2 cluster using an existing AWS VPC infrastructure, two private subnets are needed. These subnets are used as follows:

One private subnet for user VMs, which houses the virtual machines that users interact with.

Another private subnet for cluster management, which is used for internal cluster operations and management tasks, ensuring that management traffic is isolated from user traffic for security and performance reasons.

Nutanix Support and Insights

Nutanix Cloud Clusters on AWS Administration

Nutanix offers tailored licensing models for different workload types within NC2 to optimize costs. ForVDI-specific clusters, Nutanix utilizes auser-based consumption model. In this scenario, pricing is determined by the number of concurrent users, which is ideal for elastic desktop environments where the number of active VMs fluctuates. Conversely,general-purpose clusterstypically default to acapacity-based method. Here, consumption is calculated based on the total provisioned capacity (cores or TiB) of the cluster, providing predictable costs for steady-state server workloads. These models allow organizations to align their software spend directly with their actual resource utilization patterns. It is important to note that switching between portfolio types (NCI and AOS) is generally restricted once a cluster is deployed.

To avoid IP address conflicts and ensure there are no configuration issues when reusing an existing AWS subnet, the administrator should take the following actions:

aCLI > net.add_to_ip_blacklist 10.79.4.200 aCLI > net.add_to_ip_blacklist 10.79.4.201 (Answer A):

This command adds the specified IP addresses to the blacklist, preventing AHV IPAM from assigning these addresses to any VMs. This ensures that the existing EC2 instances with IPs 10.79.4.200 and 10.79.4.201 are not allocated to other VMs in the NC2 cluster.

Configure the AHV IPAM to use DHCP range 10.79.4.2 -10.79.4.253 (Answer D):

By configuring the AHV IPAM to use a specific DHCP range, you ensure that the IP addresses assigned to the EC2 instances (10.79.4.200 and 10.79.4.201) are not included in the DHCP pool. This prevents IP address conflicts within the subnet.

Nutanix aCLI Reference

Nutanix NC2 on AWS Documentation

AWS VPC and Subnet Basics

Flow Virtual Networking (FVN)provides an advanced software-defined networking layer that supports three specific types of connectivity models for NC2 clusters. First,NAT (Network Address Translation)networks allow User VMs to access external resources (like the internet) using the gateway ' s IP, providing a layer of security. Second,No-NATnetworks allow for transparent routing between the Nutanix overlay and on-premises or other VPC environments, preserving the original VM IP addresses. Third,L2 Stretchednetworks (Subnet Extensions) use VXLAN tunnels to extend a single broadcast domain from an on-premises data center to the cloud cluster. These three types allow administrators to tailor their network architecture based on the specific security and connectivity requirements of each workload hosted in the cloud.

In an NC2 on AWS deployment using Flow Virtual Networking (FVN),North-South traffic(traffic moving into or out of the Nutanix VPC) is handled via adistributed gateway model. Unlike traditional setups that might rely on a single bottleneck node, the distributed gateway model allows each Nutanix node in the cluster to participate in routing traffic to the AWS VPC router. This architecture provides high availability and scales performance linearly as nodes are added to the cluster. By distributing the gateway function, Nutanix ensures that no single point of failure exists for internet-bound or cross-VPC traffic, optimizing the path between Nutanix User VMs and native AWS services or the public internet.

For a new NC2 on AWS deployment where workload VMs have low storage and memory requirements but high CPU frequency ( > 3.0 GHz) requirements, and the goal is to minimize the number of CPU cores to reduce application licensing costs, thei3.metalinstance type is the most suitable.

i3.metal:

High CPU Frequency: i3.metal instances offer high-frequency Intel Xeon processors (up to 3.1 GHz) which meet the high CPU frequency requirement.

Low Storage and Memory: These instances come with a balanced amount of storage and memory, suitable for workloads with low requirements in these areas.

Minimized CPU Cores: i3.metal instances have fewer CPU cores compared to other high-frequency instances like i4i.metal, making them ideal for minimizing application licensing costs.

Other Instance Types:

z1d.metal: While also offering high CPU frequency, these instances typically come with a higher core count and more memory, which may not be optimal for minimizing licensing costs.

i4i.metal: Designed for I/O intensive applications with higher core counts.

m5d.metal: Balanced instance type but with more cores and not as high CPU frequency as required.

AWS EC2 Instance Types Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Instance Selection

To manage outbound traffic and prevent unfiltered internet access without deploying a dedicated firewall appliance, administrators can leverage aProxy Server. WhenFlow Virtual Networking (FVN)is implemented, it allows for sophisticated routing and encapsulation that can be integrated with an AWS Proxy server. This configuration forces all traffic exiting the Nutanix User VPCs to pass through the proxy for inspection and filtering based on corporate security policies. This setup is particularly effective for clusters requiring AOS updates or access to specific Nutanix cloud endpoints while maintaining a " locked-down " posture for User VMs. It provides an administrative chokepoint for traffic without the complexity of managing third-party firewall rules or NAT Gateway filters.

The NC2 Tile within the my.nutanix.com portal is the correct interface to deploy NC2. This portal provides an integrated and user-friendly interface specifically designed for deploying and managing Nutanix Clusters on AWS.

NC2 Deployment Interface:

NC2 Tile within the my.nutanix.com portal: This portal provides the necessary tools and options to deploy and manage NC2 clusters. It includes functionalities for setting up the clusters, configuring network settings, and managing resources.

Advantages:

User-Friendly Interface: Simplifies the deployment process with a guided setup.

Integrated Tools: Provides access to all necessary tools for managing the deployment and monitoring of NC2 clusters.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix my.nutanix.com Portal Documentation

Nutanix Best Practices for Cluster Deployment

To resolve the IP conflict issue when an EC2 instance is powered on in a subnet also used by Nutanix NC2, the administrator should block or exclude the IP address used by the NC2 VM from being assigned to EC2 instances. This can be done by configuring the IP address management (IPAM) settings to ensure that the specific IP addresses allocated to the NC2 VMs are not used by EC2 instances, preventing IP conflicts and ensuring smooth operation of both environments.

Nutanix Cloud Clusters on AWS Deployment Guide

Nutanix Support and Insights

The Nutanix NC2 portal uses a hierarchical structure consisting of Customers, Organizations, andWorkspacesto manage resources. A common point of confusion for administrators is that clusters are localized to specific Workspaces. If an administrator logs into the portal and finds their cluster " missing, " the most likely cause is that they are currently viewing a differentworkspacethan the one where the cluster was provisioned. The NC2 console requires users to select the correct context to view their resources. Checking the workspace selector in the portal interface usually resolves this visibility issue, as the account and overall portal permissions are already verified by the successful login.