NCP-MCA Nutanix Certified Professional - Multicloud Automation (NCP-MCA 6.10) Exam Questions and Answers

Comprehensive and Detailed Explanation

Nutanix Calm supports OS customization through Guest Customization , which:

Applies Sysprep for Windows

Injects configuration files

Sets hostnames, time zones, networking, and more

Runs scripts post-deployment

Sysprep is specifically executed during Windows Guest Customization .

Therefore, Option C: Guest Customization is correct.

To satisfy the requirement of acting on alerts based on specific properties (such as Severity levels: Info or Warning) rather than just the alert policy itself, the administrator must use the Alerts Matching Criteria trigger.

In Nutanix Intelligent Operations (X-Play), there are two primary alert triggers:

Alert Trigger: This triggers a playbook when a specific Alert Policy is generated (e.g., "Host Down"). It applies to all instances of that policy regardless of severity, unless the policy itself is severity-specific.

Alerts Matching Criteria: This trigger allows the administrator to define a playbook that fires on any alert matching specified criteria . Configurable criteria include Severity (Critical, Warning, Info), Impact Type , Target Entity , and Alert Policy .

By creating a playbook with the Alerts Matching Criteria trigger, the administrator can specifically select Severity: Info and Severity: Warning and filter for the NGT Alert Policy . The action "Acknowledge Alert" can then be added. This ensures that only non-critical NGT alerts are auto-acknowledged, while Critical NGT alerts (which do not match the criteria) continue to notify the administrator.

In Nutanix Self-Service (Calm), Macros are used to reference variables and properties dynamically using the syntax @@{Entity.Attribute}@@.

Services are a primary supported entity for macros. You can reference properties of other services within the same application blueprint. For example, a web server service might need the IP address of a database service. This can be achieved using a macro like @@{Database_Service.address}@@. This allows for dynamic orchestration where values are populated at runtime based on the actual deployment details of the Service entity.

Among the options provided, calm_unique is the standard built-in macro provided by the Self-Service engine.

Purpose: The @@{calm_unique}@@ macro generates a unique, short alphanumeric string at runtime.

Use Case: It is widely used in Blueprints to ensure uniqueness for VM names, hostname prefixes, or other resources that cannot have duplicate identifiers within the infrastructure (e.g., naming a VM Web-@@{calm_unique}@@ to prevent naming collisions).

Other Options: calm_date, calm_generate_uuid, and calm_math are not standard built-in macro names in the Self-Service macro library (though calm_time and calm_now exist for time-based operations).

For users to successfully deploy Marketplace Blueprints to a specific infrastructure, the Project must have a configured Environment .

The Gap: Merely adding the Account and whitelisting the Cluster in the Project settings (the "Infrastructure" tab) only authorizes access. It does not tell the Self-Service engine how to use that infrastructure (e.g., which Networks to attach, which Storage Containers to use, or what sizing policies to apply).

The Solution: The administrator must go to the Environments tab within the Project and Create a New Environment mapped to the new Account and Cluster.

Marketplace Logic: Marketplace blueprints are typically "Environment Agnostic." When a user launches one, they are prompted to select a destination Environment. If no Environment exists for the new cluster, the user cannot select it as a target for deployment.

Nutanix Intelligent Operations (X-Play) allows administrators to create custom automation playbooks by defining triggers and associated actions. The system provides a library of pre-built actions to simplify integration.

To integrate notifications with standard collaboration platforms, the administrator should select the Action specific to that platform. For example, the Slack and Microsoft Teams actions are natively available in the Action Gallery.

Slack Action: Requires entering a Slack Token and Channel Name.

Microsoft Teams Action: Requires entering a Webhook URL from the Teams instance.

Using these pre-built actions is the direct and recommended method for supported platforms, as opposed to configuring a generic Webhook manually (Option D) or modifying global settings (Option B).

The feature within Nutanix Self-Service (Calm) designed specifically for publishing blueprints to end-users is the Marketplace .

Marketplace: This component acts as an app store for the organization. Administrators and developers create Blueprints and then publish them to the Marketplace.

Process: The "Marketplace and Application Management" capability encompasses the workflow of submitting a blueprint for approval, versioning it, and making it visible to users based on their Project entitlements.

Consumption: Once published, users do not access the raw blueprint design canvas; instead, they access the Marketplace Item to launch (consume) the application.

While "Unified Multi-Cloud Orchestration" describes the platform's broad goal, and "DSL" is a method for creating code-based blueprints, "Marketplace" is the specific functional area for publishing and consumption.

In Nutanix Intelligent Operations (X-Play), a Playbook action can have a status of "Skipped" in the execution history. This status is specific and distinct from "Failed."

Conditional Execution: Administrators can configure Conditions on individual Playbook actions (e.g., "Only run this step if the Alert Severity == Critical" or "Only if entity name contains 'Prod'").

The Cause: If the Playbook triggers successfully but the specific criteria for the notification step are not met during execution, X-Play skips that specific action while effectively completing the Playbook run.

If the service were down (Option B) or the configuration invalid (Option A), the step would typically report a "Failed" status, not "Skipped."

The visibility of clusters within a Self-Service Project is strictly controlled by the Infrastructure (or Accounts) configuration within the Project settings.

Infrastructure Whitelisting: When configuring a Project, the administrator must select which Accounts and Clusters are available for use. This is often referred to as defining the Project Scope or whitelisting infrastructure.

The Cause: If users can see and create Environments targeting "Production Clusters," it is because the administrator explicitly selected (whitelisted) those Production Clusters in the Project's Infrastructure tab.

Environments vs. Infrastructure: Environments are definitions created using the allowed infrastructure. Option D is less accurate because you whitelist the Infrastructure (resources), and then Environments are created on top of them. The root cause of the resource availability is the infrastructure whitelist in the Project Scope.

In Nutanix Self-Service, Projects are the foundational organizational construct. Documentation states that Projects allow administrators to:

Group users and user groups

Assign roles (Consumer, Developer, Project Admin, etc.)

Define resources (clusters, networks, images) allocated to that project

Attach blueprints, application profiles, and environments

Thus, Projects manage user grouping and role-based access , which matches Option A .

Options B, C, and D do not represent Project functionality within Self-Service.

The scenario describes a "Zero Trust" style Security Policy (Flow Network Security) where all traffic is blocked unless explicitly allowed by a rule matching a Category.

The Rule: The policy specifically states that SSH (port 22) traffic is allowed only for VMs tagged with the category AppType: Admin-VM.

The Issue: The deployed VM cannot be accessed via SSH. This indicates that the VM does not match the allow rule.

The Fix: The Blueprint used to deploy these Administrator VMs must be updated to assign the AppType: Admin-VM category to the VM service definition.

Once the VM is deployed with this tag, the Flow Security Policy will recognize it and permit the inbound SSH traffic. Assigning Web-Servers (Option B) would open port 443, not 22.

When configuring a Playbook in Intelligent Operations (X-Play), the "User Execution" settings allow the administrator to define a specific user context (impersonation) under which the playbook actions run.

However, for a local user account created in Prism Central to be available and valid for this impersonation, that user must have logged into the Prism Central interface at least once . This login event creates the necessary user profile and mapping within the Prism Central database that X-Play requires to authenticate and execute actions on their behalf. If the user has been created but never logged in, they cannot be successfully used for playbook execution.

Nutanix Calm documentation states that Application Profiles (App Profiles) define:

Default variable values

Deployment targets (cluster, subnet, environment)

Runtime configuration differences across environments

App Profiles act as logical deployment configurations within a blueprint, allowing the same blueprint to be deployed differently across staging, test, or production environments.

Thus, the correct answer is C. App Profiles .

The most efficient and scalable method for managing user access in Nutanix Self-Service Projects is leveraging existing Identity Providers (such as Active Directory).

Add an Active Directory group to a role: When adding users to a Project, the administrator can select an entire Directory Group (AD Group) and assign a specific Project Role (e.g., Developer, Consumer, Operator) to that group.

Result: All users currently in that AD group, and any users added to that AD group in the future, automatically inherit the assigned Project Role. This eliminates the need to manually manage individual user accounts (Option D) or maintain separate local groups (Option A) within Prism Central.

In the context of Nutanix Self-Service (Calm) Blueprints, an Application Profile acts as a configuration wrapper that defines a specific variation of the application deployment. 1

Combinations: It allows the blueprint developer to define multiple "sizes" or "flavors" of the same application (e.g., "Small," "Medium," "Large") within a single blueprint.

Variables: Each Application Profile maps specific values to the variables defined in the underlying Services and Packages. For example, the "Small" profile might set the vCPU variable to 2 and the Memory variable to 4GB, while the "Large" profile sets them to 8 and 32GB respectively.

User Experience: When a user launches a blueprint from the Marketplace, they select the desired Application Profile, which then determines the specific infrastructure resources (VM specs) and software packages that get deployed. 2

Comprehensive and Detailed Explanation

Nutanix Calm documentation states:

The Blueprint Editor is the graphical interface used to design, visualize, and modify a blueprint’s components, such as services, packages, substrates, dependencies, and tasks.

The editor provides a visual topology of the multi-tier application.

Thus, the correct answer is C. Blueprint Editor .

Comprehensive and Detailed Explanation

Self-Service platform sync allows Prism Central to periodically collect updates from external providers.

Nutanix documentation states that the providers supporting platform sync with a 20-minute update window are:

Nutanix (AHV)

VMware (vSphere)

AWS

These environments support the metadata collection necessary for tracking:

IP changes

Disk resizing

VM availability

Thus, the valid set is Nutanix, VMware, and AWS , making Option C correct.

In Nutanix Self-Service (Calm), to protect sensitive data (such as passwords, keys, or personal tokens) from being displayed in plain text in the UI and Audit Logs, the developer must configure them as Secret Variables .

Secret Configuration: When defining a variable in a Blueprint or Runbook, there is a specific checkbox option to mark the variable as "Secret" (often indicated by a lock icon).

Behavior: Once a variable is marked as Secret, the Self-Service engine automatically masks the value (replacing it with asterisks *****) in all Audit Log outputs, task details, and the user interface. It is passed securely to the script execution environment but is never echoed back to the console logs in readable form.

Macros like jsonEncode (Option D) affect formatting, not security masking.

Nutanix Calm and Self-Service automation workflows require validation within the same execution context used by end users. Nutanix documentation specifies the following principles:

1. Playbook validation requires execution in the same user and project context

Playbooks that target resources using a CalmProject category must be tested in the exact context in which they will operate.

The "Execute on behalf of" option allows the administrator to run the Playbook as if a project user initiated it , ensuring validation of:

Project-based scoping

User permissions

Category-based triggers

Playbook logic and automation flow

This matches the documented requirement that Playbooks must be validated under the intended user execution model , making Option B correct .

2. Deployment must occur inside the Project to activate category-driven Playbooks

Blueprint deployments only trigger Playbooks when:

The deployment occurs inside the Project , and

The VM receives metadata (such as CalmProject category) associated with that Project.

Nutanix Calm documentation highlights that Playbooks relying on Project categories only activate when VMs are provisioned from that specific Project .

Deploying from the Marketplace does not guarantee that the correct project context or categories will be applied.

Thus, verifying Playbook execution requires deploying the blueprint assigned to the Project, making Option D correct .

Why the other options are incorrect

❌ Option A – “Execute”

This executes Playbooks only in the admin context, not the Project context. It does not validate permissions, user behavior, or category-based triggers required for Self-Service operation.

❌ Option C – Marketplace deployment

Marketplace deployments do not necessarily apply Project-specific categories or metadata, so they cannot reliably test integration with Playbooks bound to a Project.

Creating and managing Playbooks within the Intelligent Operations (X-Play) feature of Prism Central requires an administrative role with sufficient privileges to define system-wide automation rules.

Prism Admin: The Prism Admin (or Super Admin) role is explicitly required to create, edit, enable, and manage Playbooks. This role grants full control over the Intelligent Operations module.

Prism Viewer (A): This role has read-only access and can view Playbooks but cannot create or modify them.

Self-Service Admin (D): This role is specific to the Self-Service (Calm) application and its blueprints/projects, not the X-Play automation engine in Prism Central.

Self-Service Domain-Specific Language (DSL) is the specific capability within Nutanix Self-Service (formerly Calm) that enables Infrastructure-as-Code (IaC) .

Definition: The Self-Service DSL is a Python-based domain-specific language that allows administrators and developers to define Blueprints, Runbooks, and Projects as code.

Functionality: Instead of using the Graphical User Interface (GUI), users can write Python code to describe the application structure, services, and logic. This code can then be version-controlled (e.g., in Git), reviewed, and deployed via the CLI, fulfilling the principles of Infrastructure-as-Code.

Contrast: While "Application Development" and "Orchestration" are broad concepts, the DSL is the specific tool/feature that delivers the IaC mechanism.

In Intelligent Operations (X-Play) Playbooks , the syntax for string interpolation (using parameters) differs from Self-Service (Calm).

Playbook Syntax: X-Play uses the double curly brace syntax {{ ... }} to reference parameters.

Example: To reference the name of the entity that triggered the playbook, the correct parameter string is {{trigger[0].source_entity_info.name}} or {{trigger[0] .alert_entity_info.name}} depending on the trigger type.

Contrast: @@{...}@@ (Option B) is the syntax used in Self-Service (Calm) macros, not X-Play Playbooks.

To create or configure a Custom Provider in Nutanix Self-Service (Calm), the administrator typically defines the provider's schema (endpoints, variables, and actions) using the Self-Service DSL (Domain Specific Language) or by constructing a definition file.

YAML Definition: The standard workflow for creating complex custom providers involves defining the provider logic in Python (via the DSL) and compiling it into a YAML file, or writing the YAML definition directly.

Import/Update: This YAML file is then uploaded to the Self-Service interface to create or update the Provider definition. This allows the administrator to extend Self-Service capabilities to any infrastructure or service that has an API, beyond the native supported providers.

Note: While the question option phrasing ("Update the blueprint...") may be imprecise, the action of uploading a YAML file is the specific mechanism associated with defining Custom Providers and DSL-based constructs in Nutanix Self-Service.

To enforce different configurations for different types of workloads within the same Project, Nutanix Self-Service uses Environments .

Environments: These are logical configurations within a Project that map to specific infrastructure settings. An administrator can define multiple environments (e.g., "Development" and "Production") within the "Engineering" project.

Category Assignment: Within each Environment configuration, the administrator can define specific VM Categories that will be automatically applied to any VM provisioned into that environment.

Mapping:

Production Environment: Assign the category Protection: async_1hr_repl (Matches requirement: Asynchronous remote replication every 1 hour).

Development Environment: Assign the category Protection: snap_24_hr (Matches requirement: Daily snapshots).

Execution: When a user launches a blueprint, they select the target Environment (Dev or Prod). The system automatically tags the VMs with the categories defined in that environment, which in turn engages the Protection Policies associated with those tags.

Option B uses the wrong category values (sync_remote_repl instead of async). Options C and D suggest using Playbooks, but the native and most efficient method for applying deployment-time governance in Self-Service is via the Project Environment settings.

To make a specific task available for reuse across other blueprints and runbooks, an administrator can publish the task to the Task Library.

While working within the Blueprint or Runbook editor, an administrator can select a specific task they have configured. In the configuration pane for that task, there is an option to "Publish to Library" . Selecting this saves the task (including its script and settings) to the central Task Library. Once published, the task appears in the Library list and can be imported into other blueprints or runbooks, ensuring consistency and reducing duplicated effort.

When configuring HTTP Endpoints within Nutanix Self-Service (to be used by tasks for making API calls), the system provides security controls to ensure trust.

Verify TLS Certificate: This specific checkbox setting in the Endpoint configuration determines whether the Self-Service engine validates the SSL/TLS certificate of the target server.

Security: Checking this box ensures that the connection is secure and that the target identity is verified (preventing Man-in-the-Middle attacks). Unchecking it allows connections to servers with self-signed or invalid certificates (often used in dev/test), but for secure access , verifying the certificate is the required configuration.

Options A (SSH) and C (Static IP) are unrelated to the security of an outbound HTTP API call. Option B (Proxy) relates to routing, not the security handshake itself.

According to the Self-Service Blueprint and Task configuration settings, the specific parameter that enables and controls the number of retries for a failed task is the Retry Count .

Retry Count: This integer value determines how many times the system will attempt to re-execute the task if it returns a failure status. If this is set to 0 (default in some views), no retries occur. Setting it to a value of 1 or higher enables the retry logic.

Retry Interval (Option A): This setting defines the wait time (in seconds) between the attempts, but without a positive Retry Count , the interval is irrelevant.

Timeout (Option B): This defines how long the system waits for a single attempt to complete before marking it as failed.