NCP-MCI-6.10 Nutanix Certified Professional - Multicloud Infrastructure (NCP-MCI v6.10) Questions and Answers

CPU Ready Time indicates how long a VM waits for CPU resources due to contention.

Option B (Review host CPU utilization) is correct:

IfCPU utilization is high, there may beexcessive CPU overcommitment, leading to high CPU Ready Time.

Adding more hostsorreducing vCPU allocationsmay resolve the issue.

Option A (Check CVM vCPUs) is incorrect:

The Controller VM (CVM)does not directly impact application VM performancein this case.

Option C (Assess SSD capacity) is incorrect:

CPU Ready Time is unrelated to storage performance.

Option D (Enable VM memory oversubscription) is incorrect:

Memory oversubscription does not affect CPU contention.

Duringfailover in Nutanix Disaster Recovery, VMs retain theirstatic IPsbut maylose DNS settingsif the network configuration at the DR site is different from the primary site.

Option B (Create custom in-guest scripts) is correct:

Custom scriptsallowWindows or Linux VMs to restore DNS settings automaticallyafter failover.

These scripts can be executed usingpost-failover automationin Nutanix DR policies.

Option A (Self-Service Restore) is incorrect:

Self-Service Restore is used forend-user recovery of deleted files, not for network settings.

Option C (nncli tool) is incorrect:

Thenncli toolis used fornetwork troubleshooting, but it does not automatically restore DNS settings.

Option D (Configure a Protection Domain) is incorrect:

Protection Domains definereplication policies, but they do not fix DNS settings after failover.

Understanding the Exhibit & Memory Allocation

Thehost has 128GB of physical RAM.

Thecurrent memory allocationacrossthree VMs (VM1, VM2, VM3) is 128GB, but only92GB is actually utilized.

This means there is36GB of unutilized memory available for allocation.

Step-by-Step Breakdown

Existing Memory Usage Before Adding VM4

Total Physical RAM:128GB

Used by running VMs (VM1, VM2, VM3):92GB

Unutilized Memory Available:36GB

After Creating and Running VM4

VM4 is allocatedmemory but only utilizes 28GB.

The table does not show VM4’s allocated RAM, but assuming it was given a reasonable allocation, it must have been taken from the36GB unutilized memory pool.

IfVM4 uses 28GB, theremaining unutilized memory is now (36GB - 28GB) = 8GB.

Maximum Memory Allocation for VM5

Sinceonly 8GB remains unutilized, the maximum memory VM5 can be allocated while still allowing it to power on is8GB.

Evaluating the Answer Choices

(A) 4GB❌(Incorrect)

More memory (8GB) is available, so limiting to 4GB is unnecessary.

(B) 8GB✅(Correct)

Theremaining unutilized memory after VM4 is 8GB, so VM5 can be allocated up to8GBwhile ensuring it can power on.

(C) 16GB❌(Incorrect)

Only8GB is left, so 16GB isnot possible.

(D) 32GB❌(Incorrect)

There isnot enough unutilized memoryto allocate 32GB.

Key Concept: Nutanix Memory Overcommit

Nutanix AHV supportsmemory overcommit, meaning VMs can be allocated more memory than physically available usingmemory ballooning and swapping.

However,to power on VM5 without impacting performance, it must fit within the available unutilized memory, which is8GB.

Active-Active bonding allows multiple network interfaces to be used simultaneously, improving bandwidth and redundancy.

Option B (Active-Active) is correct:

This mode enablesload balancing across all available adapters, providinghigher throughput and fault tolerance.

Option A (No Uplink Bond) is incorrect:

Without a bond, VMscannot benefit from multiple adapters.

Option C (Active-Active with MAC pinning) is incorrect:

MAC pinningbinds traffic to a single NIC, limiting bandwidth distribution.

Option D (Active-Backup) is incorrect:

This modeonly provides failover, not increased bandwidth.

The Nutanix ECA course covers migration options for VMs in multi-cluster environments, particularly when minimizing downtime is critical, such as during scheduled maintenance. The scenario involves two identical clusters with guest VMs using pass-through GPUs, managed by separate Prism Central instances, requiring a migration method that ensures minimal disruption.

Extract from Nutanix Enterprise Cloud Administration (ECA) Course Documents:

Module: VM Management, Section: Cross-Cluster Live Migration"Cross-Cluster Live Migration allows administrators to migrate VMs between clusters managed by different Prism Central instances with minimal downtime. This feature supports live migration of VMs with pass-through GPUs, ensuring continuous operation during maintenance activities."

Module: Cluster Management, Section: Migration Strategies"For scenarios requiring minimal downtime, such as planned maintenance, Cross-Cluster Live Migration is the preferred method. It enables seamless VM migration across clusters, even those managed by separate Prism Central instances, while maintaining VM availability."

Explanation of Options:

A. Run a Recovery Plan planned failoverThis is incorrect. A Recovery Plan planned failover is part of Nutanix’s disaster recovery (DR) solution, used to execute failover for Protection Domains in scenarios like site failure. It is not designed for routine maintenance migrations and may involve downtime, especially for VMs with pass-through GPUs, as failover requires VM restart on the target cluster. The ECA course states:"Recovery Plans are used for DR failover, not for live migrations during maintenance, and may result in downtime."

B. Use Cross-Cluster Live MigrationThis is the correct answer. Cross-Cluster Live Migration, introduced in later AOS versions, allows VMs to be migrated between clusters, even those managed by different Prism Central instances, with minimal downtime. The ECA course confirms that this feature supports VMs with pass-through GPUs, as the migration process preserves VM state and connectivity. This method is ideal for planned maintenance, ensuring VMs remain operational.

Supporting Extract:"Cross-Cluster Live Migration minimizes downtime by transferring VM state and data live, supporting complex configurations like pass-through GPUs, making it suitable for maintenance scenarios."

C. Perform a Nutanix Move migration planThis is incorrect. Nutanix Move is a tool for migrating VMs from non-Nutanix environments (e.g., VMware or Hyper-V) to a Nutanix cluster, not for migrations between Nutanix clusters. It is not optimized for live migrations within a Nutanix environment and may involve downtime. The ECA course notes:"Nutanix Move is designed for external-to-Nutanix migrations, not for intra-Nutanix cluster migrations, and is not suitable for minimizing downtime."

D. Migrate Asynchronous Protection DomainsThis is incorrect. Migrating Asynchronous Protection Domains involves replicating snapshots to a remote cluster for DR purposes, not live VM migration. This process is asynchronous, involves downtime during failover, and is not suitable for maintenance scenarios requiring minimal disruption. The ECA course clarifies:"Asynchronous Protection Domains are used for DR replication, not for live VM migration, and require VM restart during failover."

Additional Context from ECA:

Cross-Cluster Live Migration: This feature leverages Nutanix’s hypervisor-agnostic migration capabilities, ensuring that VMs with pass-through GPUs are migrated seamlessly. The process involves copying VM memory and state while keeping the VM running, minimizing downtime to seconds or less.

Maintenance Scenario: For scheduled maintenance, Cross-Cluster Live Migration ensures that VMs remain available, which is critical for GPU-intensive workloads that cannot tolerate extended downtime.

Supporting Reference from Web Results:

The Nutanix Support Portal (https://portal.nutanix.com) aligns with the ECA documentation: "Cross-Cluster Live Migration supports live VM migration between clusters, including those with pass-through GPUs, ensuring minimal downtime for maintenance tasks."

NutanixIntelligent Operations Reports(Option D) provideweekly summariesof cluster health, performance, and resource consumption.

These reports includerecommendations for optimization, alerts, and forecasted resource usage trends.

Option A (Admin Center LCM)managesfirmware and software upgradesbut does not generate weekly performance reports.

Option B (Prism Central Syslog)is used forlogging and event tracking, not performance summaries.

Option C (Infrastructure VMs List)provides astatic list of VMsbut does not generate periodic reports.

After a Prism Central upgrade, IAM authentication settings may require reconfiguration.

Option D (Log in with a local admin account) is correct:

If IAM authentication fails, thelocal admin account must be usedto check domain settings.

Option A (Ping the Domain Controller) is incorrect:

Network connectivity is important, but theissue is likely related to IAM settings, not network reachability.

Option B (Check firewall port 9441) is incorrect:

Port 9441 is used forSSO authentication, butport issues usually result in login delays, not complete failures.

Option C (Validate signing certificate) is incorrect:

While certificates can cause issues,local admin login should always work.

The most efficient way to move a VM’s storage to a container that has different storage optimization policies (like compression) is to perform aVM migrationto the target container. This operation ensures that all the VM’s vDisks are moved to the destination container and allows leveraging the configured optimizations on the Production container.

From theNutanix Enterprise Cloud Administration (ECA)course materials:

“VM migration to another storage container in Nutanix Prism Central is supported and can be performed with minimal disruption. When moving a VM to a new container, it inherits the storage optimization policies of that container, including compression, deduplication, and encryption.”

Furthermore:

“Migrations can be initiated at the VM level in Prism Central or Prism Element. This is the most streamlined method to ensure all vDisks for a VM are moved together, preserving data integrity and performance characteristics.”

Recreating the VM or vDisks would be cumbersome and require manual data copying, introducing potential risks and downtime.

Agent VMs, such as CVMs (Controller VMs) or Witness VMs, have strict affinity and anti-affinity rules to ensure they remain on specific hosts and maintain data consistency and high availability. If an agent VM is powered off and then manually started on another host, it becomes unresponsive because it breaks these rules.

From theNutanix Enterprise Cloud Administration (ECA)course materials:

“Agent VMs have specific configuration and affinity constraints. Manually starting them on another host violates these constraints, resulting in the agent VM becoming unresponsive to the cluster.”

Further clarification:

“The cluster expects the agent VM to be on a particular host. Moving it manually to another host breaks this expectation and causes the VM to be unable to properly join the cluster services, leading to an unresponsive state.”

Therefore, it is essential to avoid manually starting agent VMs on different hosts, as doing so can disrupt cluster services.

When performing aLife Cycle Manager (LCM) upgrade, therecommended way to stop the process is to use the “Stop Update” feature in LCM (Option D).

Option A (Cancel via Ergon ecli)is not a recommended approach since manually interfering with running tasks can cause inconsistencies.

Option B (lcm_task_cleanup.py script)is used for post-upgrade cleanup but does not stop ongoing updates.

Option C (Restarting Genesis)does not stop an LCM upgrade and can cause instability.

Nutanix storage containers allow administrators to configure capacity reservations and advertised limits for better resource management.

Option D (Set Reserved Capacity to 10 GiB and Advertised Capacity to 500 GiB) is correct:

Reserved Capacityensures that10 GiB is always available for this container and not consumed by other containers.

Advertised Capacitydefines alogical limit of 500 GiBto prevent over-allocation.

Option A is incorrect:

Advertised Capacity of 10 GiB is too lowand does not match the requirement of a500 GiB storage container.

Option B is incorrect:

Only setting Advertised Capacity does not guarantee Reserved Capacity, meaning other containers could consume the reserved space.

Option C is incorrect:

Setting only Reserved Capacity does not enforce an upper limit, which could lead to overprovisioning.

https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v6_10:mul-configure-data-in-transit-encryption-pc-t.html

"Ensure that port 2009 is open between the Prism Central instances for the KMS cluster to communicate."This is explicitly stated in the "Firewall rules for Data-in-Transit Encryption" section for Prism Central.

Technical Context:

Port 2009 is used by ZooKeeper (the coordination service for the KMS cluster) in Scale-Out Prism Central deployments.

DiTE in Prism Central relies on a dedicated KMS cluster that synchronizes encryption keys across PC instances using this port.

Firewall blocks on port 2009 break KMS quorum, preventing key exchange and causing DiTE to fail.

Before performing any LCM (Life Cycle Manager) updates on a Nutanix cluster, it is essential to ensure that the AOS (Acropolis Operating System) is updated to the required or recommended version. AOS updates provide foundational enhancements, security patches, and compatibility improvements, which are critical for the successful execution of LCM updates.

From theNutanix Enterprise Cloud Administration (ECA)course materials:

“LCM updates depend on the underlying AOS version. Before proceeding with any hardware or software updates through LCM, administrators must ensure that the cluster is running a supported AOS version. This step ensures compatibility and prevents issues that can arise from dependencies between AOS and the update components.”

Additionally:

“AOS upgrades should be performed first to bring the cluster to a version that supports the desired LCM updates for components like BIOS, firmware, and hypervisors. This aligns the management stack with the latest features and security enhancements.”

Therefore, updating AOS before performing LCM updates is a mandatory prerequisite to ensure stability and supportability for the entire cluster lifecycle management process.

When diagnosing CPU performance issues, CPU Ready Time and CPU Usage are the key indicators of whether more vCPUs are needed.

Option A (VM CPU Ready Time) is correct:

High CPU Ready Time means the VM is waiting for CPU resources, indicatingCPU contention.

Option B (VM CPU Usage) is correct:

If CPU usage isconsistently high, adding more vCPUsmay improve performance.

Option C (Host CPU Usage) is incorrect:

Host-wide CPU usage does not indicate whether a specific VM needs more vCPUs.

Option D (Host Memory Swap Out Rate) is incorrect:

Memory swappingaffects RAM performance, not CPU allocation.

For cross-hypervisor DR failover (e.g., ESXi to AHV), Nutanix Guest Tools (NGT) must be installed on VMs to ensure proper configuration and recovery.

Option D (NGT must be installed on source guest VMs) is correct:

NGTensures correct reconfiguration of VM devices and networking settingsduring failover.

Ithandles disk and driver reassignmentsbetween ESXi and AHV.

Option A (Utilize delta disks) is incorrect:

Delta disks are used insnapshot optimization, not DR failover.

Option B (Deploy Legacy BIOS boot) is incorrect:

AHV prefers UEFI boot mode, and Legacy BIOS is not a requirement.

Option C (Use raw device mappings) is incorrect:

RDMs areVMware-specificand arenot used in AHV failover scenarios.

Windows Defender Credential Guard requires UEFI firmware and Secure Boot to function properly.

Option B (Enable UEFI with Secure Boot) is correct:

Credential Guardrequires a UEFI-based boot moderather thanLegacy BIOS.

Secure Boot ensures only trusted OS components load, reducing attack surface for credential theft.

Option A (Update vCPU to 8) is incorrect:

Increasing vCPUs does not impactCredential Guard compatibility.

Option C (Use Windows Server 2022) is incorrect:

Windows Server 2019supports Credential Guard; upgrading to 2022 isnot required.

Option D (Update Memory to 16GB) is incorrect:

Credential Guard has no minimum RAM requirementbeyond general OS needs.

Receive Side Scaling (RSS) VirtIO-Net Multi-Queue improves network performance by distributing network processing across multiple CPU cores.

Option C (Enable RSS VirtIO-Net Multi-Queue) is correct:

This settingreduces CPU bottlenecksby allowing multiple queues to handle network packets.

It isessential for high-throughput network applications.

Option A (Add more vCPUs) is incorrect:

CPU resources are important, butwithout enabling RSS, additional vCPUs will not optimize network traffic distribution.

Option B (Enable AHV Turbo Technology) is incorrect:

AHV Turbo improvesdisk I/O, notnetwork I/O.

Option D (Add more RAM) is incorrect:

RAM does not directly impact network performance.

For NutanixDisaster Recovery (DR) protection policies, thefirst stepis to establish a connection between theProduction cluster and the DR site, which is done by creating anAvailability Zone (AZ) (Option B).

Availability Zones (AZs) define remote sites for replicationand are a requirement for configuring protection domains and disaster recovery plans.

Option A (Installing NGT)is not necessary for setting up replication but is useful for application-consistent snapshots.

Option C (Converting the source cluster to AHV)is not required, as Nutanix supports cross-hypervisor DR betweenESXi and AHV.

Option D (Creating a point-in-time snapshot)is a later step after setting up theAvailability Zone and Protection Policy.

The Nutanix ECA course addresses data protection mechanisms, including how to safeguard disaster recovery (DR) snapshots from inadvertent or malicious deletion. Ensuring that DR snapshots are protected while providing notification requires a policy-based approach to control and monitor deletion actions. The ECA course emphasizes the use ofApproval Policiesin Prism Central to enforce oversight on critical operations like snapshot deletion.

Extract from Nutanix Enterprise Cloud Administration (ECA) Course Documents:

Module: Data Protection, Section: Approval Policies"Approval Policies in Prism Central allow administrators to enforce review and approval for operations such as snapshot deletion. By creating an Approval Policy for DR snapshots, administrators can ensure that deletion requests are reviewed by designated approvers, preventing unauthorized or accidental deletions and providing notifications to relevant stakeholders."

Module: Prism Central Management, Section: Policy Engine"To protect critical resources like DR snapshots, an Approval Policy can be applied to require approval for deletion actions. This ensures that no snapshot is deleted without explicit authorization, and notifications are sent to approvers to maintain oversight."

Explanation of Options:

A. Create and Apply an Approval PolicyThis is the correct answer. An Approval Policy in Prism Central is the best way to protect DR snapshots from inadvertent or malicious deletion. The policy requires designated approvers to review and authorize snapshot deletion requests, ensuring oversight and preventing unauthorized actions. Notifications are sent to approvers, meeting the requirement for awareness of deletion attempts. The ECA course highlights:"Approval Policies are ideal for protecting critical data assets, such as DR snapshots, by enforcing a mandatory review process before deletion."

B. Create and Apply an Alert PolicyThis is incorrect. Alert Policies in Nutanix are used to notify administrators of system events or thresholds (e.g., high CPU usage or disk failures) but do not prevent actions like snapshot deletion. While an Alert Policy could notify administrators after a deletion occurs, it does not provide proactive protection or require approval, failing to meet the question’s requirements. The ECA course states:"Alert Policies are reactive and designed to notify administrators of events, not to control or prevent actions like snapshot deletion."

C. Assign DR Admin Role to usersThis is incorrect. Assigning a DR Admin Role grants users permissions to manage DR operations, including snapshot deletion, but does not add protection or notification mechanisms. In fact, it could increase the risk of deletion by granting more users access. The ECA course notes:"The DR Admin Role provides administrative privileges for data protection tasks but does not enforce approval workflows or protect against unauthorized deletions."

D. Create a Playbook to alert on eventThis is incorrect. Playbooks in Nutanix Flow or Prism Central are used to automate responses to events (e.g., scaling resources or sending alerts), but they are not designed to prevent snapshot deletion or enforce approval workflows. A Playbook could alert administrators after a deletion event, but it lacks the proactive control provided by an Approval Policy. The ECA course clarifies:"Playbooks are suited for automated remediation or notifications but cannot enforce approval for actions like snapshot deletion."

Additional Context from ECA:

Approval Policy Workflow: In Prism Central, an Approval Policy can be created underPolicies > Approval Policies, specifying DR snapshots as the target resource and defining approvers. When a user attempts to delete a protected snapshot, the request is queued for approval, and notifications are sent to approvers via email or Prism Central’s interface.

Use Case: For DR snapshots, which are critical for recovery, Approval Policies ensure that only authorized personnel can approve deletions, reducing the risk of data loss.

Supporting Reference from Web Results:

The Nutanix Bible (https://www.nutanix.com/go/the-nutanix-bible) supports the ECA documentation: "Approval Policies in Prism Central provide granular control over operations like snapshot deletion, ensuring critical DR resources are protected through mandatory approval workflows."

Protection Domains (PDs) in Nutanix ensure that entire applications and their associated data are protected during failover.However,Volume Groups (VGs) are not automatically includedunless explicitly configured.

Option A (Select "Auto protect related entities") is correct:

This setting ensures thatassociated Volume Groups, networks, and other dependencies are included in the Protection Domainautomatically.

Without enabling this, only the VM itself would be protected, leading tomissing application data upon failover.

Option B (Manually add Volume Groups to Protected Entities) is correct:

If"Auto protect related entities" is not enabled, the administrator mustmanually add Volume Groups to the Protection Domain.

This ensures that bothVMs and their attached Volume Groupsare replicated and recovered together.

Option C (Place Volume Groups in a separate Protection Domain) is incorrect:

Separating Volume Groups into a different PDdoes not guarantee they failover together with VMs.

It is best practice tokeep related VMs and Volume Groups in the same PD.

Option D (Use application-consistent snapshots) is incorrect:

Whileapplication-consistent snapshots improve data integrity, theydo not fix missing Volume Groups in failover scenarios.

Metro Availability requires that VMs always read data from their primary site to maintain optimal performance and prevent remote data access latency.

Option C (Migrate the VM to its primary site and set appropriate rules) is correct:

If a VMfails over to the secondary sitebut is still running in the primary site, it will read data remotely, causinghigh latency and performance issues.

The solution is tomigrate the VM back to the primary siteand configureDRS rulesorhost affinity settingsto prevent unwanted movement.

Option A is incorrect:

The command listsactive Metro Availability protection domainsbut doesnot resolvethe issue.

Option B is incorrect:

Must-affinity rules can help, but they should be configuredafter migrating the VM back to the primary site.

Option D is incorrect:

RunningNCC health checkswill onlydiagnose the issue, not resolve it.

Understanding the Exhibit & the Alert

The alert states:

"The cluster is using password-based SSH access for the CVM."

"Password-based remote login is enabled on the cluster."

"It is recommended to use key-based SSH access instead of password-based SSH access for better security."

This means that the nutanix user can log in to Controller VMs (CVMs) using a password, which is a security risk.

Corrective Action: Enabling Cluster Lockdown

✅(C) Enable Cluster Lockdown. (Correct Answer)

Cluster Lockdown Mode restricts password-based SSH access and forces key-based authentication.

This prevents users from logging into CVMs using passwords, enhancing cluster security.

To enable Cluster Lockdown:

Go to Prism Central or Prism Element.

Navigate to Settings → Security → Cluster Lockdown.

Enable Cluster Lockdown Mode.

Evaluating the Other Answer Choices

❌(A) Rename the nutanix user. (Incorrect)

The nutanix user is a built-in system account required for cluster operations.

Renaming the user will not prevent SSH access via password.

❌(B) Block port 22 on the CVM firewall. (Incorrect)

Blocking port 22 (SSH) will completely disable SSH access, including key-based authentication.

This may break cluster management and troubleshooting operations.

❌(D) Delete the nutanix user. (Incorrect)

The nutanix user is a critical system account required for cluster functionality.

Deleting the account will cause serious issues with cluster management.

Multicloud Infrastructure References & Best Practices

Nutanix Security Best Practices:

Always use key-based SSH authentication instead of password-based logins.

Enable Cluster Lockdown Mode to enforce security policies.

Regularly audit user access to ensure security compliance.

Cluster Lockdown Benefits:

Prevents unauthorized SSH access via passwords.

Enforces public key authentication, reducing brute-force attack risks.

Strengthens CVM security against potential exploits.