Security and Access Control
Authentication vs authorisation
Authentication proves identity: local Prism users, or directory integration with Active Directory/LDAP. Authorisation decides what that identity can do: RBAC roles plus scope. Prism Element has a simpler role set (for example Admin and Viewer); Prism Central offers richer roles (Super Admin, Admin, Viewer, self-service oriented roles) and the ability to create custom roles with granular permissions.
Scope is where Nutanix differs from traditional platforms: access can be limited by cluster and by category. A project team can be granted VM-level rights confined to VMs tagged with a given category, without seeing the rest of the cluster.
Other controls a candidate must recognise:
- Cluster lockdown - restricts direct SSH/CVM access, forcing administration through Prism and approved channels.
- Data-at-rest encryption - either self-encrypting drives or software-based encryption with an external key management server; this is enabled at cluster creation, not switched on casually later.
- Flow Network Security - microsegmentation between workloads.
- Certificates and audit logs - TLS certificate management and a record of administrative actions.
Traps
- Answering "LDAP" when the question is about permissions (that is RBAC) or vice versa.
- Assuming encryption can be enabled at any time on any cluster - plan it at build time.
- Thinking cluster lockdown blocks Prism access; it restricts lower-level host access.
- Forgetting that categories drive both security policy and VM permissions, so a mis-tagged VM inherits the wrong policy.
Rule of thumb
"Who are you?" → authentication (AD/LDAP/local). "What may you touch?" → RBAC + category/cluster scope.