I85PREP
⌘ K
Nutanix NCP-CI-AWS study materials
Nutanix NCP-CI-AWS study resources

Nutanix NCP-CI-AWS practice questions

One question at a time. Build your Nutanix NCP-CI-AWS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

In an NC2 on AWS deployment, which component runs inside the customer's AWS VPC and provides the compute and storage resources for the Nutanix cluster?

  1. The bare-metal EC2 instances that form the cluster nodes Correct answer.
  2. The Prism Central instance hosted in Nutanix's cloud
  3. The AWS Direct Connect gateway
  4. The S3 bucket used for cluster backups

Explanation

NC2 on AWS provisions dedicated bare-metal Amazon EC2 instances inside the customer's VPC, and Nutanix software (AHV and AOS) runs directly on that hardware to form the cluster. Prism Central is deployed as part of the Nutanix software stack rather than being hosted by Nutanix, and neither Direct Connect nor S3 provides cluster compute.

Question 2Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which AWS construct must exist before NC2 can deploy a Nutanix cluster, because the bare-metal instances and the Prism Central VM are launched into it?

  1. An Elastic Beanstalk application
  2. A VPC with subnets in the target region Correct answer.
  3. An AWS Outposts rack
  4. A Route 53 private hosted zone

Explanation

NC2 deploys its EC2 bare-metal instances and Prism Central into an Amazon VPC, so the VPC and its subnets must be created in the chosen region beforehand. Outposts, Route 53 zones, and Elastic Beanstalk are unrelated to hosting the cluster's network fabric.

Question 3Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

A customer wants the lowest possible latency between an on-premises datacenter and an NC2 cluster on AWS. Which connectivity option should they choose?

  1. VPC peering between two AWS regions
  2. AWS Global Accelerator
  3. AWS Direct Connect with a private virtual interface Correct answer.
  4. Site-to-Site VPN over the public internet

Explanation

Direct Connect provides a dedicated private network path from on-premises to AWS, giving more consistent and lower latency than an internet-based VPN. Global Accelerator optimizes internet paths but still traverses the public internet, and VPC peering only connects AWS networks to each other.

Question 4Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

What is the role of Prism Central in an NC2 on AWS environment?

  1. It terminates the Direct Connect circuit
  2. It is the multi-cluster management plane used to deploy and manage NC2 clusters Correct answer.
  3. It replaces the need for a VPC
  4. It provides the distributed storage layer for the cluster nodes

Explanation

Prism Central is the centralized management plane that NC2 uses to create, monitor, and manage clusters, including those running on AWS. The distributed storage layer is provided by AOS on each node, and Prism Central does not handle network circuits or replace VPC networking.

Question 5Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which statement best describes how storage is presented to workloads in an NC2 on AWS cluster?

  1. Each node contributes local NVMe instance storage to a distributed AOS storage pool Correct answer.
  2. Storage is provided by an Amazon EFS mount shared across the cluster
  3. Workloads read and write directly to an attached EBS volume shared by all nodes
  4. All VM disks are stored in an S3 bucket accessed over the internet

Explanation

NC2 uses the local NVMe drives on the bare-metal instances, and AOS aggregates them into a distributed storage pool with replication across nodes. EBS, EFS, and S3 are AWS managed services that are not used as the cluster's primary distributed storage fabric.

Question 6Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Why does NC2 on AWS require bare-metal EC2 instance types rather than standard virtualized instances?

  1. Bare-metal instances are the only type that supports VPC networking
  2. Standard instances cannot be placed in a private subnet
  3. Nutanix needs direct access to hardware virtualization extensions and local NVMe devices to run AHV Correct answer.
  4. Bare-metal instances cost less than all other instance types

Explanation

AHV is a hypervisor, so it needs hardware virtualization support and direct control of local NVMe storage, which bare-metal instances provide. Standard instances already support VPC networking and private subnets, and cost is not the architectural reason for the requirement.

Question 7Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which AWS service is used to give the NC2 cluster nodes private DNS resolution and, when required, outbound internet access for updates?

  1. Amazon Inspector
  2. AWS WAF
  3. AWS CloudTrail
  4. Amazon VPC with NAT Gateway and Route 53 Resolver Correct answer.

Explanation

DNS resolution inside a VPC is handled by Route 53 Resolver, and a NAT Gateway provides outbound internet access for instances in private subnets without exposing them inbound. CloudTrail, WAF, and Inspector are logging, filtering, and scanning services rather than connectivity components.

Question 8Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

During an NC2 cluster creation, what does the deployment process do with the IP addresses supplied in the network configuration?

  1. It assigns them to the Prism Central VM and cluster CVMs so they are reachable on the VPC network Correct answer.
  2. It uses them only for the AWS console login
  3. It stores them in S3 for later retrieval
  4. It converts them into public Elastic IPs automatically

Explanation

The network configuration supplies the management IPs used by the Prism Central VM and the controller VMs (CVMs) so administrators can reach the cluster over the VPC. The addresses are not used for console login, converted to public IPs automatically, or stored in S3.

Question 9Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which two networks are typically configured for an NC2 on AWS cluster to separate management traffic from VM workload traffic?

  1. An S3 endpoint network and a Glacier network
  2. A Direct Connect network and a VPN network
  3. A public network and a backup network
  4. A management network and a workload (data) network Correct answer.

Explanation

NC2 deployments commonly separate the management network used by Prism and the CVMs from the workload network used by guest VMs, which improves isolation and security. Backup, S3, Glacier, Direct Connect, and VPN are not the standard pairing of cluster networks.

Question 10Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

A team wants to isolate guest VM traffic from the cluster management traffic in NC2 on AWS. What is the most appropriate approach?

  1. Assign all interfaces to the same subnet and rely on the AHV firewall only
  2. Use a single Elastic IP for every cluster component
  3. Disable the VPC and use public IPs for all traffic
  4. Place management and workload interfaces on separate VPC subnets with security groups and route tables scoped to each Correct answer.

Explanation

Separating the management and workload interfaces onto distinct subnets lets you apply different security groups and routing per traffic type, giving real isolation. Relying on a single subnet or public IPs removes network-level separation and weakens security.

Question 11Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

What is the purpose of Flow Network Security in an NC2 on AWS deployment?

  1. It provides distributed microsegmentation and firewall policy enforcement for VMs Correct answer.
  2. It encrypts S3 buckets used by the cluster
  3. It manages AWS IAM roles for the cluster
  4. It provisions the bare-metal instances

Explanation

Flow Network Security delivers distributed firewall policies and microsegmentation at the VM level within the Nutanix environment. It does not manage S3 encryption, IAM roles, or EC2 provisioning, which are separate AWS and Nutanix functions.

Question 12Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which IAM consideration applies when NC2 is configured to manage AWS resources on the customer's behalf?

  1. Root account access keys must be embedded in the cluster
  2. IAM permissions are not required because NC2 runs entirely outside AWS
  3. All cluster nodes must share a single IAM user password
  4. A least-privilege IAM role or policy must be granted so NC2 can act within the account Correct answer.

Explanation

NC2 needs scoped AWS permissions, typically through an IAM role or policy, to provision and manage resources in the account, following least-privilege practice. Root keys, embedded credentials, or shared passwords are insecure and unnecessary.

Question 13Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

How does NC2 on AWS typically achieve resilience for the cluster's data?

  1. By replicating data across nodes within the cluster's availability zone using AOS redundancy Correct answer.
  2. By using AWS Backup to replicate VM disks
  3. By storing all data in an S3 bucket in another region
  4. By relying on a single node with EBS snapshots

Explanation

AOS provides redundancy by replicating or erasure-coding data across the nodes in the cluster, so the loss of a node does not lose data. EBS snapshots, cross-region S3, and AWS Backup are not the primary in-cluster resilience mechanism.

Question 14Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

When sizing an NC2 on AWS cluster, which factor most directly determines the usable storage capacity?

  1. The size of the Route 53 hosted zone
  2. The number of bare-metal nodes and the capacity of their local NVMe drives, adjusted for redundancy Correct answer.
  3. The number of IAM users in the account
  4. The number of Elastic IP addresses allocated

Explanation

Usable capacity comes from the aggregate local NVMe storage across nodes, minus the overhead consumed by the configured redundancy. Elastic IPs, DNS zones, and IAM users have no bearing on storage capacity.

Question 15Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which statement about the minimum cluster size for a production NC2 on AWS deployment is most accurate?

  1. Cluster size is irrelevant because storage is external
  2. Exactly two nodes are required and provide full redundancy
  3. A single node is sufficient for production because AWS handles hardware failures
  4. At least three nodes are typically required so the cluster can tolerate a node failure with redundancy Correct answer.

Explanation

A production cluster generally needs at least three nodes so that AOS can maintain redundancy and continue operating if one node fails. A single node has no failure tolerance, and two nodes cannot sustain a fault with standard redundancy.

Question 16Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

What happens to the Nutanix software licensing model when a cluster runs in NC2 on AWS?

  1. Licenses are permanently bound to the physical AWS host and cannot be changed
  2. Licenses are only required for Prism Central, not the nodes
  3. Licenses are consumed on a subscription basis tied to the cluster, with term or capacity-based options Correct answer.
  4. Licensing is handled entirely by AWS and Nutanix licenses are not needed

Explanation

NC2 uses subscription licensing associated with the cluster, offered in term or capacity-based forms rather than perpetual licenses tied to hardware. AWS does not supply Nutanix licensing, and node-level consumption still applies.

Question 17Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An administrator needs to extend an on-premises Nutanix environment to AWS for burst capacity while keeping a single management view. Which NC2 capability supports this?

  1. Replacing Prism Central with the AWS Management Console
  2. Migrating all on-premises hardware to AWS permanently
  3. Managing the AWS-based NC2 cluster from the same Prism Central used on-premises Correct answer.
  4. Running AHV directly on AWS Fargate

Explanation

Prism Central can manage both on-premises clusters and NC2 clusters on AWS, giving a unified view for operations and enabling hybrid bursting. Permanent migration, replacing Prism Central, and Fargate are not how this hybrid model works.

Question 18Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which AWS networking component allows instances in a private subnet to reach the internet for software downloads without exposing them to inbound traffic?

  1. A NAT Gateway in a public subnet with a route from the private subnet Correct answer.
  2. A VPC endpoint for S3 only
  3. A security group allowing all inbound traffic
  4. An internet gateway attached directly to the private subnet

Explanation

A NAT Gateway placed in a public subnet lets private-subnet instances initiate outbound connections while blocking unsolicited inbound traffic. An internet gateway requires a public IP, an S3 endpoint only reaches S3, and permissive security groups do not create an egress path.

Question 19Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

What is the primary reason NC2 on AWS clusters are deployed within a single AWS region and typically a single availability zone?

  1. Because licensing only permits one region
  2. Because Prism Central cannot resolve DNS across regions
  3. Because AWS forbids multi-region VPCs
  4. To keep storage replication traffic on a low-latency, high-bandwidth local network between nodes Correct answer.

Explanation

AOS replication is latency-sensitive, so nodes are kept close together on a low-latency local network within an availability zone. AWS does not forbid multi-region designs, DNS works across regions, and licensing is not region-restricted in this way.

Question 20Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which task is performed by the NC2 deployment workflow rather than by the customer manually in the AWS console?

  1. Registering a new domain name
  2. Creating the IAM user for console login
  3. Launching and configuring the bare-metal instances and installing the Nutanix software stack Correct answer.
  4. Purchasing a Direct Connect circuit

Explanation

The NC2 workflow automates launching the bare-metal instances, configuring networking for the cluster, and installing the Nutanix software. IAM users, domain registration, and Direct Connect procurement remain customer or AWS account tasks.

Question 21Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

A security team requires that management access to Prism Central and the CVMs be restricted to a corporate CIDR range. Which control best accomplishes this in NC2 on AWS?

  1. An IAM password policy requiring complexity
  2. Security group rules on the management subnet allowing only the corporate CIDR Correct answer.
  3. An S3 bucket policy denying other IPs
  4. A CloudFront distribution in front of Prism Central

Explanation

Security groups act as stateful virtual firewalls on the management interfaces, so restricting inbound rules to the corporate CIDR limits who can reach Prism Central and the CVMs. S3 policies, CloudFront, and password policies do not restrict network access to those management endpoints.

Question 22Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which statement about Prism Element versus Prism Central in an NC2 on AWS cluster is correct?

  1. Prism Element manages a single cluster locally, while Prism Central provides centralized multi-cluster management Correct answer.
  2. Prism Element and Prism Central are identical and interchangeable
  3. Prism Element manages multiple clusters, while Prism Central manages only one node
  4. Prism Element is an AWS service, while Prism Central runs on-premises only

Explanation

Prism Element is the local management interface for an individual cluster, and Prism Central aggregates management across one or more clusters. They serve different scopes and are not interchangeable, and both can run in the NC2 environment.

Question 23Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which consideration is most important when choosing the AWS region for an NC2 deployment?

  1. The default time zone of the account
  2. Proximity to users and on-premises systems, plus availability of the required bare-metal instance types Correct answer.
  3. The number of S3 buckets already in the account
  4. The color scheme of the AWS console

Explanation

Region choice affects latency to users and to on-premises systems, and not every region offers the specific bare-metal instance types NC2 requires. Console appearance, bucket count, and account time zone do not influence deployment viability.

Question 24Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An architect is told the NC2 cluster must continue running guest VMs even if a single bare-metal host is lost. Which design element directly satisfies this requirement?

  1. Attaching an EBS volume to each VM
  2. Using a single large node to hold all VMs
  3. Configuring AOS redundancy so VM data is replicated to other nodes and VMs can restart elsewhere Correct answer.
  4. Enabling S3 versioning on a backup bucket

Explanation

With data replicated across nodes, a surviving node has a copy of the VM data and AHV can restart the affected VMs. EBS attachments, S3 versioning, and consolidating onto one node do not provide host-failure tolerance.

Question 25Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which AWS feature can be used to provide a private, dedicated connection between the customer's VPC and their on-premises network for NC2 management traffic?

  1. A public Elastic IP on Prism Central
  2. An S3 Transfer Acceleration endpoint
  3. AWS Direct Connect with a virtual private gateway or transit gateway Correct answer.
  4. A VPC gateway endpoint for DynamoDB

Explanation

Direct Connect, terminated through a virtual private gateway or transit gateway, establishes a private dedicated path between on-premises and the VPC. DynamoDB endpoints, S3 acceleration, and public IPs do not provide a private dedicated connection.

Question 26Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

In an NC2 on AWS deployment, which component is responsible for launching and managing the underlying bare-metal EC2 instances that host the Nutanix cluster?

  1. The customer, who must manually launch and register each bare-metal instance
  2. AWS Auto Scaling groups that scale hosts based on CPU utilization
  3. The Nutanix Cloud Clusters service, which orchestrates AWS resources on the customer's behalf Correct answer.
  4. Prism Central running on-premises that directly provisions EC2 instances

Explanation

NC2 is a managed service that provisions and orchestrates the AWS infrastructure, including bare-metal EC2 hosts, as part of cluster creation and lifecycle operations. The customer does not manually launch and register hosts, and Prism Central does not call AWS APIs to provision instances.

Question 27Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which AWS account model is supported when deploying an NC2 on AWS cluster?

  1. The cluster must run in an AWS account owned and operated by Nutanix
  2. The cluster runs in the customer's own AWS account, with NC2 requiring cross-account role access Correct answer.
  3. The cluster must be deployed in an AWS GovCloud account regardless of region
  4. The cluster requires a dedicated AWS Organizations management account with no other workloads

Explanation

NC2 clusters are deployed into the customer's AWS account, and Nutanix accesses resources through a cross-account IAM role that the customer authorizes. This keeps billing and resource ownership with the customer while allowing the service to orchestrate infrastructure.

Question 28Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which EC2 instance family characteristic makes it suitable as an NC2 on AWS cluster host?

  1. It supports nested virtualization with hardware-assisted extensions
  2. It is a burstable instance type with CPU credits
  3. It is a spot instance type optimized for interruptible workloads
  4. It is a bare-metal instance type with no hypervisor between the OS and hardware Correct answer.

Explanation

Nutanix AHV requires direct access to hardware virtualization features, so NC2 uses bare-metal EC2 instance types where no AWS hypervisor sits beneath the Nutanix stack. Burstable and spot characteristics do not satisfy this requirement.

Question 29Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An administrator is preparing an AWS VPC for an NC2 cluster and needs to meet its DNS prerequisites. Which VPC settings must be enabled?

  1. Enable DNS hostnames and DNS resolution Correct answer.
  2. Disable the default route table association
  3. Enable subnet flow logs
  4. Enable auto-assign public IPv4 addresses

Explanation

NC2 cluster hosts rely on DNS resolution and hostnames within the VPC, so DNS resolution and DNS hostnames must be enabled on the VPC. These settings control DNS behavior; they do not enable automatic allocation of primary private IPv4 addresses from the subnet.

Question 30Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which statement describes how an NC2 on AWS cluster connects to an existing on-premises Nutanix environment for a single-pane-of-glass management experience?

  1. The NC2 cluster runs its own Prism Central and replicates configuration to the on-premises Prism Element
  2. The on-premises Prism Element directly manages the NC2 hosts without Prism Central
  3. The NC2 cluster must be rebuilt on-premises before it can be managed centrally
  4. The on-premises Prism Central registers the NC2 cluster as a remote cluster in the same Prism Central instance Correct answer.

Explanation

A single Prism Central can manage multiple clusters, including an NC2 cluster in AWS, by registering it as a remote cluster. This provides centralized management without duplicating Prism Central instances or rebuilding the cluster.

Question 31Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which AWS construct is used to define the network boundaries and subnets into which an NC2 cluster is deployed?

  1. An Amazon Route 53 private hosted zone
  2. An AWS Transit Gateway attachment
  3. An AWS Direct Connect virtual interface
  4. A VPC with one or more subnets in the selected region Correct answer.

Explanation

NC2 cluster hosts are placed into subnets within a VPC in the chosen AWS region. Transit Gateway, Direct Connect, and Route 53 are connectivity and DNS services that may complement but do not define the deployment network boundary.

Question 32Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

What is the role of the IAM role that the customer creates for NC2 during onboarding?

  1. It grants AWS support engineers access to the cluster's Prism Central UI
  2. It provides the licensing entitlement for Nutanix software
  3. It grants Nutanix the permissions needed to provision and manage AWS resources in the customer's account Correct answer.
  4. It replaces the need for a VPC and subnets in the customer account

Explanation

The cross-account IAM role delegates specific AWS permissions so the NC2 service can create and manage resources such as EC2 hosts and networking components in the customer account. It does not grant UI access, replace networking, or carry licensing.

Question 33Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which statement best describes the relationship between an NC2 cluster and the AWS region in which it is created?

  1. The cluster spans multiple AWS regions for data locality
  2. The cluster requires at least two regions to satisfy quorum
  3. The cluster region is chosen automatically by AWS and cannot be influenced
  4. The cluster is created in a single AWS region and its hosts reside there Correct answer.

Explanation

An NC2 cluster is deployed into one AWS region, and its bare-metal hosts and associated resources live in that region. Multi-region quorum and automatic region selection are not part of the model.

Question 34Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

A team is planning an NC2 cluster and wants to minimize latency to an on-premises data center while keeping the cluster in a single AWS region. Which action best supports this goal?

  1. Choose the region with the lowest EC2 list price regardless of location
  2. Choose an AWS region geographically close to the data center and use a dedicated connection such as Direct Connect Correct answer.
  3. Rely on the public internet for all traffic between the data center and AWS
  4. Deploy the cluster across two regions to average out latency

Explanation

Latency between on-premises systems and an NC2 cluster is dominated by geographic distance and the network path, so selecting a nearby region and using a private dedicated connection reduces round-trip time. Price-only or multi-region choices do not directly address latency.

Question 35Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An architect wants to reduce the blast radius of an Availability Zone failure for an NC2 cluster while staying within the supported deployment model. Which approach is most appropriate?

  1. Rely on AWS to automatically migrate bare-metal hosts between Availability Zones
  2. Deploy two independent NC2 clusters in separate Availability Zones and use data protection between them Correct answer.
  3. Place all hosts in one Availability Zone and enable EC2 auto-recovery
  4. Deploy a single cluster across multiple Availability Zones in the region

Explanation

A single NC2 cluster is deployed within one Availability Zone, so resilience against an AZ-level failure is achieved by running separate clusters in different zones and protecting data between them. AWS does not automatically move bare-metal hosts across zones.

Question 36Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An administrator needs to give the NC2 cluster hosts outbound internet access for software updates while keeping them in private subnets. Which configuration accomplishes this?

  1. Attach an internet gateway directly to the private subnet
  2. Route the private subnets to a NAT gateway in a public subnet Correct answer.
  3. Assign each host an Elastic IP address and open all inbound ports
  4. Place the hosts in a public subnet with a security group allowing all traffic

Explanation

A NAT gateway in a public subnet allows instances in private subnets to initiate outbound connections without exposing them to inbound internet traffic. Elastic IPs, direct internet gateway attachment to private subnets, and public placement all undermine the private design.

Question 37Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

When configuring the cluster network during NC2 deployment, which address range should be provided for the CVM and hypervisor management traffic?

  1. A public routable range assigned by AWS automatically
  2. The same range used by guest VM workloads to consolidate addressing
  3. A dedicated range that does not overlap the VPC subnet or on-premises networks Correct answer.
  4. A range that overlaps the VPC subnet CIDR to simplify routing

Explanation

The management network range must be unique and non-overlapping with the VPC subnets and any connected on-premises networks to avoid routing conflicts. Overlapping or shared ranges cause connectivity problems.

Question 38Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

A security team requires that all administrative access to Prism Element and Prism Central in an NC2 cluster be logged and restricted to specific source addresses. Which combination best meets this requirement?

  1. Security group rules limited to the corporate CIDR plus VPC flow logs and Prism audit logs Correct answer.
  2. Disabling Prism Central and managing only through the AWS console
  3. Public IP addresses on each CVM with no restrictions
  4. A network ACL that denies all traffic and relies on console access only

Explanation

Restricting security group ingress to known CIDRs limits who can reach the management interfaces, while flow logs and Prism audit logs provide the required visibility. Denying all traffic or exposing public IPs does not meet the goal.

Question 39Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which statement correctly distinguishes Prism Element from Prism Central in an NC2 on AWS deployment?

  1. Prism Element is an AWS-native service and Prism Central is a Nutanix service
  2. Prism Element manages a single cluster, while Prism Central can manage multiple clusters including the NC2 cluster Correct answer.
  3. Prism Central runs only on-premises and cannot manage an NC2 cluster
  4. Both are identical components and differ only in licensing tier

Explanation

Prism Element is the management plane for an individual cluster, whereas Prism Central provides centralized management across multiple registered clusters, including NC2 clusters in AWS. They are distinct components with different scopes.

Question 40Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

During NC2 cluster creation, the deployment workflow performs several steps automatically. Which task is part of that automated workflow?

  1. Purchasing Reserved Instances for the bare-metal hosts
  2. Configuring the cluster's storage tier, networking, and registering the cluster with Prism Central Correct answer.
  3. Creating the cross-account IAM role and attaching policies in the customer account
  4. Designing the customer's on-premises network segmentation

Explanation

The NC2 workflow automates cluster formation, including configuring storage and networking and registering the cluster with Prism Central. IAM role creation is a customer onboarding step, and on-premises design and RI purchasing are outside the workflow.

Question 41Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An administrator wants guest VM traffic in an NC2 cluster to use a different subnet from the CVM management traffic. Which design achieves this?

  1. Place all guest VMs in the AWS public subnet used by the NAT gateway
  2. Configure a separate VLAN-backed network for guest VMs and keep management on its own network Correct answer.
  3. Use the same subnet for both and rely on security groups to separate traffic
  4. Assign guest VMs addresses from the management subnet but with different hostnames

Explanation

Separating guest workload traffic onto its own VLAN-backed network keeps it distinct from CVM and hypervisor management traffic, improving isolation and troubleshooting. Reusing the management subnet or the NAT subnet does not provide separation.

Question 42Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which AWS capability allows an NC2 cluster to present a consistent private IP addressing scheme to on-premises systems without exposing hosts to the public internet?

  1. A VPC with private subnets connected to on-premises through a VPN or Direct Connect Correct answer.
  2. Assigning public Elastic IPs to every CVM
  3. Enabling public DNS resolution for the cluster's private addresses
  4. Using an internet-facing Application Load Balancer for all cluster traffic

Explanation

Private subnets combined with a VPN or Direct Connect provide private connectivity between on-premises networks and the cluster while keeping hosts off the public internet. Public IPs, internet-facing load balancers, and public DNS expose or misroute traffic.

Question 43Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An architect is sizing an NC2 cluster and must account for the storage overhead imposed by resiliency. Which statement is correct?

  1. Usable capacity is determined only by the number of VMs running on the cluster
  2. Usable capacity equals raw capacity regardless of the resiliency factor
  3. Usable capacity is fixed at 50 percent for all NC2 deployments
  4. Usable capacity is reduced by the configured replication or erasure coding scheme Correct answer.

Explanation

Nutanix resiliency consumes raw capacity to protect data, so usable capacity is less than raw capacity and depends on the configured replication factor or erasure coding. It is not fixed at a single percentage and is not driven by VM count alone.

Question 44Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

Which statement about the minimum number of hosts for a production NC2 on AWS cluster is accurate?

  1. Exactly two hosts are required to form a valid cluster
  2. The host count is determined solely by the number of VMs to be migrated
  3. A minimum of three hosts is required to support resiliency and cluster quorum Correct answer.
  4. A single host is sufficient for production because AWS provides hardware redundancy

Explanation

A production NC2 cluster requires at least three hosts so that data resiliency and cluster quorum can be maintained if a host is lost. One or two hosts cannot sustain the intended failure tolerance.

Question 45Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

A team needs to migrate workloads to NC2 on AWS and must keep data encrypted at rest using keys they control. Which approach is appropriate?

  1. Disable encryption on the bare-metal instance store
  2. Use AWS KMS customer managed keys with EBS encryption for the cluster's volumes Correct answer.
  3. Rely on the default AWS managed key with no further configuration
  4. Use a self-signed certificate on Prism Central as the encryption mechanism

Explanation

EBS volumes backing the cluster can be encrypted with AWS KMS, and using customer managed keys gives the organization control over key policy and rotation. Default keys reduce control, and instance store or certificates do not provide volume encryption at rest.

Question 46Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An administrator observes that an NC2 cluster cannot reach the Nutanix service endpoints required for licensing and support. Which configuration is the most likely cause?

  1. The guest VMs are using a different VLAN than management
  2. The Prism Central instance is registered to more than one cluster
  3. The cluster has too many hosts for the VPC subnet size
  4. The private subnets lack a route to a NAT gateway or proxy for outbound traffic Correct answer.

Explanation

Outbound connectivity to Nutanix service endpoints requires a route from the private subnets through a NAT gateway or an approved proxy. Host count, Prism Central registration, and guest VLAN choice do not block service endpoint access.

Question 47Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An architect must ensure that a single bare-metal host failure in an NC2 cluster does not cause data loss. Which configuration is required?

  1. Replication factor 2 or higher, or an equivalent erasure coding scheme Correct answer.
  2. Replication factor 1 with frequent snapshots
  3. A single Availability Zone with no redundancy
  4. Backup of the cluster to an S3 bucket only

Explanation

Data resiliency within the cluster requires a replication factor of at least 2, or an erasure coding scheme that provides equivalent protection, so that a host failure does not lose data. Snapshots and backups alone do not provide continuous protection.

Question 48Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

A customer wants to connect an NC2 VPC to multiple on-premises networks and other VPCs using a hub-and-spoke model. Which AWS service is most appropriate?

  1. An AWS Site-to-Site VPN without a gateway
  2. AWS Transit Gateway Correct answer.
  3. An internet gateway attached to each VPC
  4. VPC peering between every pair of VPCs

Explanation

AWS Transit Gateway provides a central hub that connects VPCs and on-premises networks in a hub-and-spoke topology, simplifying routing as the number of networks grows. Full-mesh peering and per-VPC internet gateways do not scale well for this requirement.

Question 49Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An administrator is evaluating whether to use Flow Network Security in an NC2 cluster that already has AWS security groups. Which statement best describes how the two complement each other?

  1. AWS security groups apply only to Prism Central traffic
  2. Flow Network Security replaces AWS security groups entirely
  3. Flow Network Security operates only on the AWS management subnet
  4. AWS security groups apply at the EC2 network interface level, while Flow Network Security enforces policies at the VM level within the cluster Correct answer.

Explanation

AWS security groups filter traffic at the EC2 network interface boundary, whereas Flow Network Security provides distributed, VM-level policy enforcement inside the Nutanix cluster. They operate at different layers and complement rather than replace each other.

Question 50Nutanix Cloud Clusters (NC2) on AWS Architecture and Deployment

An architect is designing an NC2 deployment that must survive the loss of an entire Availability Zone with minimal data loss. Which combination best meets this requirement?

  1. A single NC2 cluster with snapshots taken once per day
  2. A single NC2 cluster with replication factor 3 in one Availability Zone
  3. A single NC2 cluster with erasure coding enabled
  4. Two NC2 clusters in separate Availability Zones with synchronous replication between them Correct answer.

Explanation

Protection against an Availability Zone failure requires resources in more than one zone, which in the NC2 model means separate clusters in different zones with data protection between them. In-cluster replication and erasure coding protect against host failure, not a full zone outage.