Nutanix NCP-CI-Azure flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NC2 BareMetal hosting

Nutanix Cloud Clusters run AOS directly on dedicated Azure BareMetal hosts, so AHV is the hypervisor with no nested virtualization and no noisy-neighbor contention from other tenants.

Delegated subnet for NC2

The NC2 cluster is deployed into a subnet delegated to the NC2 service inside a customer VNet; deleting or reconfiguring that subnet breaks cluster management connectivity.

NC2 scale-out granularity

NC2 clusters scale by adding or removing whole BareMetal nodes, never partial nodes, and scale-out is gated by Azure quota approval for the chosen SKU in that region.

AHV VLAN to Azure mapping

AHV VLANs on NC2 map onto Azure VNet and subnet constructs, so guest traffic is filtered by Azure NSGs and routed by UDRs like any Azure workload.

NC2 service principal RBAC

Deploying NC2 requires registering the service in the Azure subscription and granting its service principal RBAC roles on the target resource group so it can manage BareMetal hosts.

Usable capacity with RF

AOS replicates data across nodes at replication factor 2 or 3, so usable capacity is roughly raw NVMe capacity divided by RF, minus metadata and reserved overhead.

Hub-and-spoke for NC2

NC2 clusters typically sit in a spoke VNet peered to a hub that holds ExpressRoute or VPN Gateway, because VNet peering is non-transitive and gateways live in the hub.

NSG enforcement point

Azure NSGs attach at subnet or NIC level and are the primary Layer 3/4 filter for NC2 guest traffic, since AHV VLANs are realized as Azure subnets.

UDR forced tunneling

A user-defined route on the NC2 subnet pointing the default or specific prefixes at an NVA private IP forces guest traffic through firewall inspection.

Entra ID for Prism

Prism can federate with Microsoft Entra ID via SAML or OIDC, and directory groups are mapped to Prism roles so access follows identity lifecycle automatically.

Azure Bastion for NC2 guests

Azure Bastion provides RDP and SSH to NC2 guest VMs through the portal without public IPs, avoiding exposure of management interfaces to the internet.

Two separate RBAC planes

Azure RBAC controls what the NC2 service principal can do to Azure resources; Prism RBAC controls who operates clusters and VMs. They are independent and both must be governed.

Private DNS for PaaS

Guest VMs on NC2 resolve Azure PaaS private endpoints only if the matching Private DNS zones are linked to the NC2 VNet and the VNet uses Azure or custom DNS.

Single Prism Central across sites

One Prism Central can register both on-premises and NC2 clusters, providing unified inventory, shared categories, and one set of protection policies across sites.

Calm multi-cluster blueprints

Nutanix Calm blueprints deploy the same multi-tier application to on-premises AHV or NC2 AHV by changing the target cluster in the project configuration.

Nutanix Flow microsegmentation

Flow policies defined in Prism Central apply to NC2 guest VMs and enforce east-west rules inside AHV, complementing Azure NSGs which cannot see intra-VLAN traffic.

LCM version constraints on NC2

Life Cycle Manager performs AOS, AHV, and firmware updates, but NC2 only supports specific AOS releases, so verify the supported matrix before upgrading.

Dual monitoring planes

Prism health checks and alerts cover the Nutanix stack, while Azure Monitor and Log Analytics cover BareMetal hosts and networking; correlate both for full-stack visibility.

Nutanix Move cutover

Move performs pre-checks, an initial bulk sync, and a final incremental sync at cutover, then powers off the source and starts the target VM with minimal downtime.

Protection policy by category

Prism Central protection policies attach replication schedules and retention to VMs by category, so new VMs inherit DR settings automatically when categorized.

Recovery plan orchestration

Recovery plans define VM boot order, IP address changes, and scripts executed at failover, and test failover validates the plan in an isolated network without disrupting replication.

RPO from replication interval

Recovery point objective equals the protection policy's replication frequency; a one-hour schedule permits up to one hour of data loss on an unplanned failover.

RTO composition

Recovery time objective is detection time plus recovery plan execution plus VM boot and post-boot validation, so automation reduces but never eliminates boot latency.

Planned versus unplanned failover

Planned failover performs a final sync and powers off the source for near-zero loss; unplanned failover restarts VMs from the last replicated snapshot at the target site.

Cross-region NC2 DR

NC2 clusters are region-scoped, so disaster recovery to another Azure region requires a second NC2 cluster with pre-provisioned capacity and matching networking constructs.

Move agentless versus agent

Agentless migration uses source hypervisor APIs for VMware and Hyper-V, while agent-based migration installs into the guest OS to support broader source platforms.

Azure Policy guardrails

Azure Policy enforces allowed regions, required tags, and denied resource types on the subscription hosting NC2, preventing configuration drift from approved deployment standards.

Management group inheritance

Management groups sit above subscriptions and cascade RBAC and Azure Policy downward, so placing NC2 subscriptions in a dedicated group yields uniform governance.

Defender coverage boundary

Microsoft Defender for Cloud assesses posture and detects threats on Azure resources underlying NC2, but it cannot inspect activity inside AHV guest operating systems.

BareMetal billing behavior

NC2 node hours accrue while the cluster exists regardless of guest VM power state, so idle clusters must be deleted or scaled down to stop compute charges.

NC2 cost tagging

Tagging the NC2 resource group with cost center, environment, and owner enables Azure Cost Management budgets and alerts scoped precisely to the cluster's spend.

Least privilege for NC2 principal

Scoping the NC2 service principal to the minimum RBAC roles on the specific resource group, rather than subscription Owner, limits blast radius if credentials are misused.