I85PREP
⌘ K
Nutanix NCP-CI-Azure study materials
Nutanix NCP-CI-Azure study resources

Nutanix NCP-CI-Azure practice questions

One question at a time. Build your Nutanix NCP-CI-Azure understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

In an NC2 on Azure deployment, which component provides the connection path between the customer's on-premises network and the NC2 cluster's VNet?

  1. A site-to-site VPN or ExpressRoute connection Correct answer.
  2. A NAT gateway in the cluster subnet
  3. An Azure Front Door profile
  4. A public IP address on each CVMs

Explanation

NC2 on Azure requires private connectivity between on-premises environments and the Azure VNet hosting the cluster. This is delivered through a site-to-site VPN gateway or Azure ExpressRoute, depending on bandwidth and latency requirements.

Question 2Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure construct directly hosts the Nutanix Controller VMs and the Prism Central VM in an NC2 deployment?

  1. An Azure Blob storage container
  2. An Azure SQL managed instance
  3. An Azure Kubernetes Service node pool
  4. An Azure virtual network subnet Correct answer.

Explanation

The NC2 cluster runs as Azure virtual machines inside a delegated subnet of a customer VNet. Controller VMs and Prism Central are deployed as Azure VMs in that subnet, consuming the VNet's addressing and NSG rules.

Question 3Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An administrator wants the NC2 cluster's management traffic reachable only from the corporate network. Which Azure feature should be applied to the cluster subnet to enforce this?

  1. Azure Policy deny assignments on the subscription
  2. Network security group rules restricting inbound sources Correct answer.
  3. Resource locks on the VNet
  4. Service endpoints on the storage account

Explanation

Network security groups filter traffic at the subnet and NIC level, so inbound rules can limit management access to corporate CIDR ranges. Azure Policy, locks, and service endpoints govern configuration or PaaS access rather than packet filtering.

Question 4Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

What is the role of Prism Central in an NC2 on Azure environment?

  1. It replaces the Azure load balancer for cluster traffic
  2. It terminates the site-to-site VPN tunnel
  3. It stores the cluster's data at rest in Azure Blob
  4. It provides centralized management across one or more NC2 clusters Correct answer.

Explanation

Prism Central is the multicluster management plane that provides a single pane for managing registered NC2 clusters and their workloads. It does not perform data-plane storage or VPN termination functions.

Question 5Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure resource must exist before the NC2 deployment process can place controller VMs into the target network?

  1. A Log Analytics workspace
  2. A virtual network with a delegated subnet Correct answer.
  3. An Azure Container Registry
  4. An Azure Bastion host

Explanation

NC2 deployment provisions VMs into a subnet of a customer VNet, so the VNet and an appropriately sized subnet must be prepared in advance. Container Registry, Log Analytics, and Bastion are optional supporting services, not prerequisites for placement.

Question 6Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure construct is used to give the NC2 cluster outbound internet access for software updates without assigning public IPs to each VM?

  1. A public IP on the Prism Central VM only
  2. A private endpoint to Azure Update Manager
  3. A NAT gateway attached to the cluster subnet Correct answer.
  4. An internal load balancer with a floating IP

Explanation

A NAT gateway provides scalable source network address translation for outbound traffic from a subnet, so VMs can reach the internet without individual public IPs. Internal load balancers and private endpoints do not provide general outbound internet access.

Question 7Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

During NC2 deployment, the administrator must supply an Azure service principal. What is this principal used for?

  1. Encrypting data at rest on the cluster's storage disks
  2. Establishing the IPsec tunnel to on-premises
  3. Authenticating Prism users through Microsoft Entra ID
  4. Granting NC2 permission to create and manage Azure resources in the subscription Correct answer.

Explanation

NC2 uses an Azure service principal with a role assignment so the platform can provision and manage the Azure resources that make up the cluster. It is an automation identity for resource management, not a user directory or encryption key.

Question 8Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

A team needs the NC2 cluster VMs to resolve on-premises DNS names. Which configuration achieves this?

  1. Enable Azure DNS private zones for the cluster subnet only
  2. Set the VNet DNS servers to the on-premises DNS servers reachable over the hybrid link Correct answer.
  3. Configure Prism Central as the DNS forwarder for Azure
  4. Assign public DNS servers to each CVM

Explanation

Azure VNets allow custom DNS servers, so pointing the VNet at on-premises resolvers reachable over VPN or ExpressRoute lets cluster VMs resolve internal names. Public resolvers and Prism Central do not provide on-premises name resolution.

Question 9Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which statement best describes how NC2 on Azure consumes Azure compute capacity?

  1. It uses Azure Spot VMs exclusively to reduce cost
  2. It deploys onto Azure VMware Solution hosts
  3. It runs on dedicated bare-metal hosts provisioned by Nutanix
  4. It runs Nutanix software on Azure VMs sized from supported instance types Correct answer.

Explanation

NC2 on Azure is delivered as Nutanix software running on Azure virtual machines chosen from supported instance families. It does not require bare-metal hosts, Spot-only capacity, or Azure VMware Solution infrastructure.

Question 10Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An administrator is sizing the cluster subnet in Azure. Which consideration is most important for the subnet address range?

  1. It must be exactly a /24 because NC2 requires that prefix
  2. It must not overlap with any Azure DNS private zone
  3. It must be a public range routable from the internet
  4. It must accommodate all cluster VMs plus room for growth and Azure-reserved addresses Correct answer.

Explanation

The subnet must hold every controller VM, Prism Central, and any additional VMs, while Azure reserves several addresses per subnet. Planning for growth avoids later re-IP or redeployment work.

Question 11Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure feature allows an NC2 cluster in one region to be paired with a recovery VNet in another region for disaster recovery planning?

  1. Availability sets within a single datacenter
  2. A single VNet spanning both regions
  3. Azure DNS private resolver
  4. Region pairing with replicated VNets and gateways Correct answer.

Explanation

Azure regional pairing and replicated networking constructs let teams design cross-region recovery for NC2 environments. A single VNet cannot span regions, and availability sets are confined to one datacenter.

Question 12Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

What does the NC2 deployment require regarding the Azure subscription role assigned to the deploying user or principal?

  1. Owner on every subscription in the tenant
  2. Global Administrator in Microsoft Entra ID
  3. Reader on the target resource group only
  4. Sufficient permissions such as Contributor on the target subscription or resource group Correct answer.

Explanation

Deployment needs to create and configure resources, so a role like Contributor scoped to the subscription or resource group is sufficient. Tenant-wide directory roles and Owner on all subscriptions exceed what is required.

Question 13Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which statement about the relationship between an NC2 cluster and its Azure resource group is accurate?

  1. Each CVM must be placed in its own resource group
  2. Cluster Azure resources are organized within the resource group chosen at deployment Correct answer.
  3. Resource groups are global and not tied to a region
  4. The resource group must be empty and cannot contain other resources

Explanation

Deployment targets a resource group that holds the cluster's Azure resources, simplifying lifecycle and RBAC management. Resource groups are region-associated metadata containers and may hold other resources.

Question 14Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

A security team requires that all traffic between the on-premises datacenter and the NC2 cluster stay off the public internet. Which connectivity choice satisfies this?

  1. A site-to-site VPN over the internet
  2. Public IPs with NSG allow-listing
  3. Azure ExpressRoute with private peering Correct answer.
  4. Azure Bastion to each CVM

Explanation

ExpressRoute private peering carries traffic over a dedicated private circuit rather than the public internet. Internet-based VPN, Bastion, and public IPs all traverse public infrastructure.

Question 15Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

What is the purpose of registering an NC2 cluster with Prism Central?

  1. To enable centralized management, RBAC, and cross-cluster operations Correct answer.
  2. To obtain a public IP for the cluster
  3. To convert the cluster to a single-node deployment
  4. To attach Azure managed disks to the cluster

Explanation

Registering a cluster with Prism Central brings it under a common management plane for policies, roles, and multicluster visibility. It does not change disk attachment, addressing, or cluster node count.

Question 16Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An administrator observes that NC2 cluster VMs cannot reach the internet even though a NAT gateway exists. Which misconfiguration is the most likely cause?

  1. The NSG has an outbound allow rule
  2. The VNet has too many address spaces
  3. The cluster subnet is not associated with the NAT gateway Correct answer.
  4. Prism Central is not registered

Explanation

A NAT gateway only provides egress for subnets explicitly associated with it, so an unassociated cluster subnet will lack outbound connectivity. Address space count, Prism registration, and allow rules do not block egress in this scenario.

Question 17Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which factor most directly determines the maximum usable capacity of an NC2 on Azure cluster?

  1. The count of NSG rules attached to the subnet
  2. The number of Prism Central VMs deployed
  3. The number and size of storage-bearing Azure VM instances in the cluster Correct answer.
  4. The size of the Azure Bastion subnet

Explanation

Capacity derives from the storage contributed by the cluster's storage-bearing VM instances and their attached disks. Prism Central count, Bastion sizing, and NSG rule counts do not contribute usable cluster capacity.

Question 18Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Two NC2 clusters in different Azure regions must be managed from a single Prism Central. What must be true of the network design?

  1. Routing must allow the clusters and Prism Central to communicate over private addressing Correct answer.
  2. Prism Central must be deployed in an Azure public zone
  3. Both clusters must share the same subnet CIDR
  4. Both clusters must be in the same Azure tenant region

Explanation

A single Prism Central managing clusters across regions requires IP reachability between them, typically over VNet peering or a hub-and-spoke design. Overlapping or identical subnets would break routing, and Prism Central does not need public exposure.

Question 19Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure capability provides private, low-latency connectivity between the NC2 cluster VNet and other VNets in the same organization without a VPN gateway?

  1. Virtual network peering Correct answer.
  2. Public IP prefix
  3. Azure Firewall Premium
  4. Azure Traffic Manager

Explanation

VNet peering connects virtual networks over the Azure backbone with low latency and no gateway requirement. Traffic Manager is DNS-based distribution, Firewall is a security appliance, and public IP prefixes allocate addresses.

Question 20Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An architect must ensure NC2 cluster management traffic survives the loss of a single Azure availability zone. Which design element is most relevant?

  1. Spreading cluster VMs across availability zones where supported Correct answer.
  2. Relying on Azure DNS default resolution
  3. Placing all CVMs in one availability set
  4. Using a single NAT gateway in one zone

Explanation

Zone-aware placement distributes VMs across physically separate datacenters within a region, improving resilience to a zone failure. A single availability set or single-zone gateway remains vulnerable to zone loss.

Question 21Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which statement about the Azure VNet used by an NC2 cluster is correct?

  1. It must be an Azure Virtual WAN hub by default
  2. It is automatically peered to Microsoft's management VNet
  3. It is owned and managed by the customer within their subscription Correct answer.
  4. It is created and owned by Nutanix in a Nutanix subscription

Explanation

NC2 deploys into customer-owned Azure networking, so the VNet, subnets, and related rules remain under the customer's control. It is not provisioned in a Nutanix subscription or auto-peered to a Microsoft management network.

Question 22Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure service is commonly used to provide private, browser-based administrative access to NC2 VMs without exposing public IPs?

  1. Azure CDN
  2. Azure Bastion Correct answer.
  3. Azure Front Door
  4. Azure DDoS Protection

Explanation

Azure Bastion provides RDP and SSH access through the Azure portal over a private connection, avoiding public IPs on VMs. Front Door and CDN are HTTP delivery services, and DDoS Protection mitigates attacks rather than providing access.

Question 23Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

What is the primary reason NC2 on Azure deployments require careful CIDR planning before provisioning?

  1. Prism Central requires a public CIDR block
  2. NSG rules cannot be changed after deployment
  3. Overlapping address spaces break routing between the cluster and connected networks Correct answer.
  4. Azure charges more for larger subnets

Explanation

Overlapping CIDRs between the cluster VNet and on-premises or peered networks cause routing ambiguity and failed connectivity that is costly to remediate. Pricing, public addressing, and NSG immutability are not the drivers.

Question 24Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure resource provides the private IP endpoint that on-premises systems use to reach Prism Central when no public exposure is allowed?

  1. The Prism Central VM's private IP in the cluster subnet Correct answer.
  2. An Azure Front Door endpoint
  3. A storage account private endpoint
  4. An Azure public IP with a DNS label

Explanation

Prism Central is reachable through its private IP within the VNet, which is advertised to on-premises over VPN or ExpressRoute. Public IPs, Front Door, and storage private endpoints do not serve this management purpose.

Question 25Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

A team wants to validate that NC2 cluster VMs can reach an on-premises service after deployment. Which approach directly confirms routing and name resolution together?

  1. Verify the NSG has a default deny rule
  2. Check that the VNet has at least two address spaces
  3. Confirm Prism Central shows the cluster as registered
  4. Resolve the service's FQDN and connect to it from a CVM Correct answer.

Explanation

Resolving the FQDN and completing a connection from a cluster VM exercises both DNS and routing end to end. Address space count, registration status, and NSG defaults do not demonstrate reachability to the service.

Question 26Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

In an NC2 on Azure deployment, which Azure resource type hosts the Nutanix Controller VM (CVM) and user VMs that make up the cluster?

  1. Azure SQL managed instances
  2. Azure App Service plans
  3. Azure Container Apps environments
  4. Azure virtual machines Correct answer.

Explanation

NC2 runs the Nutanix software stack on Azure infrastructure as a service, so each node is an Azure virtual machine that hosts a Controller VM and user VMs. App Service, SQL managed instances, and Container Apps are managed platform services that cannot host the Nutanix CVM.

Question 27Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure disk type should an administrator select for NC2 cluster nodes when low-latency, high-IOPS storage for the Nutanix distributed storage fabric is the priority?

  1. Archive-tier blob storage
  2. Standard HDD
  3. Premium SSD or Ultra Disk Correct answer.
  4. Cool-tier blob storage

Explanation

The Nutanix distributed storage fabric performs best on low-latency SSD-backed disks, which in Azure means Premium SSD or Ultra Disk depending on the VM series. HDD and blob tiers are object or archival storage and are not suitable as local data disks for the cluster.

Question 28Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An NC2 cluster must be deployed into an Azure region. What must exist in the target subscription before deployment begins?

  1. A VNet with a subnet sized for the cluster and its gateways Correct answer.
  2. A site-to-site VPN gateway in every region
  3. A pre-created Azure Kubernetes Service cluster
  4. An ExpressRoute circuit owned by Nutanix

Explanation

NC2 deployment consumes an existing Azure VNet and subnet, so the network must be planned and created before provisioning. AKS, Nutanix-owned ExpressRoute circuits, and per-region VPN gateways are not prerequisites for a basic deployment.

Question 29Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure construct gives the NC2 cluster a stable private address inside the VNet that other workloads use for management access?

  1. An Azure Front Door endpoint
  2. A Traffic Manager profile
  3. A subnet delegated to the cluster with private IP addressing Correct answer.
  4. A public IP address with a DNS label

Explanation

Cluster management endpoints such as Prism Element and Prism Central receive private IP addresses from the cluster subnet, so peers reach them over the VNet or connected networks. Public IPs, Front Door, and Traffic Manager are internet-facing or global routing constructs, not the private addressing mechanism.

Question 30Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure feature must be enabled on the cluster subnet so that NC2 nodes can resolve Azure private DNS zone records?

  1. Attach a public DNS zone to the subscription
  2. Link the private DNS zone to the cluster VNet Correct answer.
  3. Configure the VNet peering with DNS forwarding disabled
  4. Enable Azure DNS Private Resolver in every subnet

Explanation

Azure private DNS zones resolve only for VNets that are linked to the zone, so the cluster VNet must have a virtual network link. Public zones, resolver placement, and peering DNS settings do not by themselves make private zone records resolvable.

Question 31Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

What role does the Azure network security group play for an NC2 cluster subnet?

  1. It assigns private IP addresses to cluster nodes
  2. It filters inbound and outbound traffic to and from cluster nodes Correct answer.
  3. It encrypts traffic between cluster nodes
  4. It load balances management traffic across nodes

Explanation

A network security group applies allow and deny rules to traffic entering and leaving subnets and network interfaces, which is how administrators restrict access to NC2 management and data paths. IP assignment, encryption, and load balancing are handled by other Azure or Nutanix mechanisms.

Question 32Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which statement describes how an NC2 cluster scales out to add capacity?

  1. Additional Azure VMs are added as new cluster nodes within the same VNet Correct answer.
  2. A second independent cluster is created and merged into Prism Element
  3. The existing nodes are resized to larger VM SKUs only
  4. Azure automatically adds disks to the storage pool without new VMs

Explanation

NC2 scale-out means provisioning more Azure VM nodes into the cluster, which join the existing Prism Element and contribute compute and storage. Resizing alone is vertical scaling, clusters are not merged this way, and Azure does not autonomously extend the Nutanix storage pool.

Question 33Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure component is required so that an NC2 cluster's management interfaces can be reached from an on-premises network over a private path?

  1. A NAT gateway attached to the cluster subnet
  2. An Azure Bastion host in the cluster subnet
  3. A VPN gateway or ExpressRoute connection into the cluster VNet Correct answer.
  4. A public IP address on each Controller VM

Explanation

Private hybrid reachability requires a VPN gateway or ExpressRoute circuit connected to the cluster VNet, with routing and firewall rules permitting the flows. Public IPs, Bastion, and NAT gateways address internet or jump-host access rather than private site-to-site connectivity.

Question 34Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An administrator is choosing an Azure VM series for NC2 cluster nodes. Which requirement most directly constrains the choice?

  1. The series must support nested virtualization for Hyper-V
  2. The series must include a GPU for Prism Central
  3. The series must support the number and type of data disks Nutanix requires Correct answer.
  4. The series must be available in the free tier

Explanation

NC2 nodes need sufficient local data disks of the right type and throughput to back the Nutanix storage fabric, so disk support is a primary constraint on VM series selection. GPUs, free-tier eligibility, and nested Hyper-V are not general requirements for NC2.

Question 35Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

A deployment fails because the chosen cluster subnet overlaps with an on-premises network reachable over ExpressRoute. What is the correct remediation?

  1. Disable ExpressRoute during deployment and re-enable it afterward
  2. Convert the cluster subnet to an IPv6-only range
  3. Add a NAT gateway to translate the overlapping addresses
  4. Redeploy using a non-overlapping subnet and update routing accordingly Correct answer.

Explanation

Overlapping address space breaks routing between Azure and on-premises networks, so the cluster must use a CIDR that does not conflict with any connected network. Disabling ExpressRoute, NAT translation, or IPv6 conversion does not resolve the underlying overlap for a production design.

Question 36Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

A security policy forbids management access to NC2 from the internet. Which combination best satisfies this while allowing administrator access?

  1. Place the cluster in a public subnet and use Azure Firewall DNAT
  2. Allow only port 443 from any source and rely on strong passwords
  3. Expose Prism Central through a public load balancer with TLS
  4. Restrict the NSG to administrator source ranges over VPN or ExpressRoute Correct answer.

Explanation

Limiting NSG rules to known administrator source ranges reached through private connectivity keeps management traffic off the public internet. Broad 443 access, public subnet DNAT, and public load balancers all expose management endpoints.

Question 37Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An NC2 cluster must send syslog to a SIEM hosted in a different VNet in the same region. Which Azure capability provides private connectivity without internet traversal?

  1. A NAT gateway on the cluster subnet
  2. Azure DNS private zones
  3. VNet peering between the cluster VNet and the SIEM VNet Correct answer.
  4. A public IP address on each CVM

Explanation

VNet peering connects the two VNets over the Azure backbone so traffic stays private and does not traverse the internet. NAT gateways handle outbound internet, DNS zones resolve names, and public IPs expose endpoints rather than provide private VNet-to-VNet paths.

Question 38Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

After deployment, administrators notice Prism Element is reachable but user VMs cannot reach an on-premises database. Which troubleshooting step is most direct?

  1. Re-register the cluster with Prism Central
  2. Verify routing and NSG rules between the cluster subnet and the on-premises prefix Correct answer.
  3. Replace the CVM disks with Premium SSD
  4. Rebuild the cluster with a larger subnet

Explanation

When management works but a specific workload path fails, the likely cause is routing or NSG filtering for the destination prefix. Subnet size, disk type, and Prism Central registration do not affect whether user VM traffic reaches an on-premises database.

Question 39Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which design choice best protects an NC2 cluster from the failure of a single Azure fault domain within a region?

  1. Use a single node with Premium SSD storage
  2. Distribute cluster nodes across availability zones where the region supports them Correct answer.
  3. Place all nodes in one availability set with two fault domains
  4. Attach all nodes to one NAT gateway

Explanation

Spreading nodes across availability zones places them in separate physical fault domains, so a zone failure does not take down the whole cluster. A single availability set, a single node, or a shared NAT gateway does not provide equivalent zone-level resilience.

Question 40Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An architect wants cluster management traffic to remain available if one Azure availability zone is lost. Which design element is essential?

  1. A site-to-site VPN terminating in a single zone
  2. A single Prism Element VM in one zone with a public IP
  3. Prism Central and management endpoints placed on nodes spread across zones with load balancing Correct answer.
  4. One NAT gateway in the primary zone only

Explanation

Zone-resilient management requires the management roles to run on nodes distributed across zones and be fronted by load balancing so traffic fails over. Single-zone Prism Element, NAT, or VPN endpoints remain single points of failure.

Question 41Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which Azure resource is used to distribute inbound management connections across multiple Prism Element CVMs in an NC2 cluster?

  1. A network security group
  2. An internal Azure Load Balancer Correct answer.
  3. An Azure NAT gateway
  4. An Azure private DNS zone

Explanation

An internal load balancer provides a single private front-end address and distributes connections across healthy backend CVMs. NAT gateways are outbound-only, DNS zones resolve names, and NSGs filter rather than balance traffic.

Question 42Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

A team wants to connect an NC2 cluster VNet to a hub VNet that already holds shared services. Which topology is the standard Azure recommendation?

  1. Full mesh peering between every workload VNet
  2. Public IP connectivity between the VNets
  3. Hub-and-spoke peering with the cluster VNet as a spoke Correct answer.
  4. A single flat VNet shared by all workloads

Explanation

Hub-and-spoke peering centralizes shared services and connectivity in the hub while keeping the cluster in a spoke VNet. Full mesh, a single flat VNet, and public IP connectivity increase blast radius, address pressure, or exposure.

Question 43Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which statement about the Azure region and the NC2 cluster is accurate?

  1. Nodes can be spread across multiple Azure regions in a single cluster
  2. The cluster region is selected automatically by Prism Central
  3. All cluster nodes reside in one Azure region chosen at deployment Correct answer.
  4. The cluster spans regions only when ExpressRoute is present

Explanation

An NC2 cluster is deployed into a single Azure region, and its nodes and VNet reside there. Cross-region resilience is achieved with separate clusters and replication rather than by stretching one cluster across regions.

Question 44Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An administrator needs to confirm that NC2 node VMs are using the intended accelerated networking feature. Which check is most appropriate?

  1. Inspect the network interface configuration of each cluster VM in the Azure portal Correct answer.
  2. Check the Azure subscription spending limit
  3. Verify the size of the cluster subnet
  4. Review the Prism Central task log for deployment warnings

Explanation

Accelerated networking is a property of the VM network interface, so reviewing NIC settings in Azure confirms whether it is enabled. Task logs, spending limits, and subnet size do not report NIC feature state.

Question 45Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Which consideration most affects the choice of Azure VM size for NC2 nodes when the workload is storage-heavy?

  1. The number of public IP addresses allowed
  2. The maximum number of data disks and aggregate disk throughput supported Correct answer.
  3. The availability of the free tier
  4. The default outbound access setting

Explanation

Storage-heavy workloads depend on how many data disks a VM size supports and the aggregate throughput those disks provide, since the Nutanix storage fabric is built on them. Public IP counts, free-tier status, and outbound defaults do not determine storage capability.

Question 46Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

A candidate design places Prism Central on the same three nodes that serve production user VMs. What is the main risk?

  1. The cluster loses its Azure resource group association
  2. Management availability competes with and depends on production workload health Correct answer.
  3. Prism Central cannot run on nodes that host user VMs
  4. Storage deduplication is disabled automatically

Explanation

Co-locating Prism Central with production workloads means management availability shares fate and resources with those workloads, which is why many designs separate them. Prism Central can run on cluster nodes, and resource group association and deduplication are unaffected.

Question 47Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

Two subnets in the cluster VNet must exchange traffic, but an NSG denies it. Which action resolves the issue while preserving least privilege?

  1. Remove the NSG from both subnets
  2. Add an allow-any rule for all protocols
  3. Add an explicit allow rule scoped to the required ports and source prefixes Correct answer.
  4. Move both subnets into the same NSG with default rules

Explanation

Least privilege means adding a narrowly scoped allow rule for the specific ports and sources required. Removing the NSG, allowing all protocols, or relying on default rules either removes protection or fails to permit the needed traffic.

Question 48Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An NC2 cluster must reach Azure Blob storage privately for backups. Which configuration achieves this?

  1. A NAT gateway on the cluster subnet
  2. An NSG rule allowing port 443 to all destinations
  3. A public IP address on the storage account
  4. A private endpoint for the storage account in the cluster VNet with matching DNS Correct answer.

Explanation

A private endpoint places the storage account on a private IP inside the VNet, and private DNS ensures the storage hostname resolves to that endpoint. NAT, public IPs, and broad NSG rules keep traffic on the public path or fail to resolve privately.

Question 49Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

During a scale-out, a new node is added to the cluster subnet but cannot join Prism Element. Which cause is most consistent with an NC2 networking design error?

  1. The new node is in the same availability zone as an existing node
  2. The NSG or firewall blocks the CVM-to-CVM ports required for cluster formation Correct answer.
  3. The new node uses Premium SSD instead of Ultra Disk
  4. The cluster subnet has more free addresses than needed

Explanation

Cluster formation depends on CVM-to-CVM communication over specific ports, so filtering between nodes prevents a new node from joining. Disk SKU differences, spare addresses, and shared availability zones do not block cluster join.

Question 50Nutanix Cloud Clusters (NC2) on Azure: architecture, deployment, and networking

An architect must decide between a single large cluster and two smaller clusters across two Azure regions for disaster recovery. Which reasoning is most sound?

  1. A single large cluster is preferred because it spans regions natively
  2. Two clusters are unnecessary because Azure zone redundancy replaces regional DR
  3. Two regional clusters with replication provide DR because one cluster cannot span regions Correct answer.
  4. A single cluster is preferred because Prism Central cannot manage two clusters

Explanation

Because an NC2 cluster is confined to one region, regional disaster recovery requires separate clusters with replication between them. A single cluster cannot span regions, zone redundancy does not cover regional loss, and Prism Central can manage multiple clusters.