I85PREP
⌘ K
Nutanix NCP-CI-Azure study materials
Nutanix NCP-CI-Azure study resources

Nutanix NCP-CI-Azure: Security, Governance, and Cost Management in Azure Deployments

Nutanix NCP-CI-Azure · Work through your exam, one topic at a time.

All guide sections

Security, Governance, and Cost Management in Azure Deployments

Domain 5: Security, governance, and cost management in Azure deployments

This domain tests hardening NC2, applying Azure governance, and avoiding the cost traps of dedicated bare-metal.

Security controls

  • Apply least privilege to the NC2 service principal; scope it to the subscription/resource group it needs, and rotate credentials.
  • Use NSGs and Azure Firewall for north-south traffic; use Nutanix Flow for east-west microsegmentation inside AHV. Azure NSGs do not inspect intra-cluster AHV traffic.
  • Harden Prism with AD/LDAP, SAML SSO, RBAC, strong password policy, and restricted management access (Bastion/private endpoints rather than public IPs).
  • Encrypt data at rest with AOS encryption/self-encrypting drives and protect keys; Azure Disk Encryption does not cover AHV guest virtual disks.

Governance

  • Use Azure Policy, resource locks, and tags on the NC2 resource group for cost allocation and guardrails. Tags on Azure resources do not automatically become Prism categories.
  • Separate dev/test and production subscriptions or resource groups; enforce naming and network segmentation.

Cost management

  • NC2 bare-metal nodes bill while allocated. You generally cannot "stop" a bare-metal cluster like an Azure VM to pause compute cost; delete the cluster when unused.
  • Right-size node count and storage runway; overprovisioning for peak forever is expensive. Check Marketplace terms for committed-use or reserved options rather than assuming Azure VM reservations apply.
  • Watch egress and ExpressRoute/VPN costs for replication and backups.

Worked example

A team leaves a three-node NC2 cluster idle for a month to "keep it ready." The nodes still bill. If the data fits in snapshots and can be rebuilt, delete the cluster and redeploy later; if not, replicate to a smaller target and document recovery time.

Traps

Assuming NSGs microsegment AHV east-west traffic; using Azure Backup for guest VMs; granting Owner to the service principal; forgetting that idle bare-metal still costs; treating Azure tags as Prism categories.