I85PREP
⌘ K
NCP-MCA study materials
NCP-MCA study resources

NCP-MCA practice questions

One question at a time. Build your NCP-MCA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Automation Fundamentals and Prism Central Automation Concepts

In Nutanix Prism Central automation, what is the primary role of a Playbook?

  1. A catalog item that provisions infrastructure from a static blueprint
  2. A backup policy that defines retention for protected VMs
  3. A dashboard widget that visualizes cluster capacity trends
  4. An automated workflow that runs a sequence of actions triggered by events or schedules Correct answer.

Explanation

Playbooks in Prism Central are workflow definitions that chain actions together and are launched by triggers such as alerts, events, schedules, or manual initiation. They orchestrate remediation and operational tasks rather than just displaying data or defining static blueprints.

Question 2Automation Fundamentals and Prism Central Automation Concepts

Which Prism Central capability lets end users request pre-approved VM configurations through a self-service catalog?

  1. Flow Network Security
  2. Self-Service Blueprints Correct answer.
  3. Prism Central Reports
  4. LCM Inventory

Explanation

Self-Service Blueprints define approved VM templates and deployment settings that end users consume through a catalog, enforcing standards without manual admin effort. The other options address security policy, reporting, and lifecycle updates.

Question 3Automation Fundamentals and Prism Central Automation Concepts

What does an alert trigger in a Prism Central Playbook do?

  1. It converts the alert into a support ticket in the vendor portal
  2. It suppresses the alert permanently across all clusters
  3. It schedules a one-time snapshot of the affected VM
  4. It starts the playbook automatically when a matching alert condition is raised Correct answer.

Explanation

An alert-based trigger evaluates incoming alerts against configured criteria and launches the associated playbook when a match occurs. This enables automated remediation such as restarting services or notifying owners. It does not silence alerts or create external tickets on its own.

Question 4Automation Fundamentals and Prism Central Automation Concepts

In Prism Central, what is the purpose of a category applied to VMs?

  1. It provides a key-value label used for policy scoping and automation targeting Correct answer.
  2. It determines which storage container the VM uses
  3. It assigns a static IP address to the VM
  4. It sets the CPU reservation for the VM

Explanation

Categories are key-value pairs attached to entities such as VMs, and automation and security policies use them to select the objects they apply to. This makes categories the primary scoping mechanism for Playbooks, blueprints, and Flow policies.

Question 5Automation Fundamentals and Prism Central Automation Concepts

Which component of Nutanix Flow is responsible for enforcing microsegmentation rules on traffic between VMs?

  1. The LCM framework
  2. The Prism Central task manager
  3. The distributed firewall on each host Correct answer.
  4. The Self-Service catalog

Explanation

Flow security policies are enforced by a distributed firewall that runs on each host, allowing rules to be applied close to the workloads. Prism Central provides the management plane where policies are defined, but enforcement happens at the host level.

Question 6Automation Fundamentals and Prism Central Automation Concepts

What is the function of a runbook in the context of Nutanix automation?

  1. A hardware compatibility list for supported nodes
  2. A documented procedure that can be executed as an automated workflow Correct answer.
  3. A licensing tier for Prism Central
  4. A snapshot retention schedule

Explanation

A runbook captures a repeatable operational procedure so it can be executed consistently, and in Prism Central it can be codified as an automated workflow. This reduces manual steps and human error during routine operations.

Question 7Automation Fundamentals and Prism Central Automation Concepts

Which Prism Central feature provides a single inventory view across multiple registered clusters?

  1. Nutanix Move
  2. Prism Central multi-cluster management Correct answer.
  3. Prism Element
  4. Nutanix Files

Explanation

Prism Central registers multiple Prism Element clusters and presents a consolidated inventory and management view across them. Prism Element manages a single cluster, while Move and Files address migration and file services respectively.

Question 8Automation Fundamentals and Prism Central Automation Concepts

What distinguishes a manual trigger from a scheduled trigger in a Prism Central Playbook?

  1. A manual trigger requires a user to start the playbook on demand Correct answer.
  2. A manual trigger runs only on a fixed cron expression
  3. A manual trigger fires only when an alert is resolved
  4. A manual trigger executes only during maintenance windows

Explanation

A manual trigger means the playbook is started explicitly by a user, typically through the interface or an API call. Scheduled triggers use time-based definitions, and alert triggers respond to monitored conditions.

Question 9Automation Fundamentals and Prism Central Automation Concepts

An administrator wants a Playbook to run only against VMs tagged with the category Environment:Production. Where should this restriction be configured?

  1. In the cluster time zone configuration
  2. In the Prism Central SMTP server settings
  3. In the playbook trigger or action target selection using the category filter Correct answer.
  4. In the alert policy severity mapping

Explanation

Playbooks select the entities they act on through category filters applied to targets, so scoping to Environment:Production is done there. Trigger conditions decide when the playbook runs, but target selection determines which VMs are affected.

Question 10Automation Fundamentals and Prism Central Automation Concepts

A team needs a Playbook that restarts a service whenever a specific alert fires, then posts a summary to a chat channel. Which combination of playbook elements is required?

  1. A manual trigger plus a category deletion
  2. A report subscription plus an LCM update
  3. An alert trigger plus actions for the restart and the notification Correct answer.
  4. A scheduled trigger plus a blueprint deployment

Explanation

The alert trigger starts the workflow when the condition is detected, and the playbook actions perform the restart and send the notification. Each desired outcome maps to an action executed in sequence after the trigger fires.

Question 11Automation Fundamentals and Prism Central Automation Concepts

When designing a self-service blueprint, which element defines the values an end user may choose, such as memory size or image?

  1. The cluster's replication factor
  2. The Flow policy priority
  3. The Prism Central backup schedule
  4. The blueprint's input parameters exposed in the catalog form Correct answer.

Explanation

Blueprint input parameters are surfaced to end users as catalog form fields, letting them supply approved values within defined constraints. This balances self-service flexibility with administrative guardrails.

Question 12Automation Fundamentals and Prism Central Automation Concepts

An operator builds a Flow policy to allow only web-tier VMs to reach database-tier VMs on port 1433. Which scoping construct should select the source and destination VMs?

  1. VM names matched with wildcards
  2. Categories assigned to the VMs Correct answer.
  3. Cluster names
  4. IP addresses entered manually

Explanation

Flow policies use categories to define source and destination groups, so policies follow VMs as they are created or moved. Name wildcards, static IPs, and cluster names are brittle and do not adapt to dynamic environments.

Question 13Automation Fundamentals and Prism Central Automation Concepts

A playbook must pause for human approval before deleting a VM. Which design approach satisfies this requirement?

  1. Set the delete action to run twice for confirmation
  2. Disable auditing so the deletion is not logged
  3. Rely on the alert trigger to auto-approve
  4. Add an approval action before the delete action in the workflow Correct answer.

Explanation

An approval action introduces a gate where a designated approver must confirm before subsequent actions execute. This keeps destructive steps under human control while preserving automation for the rest of the workflow.

Question 14Automation Fundamentals and Prism Central Automation Concepts

What is the effect of assigning a category to a VM that is already targeted by a Flow policy scoped to that category?

  1. The VM is excluded from the policy until a reboot
  2. The policy is deleted and must be recreated
  3. The VM's category overrides all other policies
  4. The VM becomes subject to the policy's rules immediately Correct answer.

Explanation

Because Flow policies are category-driven, adding the matching category brings the VM into the policy scope without manual rule edits. Enforcement then applies according to the policy's defined rules.

Question 15Automation Fundamentals and Prism Central Automation Concepts

Which Prism Central construct best supports repeatable provisioning of a three-tier application with consistent naming and network placement?

  1. A single VM clone performed manually each time
  2. A one-off snapshot restore
  3. A self-service blueprint defining the tiers, categories, and networks Correct answer.
  4. An ad hoc script run from an administrator's laptop

Explanation

A blueprint codifies the tiers, categories, and network placement so each deployment is consistent and auditable. Manual clones, ad hoc scripts, and snapshot restores lack standardized, repeatable definitions.

Question 16Automation Fundamentals and Prism Central Automation Concepts

How does Prism Central use projects when organizing self-service automation?

  1. They group users, quotas, and blueprints so teams operate within bounded resources Correct answer.
  2. They replace categories for policy scoping
  3. They set the NTP servers for the environment
  4. They define the replication factor for the cluster

Explanation

Projects partition self-service resources by associating users or groups with quotas, networks, and blueprints, giving teams autonomy within limits. This is an organizational and governance construct rather than a storage or time-sync setting.

Question 17Automation Fundamentals and Prism Central Automation Concepts

A playbook triggered by a disk-capacity alert should first verify whether the condition persists before expanding storage. Which playbook design element supports this conditional behavior?

  1. A decision or conditional step that evaluates the current state Correct answer.
  2. A second identical alert trigger
  3. A category rename
  4. A longer schedule interval

Explanation

Conditional or decision steps let the workflow branch based on evaluated criteria, so the expansion only proceeds when the condition still holds. This avoids unnecessary remediation from transient alerts.

Question 18Automation Fundamentals and Prism Central Automation Concepts

Which statement accurately describes the relationship between Prism Central and Prism Element in a multi-cluster deployment?

  1. Both are identical interfaces with no functional difference
  2. Prism Central replaces Prism Element entirely after registration
  3. Prism Central manages multiple clusters while each Prism Element continues to manage its local cluster Correct answer.
  4. Prism Element manages Prism Central's configuration database

Explanation

Prism Central provides centralized, cross-cluster management, while each Prism Element remains the local management interface for its own cluster. They operate together rather than one replacing the other.

Question 19Automation Fundamentals and Prism Central Automation Concepts

An administrator wants automated remediation to occur only outside business hours for non-critical alerts. Which combination achieves this?

  1. An alert trigger with a time-window condition and severity filter Correct answer.
  2. A blueprint with a larger memory input
  3. A manual trigger with no conditions
  4. A Flow policy with a higher priority

Explanation

Combining a time-window condition with a severity filter ensures the playbook runs only when both the schedule and alert classification match. This prevents disruptive remediation during business hours for low-severity events.

Question 20Automation Fundamentals and Prism Central Automation Concepts

A Flow policy and a playbook both reference the same category, but a VM is missing that category. What is the result?

  1. The Flow policy applies but the playbook skips the VM
  2. The playbook runs but the Flow policy blocks all traffic
  3. The VM is excluded from both until the category is applied Correct answer.
  4. The VM is included in both because policies match by name

Explanation

Category-based scoping means an entity without the referenced category does not match the policy or playbook target. Applying the category brings the VM into scope for both constructs.

Question 21Automation Fundamentals and Prism Central Automation Concepts

Why is it preferable to scope automation targets with categories rather than explicit VM lists when VMs are frequently recreated?

  1. Explicit lists cannot reference more than one VM
  2. Categories disable auditing for targeted VMs
  3. Explicit lists consume more storage space
  4. Categories persist independently of VM lifecycle and automatically cover newly created matching VMs Correct answer.

Explanation

Categories are applied as part of provisioning, so recreated VMs inherit the correct scope and are covered without editing automation definitions. Static VM lists become stale as objects are deleted and recreated.

Question 22Automation Fundamentals and Prism Central Automation Concepts

A playbook that deletes stale test VMs runs on a schedule. Which safeguard best prevents accidental deletion of production workloads?

  1. Increase the schedule frequency to catch more VMs
  2. Run the playbook with a manual trigger only once
  3. Scope the target to a test category and add an approval or verification step Correct answer.
  4. Remove categories from all VMs before running

Explanation

Scoping to a test-specific category ensures only intended VMs match, and an approval or verification step adds a human or automated check before deletion. Frequency changes and category removal increase risk rather than reduce it.

Question 23Automation Fundamentals and Prism Central Automation Concepts

Which outcome indicates that a scheduled playbook executed successfully but its conditional branch skipped remediation?

  1. The target category is deleted
  2. The playbook never appears in run history
  3. The trigger is disabled automatically
  4. The playbook run shows completed status with the condition evaluating false Correct answer.

Explanation

A completed run with a false condition shows the workflow executed and intentionally bypassed remediation. This is expected behavior for conditional logic and confirms the guardrail worked as designed.

Question 24Automation Fundamentals and Prism Central Automation Concepts

In Prism Central, which object stores the definition of desired VM configuration used by self-service provisioning?

  1. The protection domain
  2. The blueprint Correct answer.
  3. The alert policy
  4. The report

Explanation

A blueprint holds the desired configuration, including compute, storage, network, and category settings, that self-service provisioning consumes. Alert policies, reports, and protection domains serve monitoring, analytics, and data protection roles.

Question 25Automation Fundamentals and Prism Central Automation Concepts

Which Prism Central feature would an administrator use to apply a security rule that follows a VM as it migrates between hosts?

  1. A static host firewall rule
  2. A VLAN change on the switch
  3. A Flow policy scoped by category Correct answer.
  4. A manual iptables entry on each host

Explanation

Flow policies scoped by category remain attached to the VM's identity, so protection follows the workload regardless of host placement. Static host rules and manual entries do not track VM movement.

Question 26Automation Fundamentals and Prism Central Automation Concepts

In Prism Central automation, what is the primary role of a category when it is used as a playbook target selector?

  1. It records the audit trail of every action executed by previous playbook runs
  2. It provides a dynamic label that playbook runs evaluate to determine which VMs are in scope Correct answer.
  3. It stores the credentials that the playbook uses to authenticate to guest operating systems
  4. It defines the alert threshold that must be crossed before the playbook trigger fires

Explanation

Categories are key-value metadata assigned to entities such as VMs, and playbook target selection evaluates that metadata at run time to build the set of in-scope objects. Because the label is dynamic, a VM that gains or loses the category automatically enters or leaves scope without editing the playbook. Categories carry no credentials, thresholds, or audit history.

Question 27Automation Fundamentals and Prism Central Automation Concepts

An administrator needs a Prism Central automation that runs a remediation sequence only after a specific alert has fired and then cleared within the same hour. Which design element determines that the sequence starts from the alert rather than from a fixed time?

  1. The alert-based trigger configured on the playbook Correct answer.
  2. The category value applied to the affected cluster
  3. The project quota assigned to the automation owner
  4. The playbook schedule interval configured in the trigger settings

Explanation

An alert-driven trigger subscribes the playbook to a specific alert definition so execution begins when that alert is raised, which is what allows a condition such as fire-then-clear to gate the run. A schedule starts execution at fixed times regardless of alert state. Quotas and cluster categories govern capacity and scoping, not the start of execution.

Question 28Automation Fundamentals and Prism Central Automation Concepts

A playbook must remediate only VMs whose category PowerState is set to Off, and the category value is changed by another automated process minutes before the playbook runs. What behavior should the administrator expect from the playbook's target evaluation?

  1. Targets are frozen when the playbook is created, so later category changes are ignored until the playbook is edited
  2. Targets are resolved only for VMs that already have an approved blueprint deployment
  3. Targets are resolved when the run executes, so VMs whose category value changed before the run are evaluated using the new value Correct answer.
  4. Targets are resolved once per cluster registration and cached until Prism Central is restarted

Explanation

Playbook target selection is evaluated at run time against current entity metadata, so a category value updated before the run changes which VMs match. This is the reason category-driven scoping is preferred over static VM lists when the environment changes frequently. The scope is not frozen at authoring time, cached per cluster, or limited to blueprint-deployed VMs.

Question 29Automation Fundamentals and Prism Central Automation Concepts

An operator wants a playbook action to run a script inside the guest operating system of each targeted VM. Which Prism Central capability must be available and configured for that action to succeed?

  1. Nutanix Guest Tools installed and running in each targeted guest Correct answer.
  2. An image placement policy covering the target cluster
  3. A protection domain that includes the targeted VMs
  4. A Flow network policy permitting the management plane to reach the guest

Explanation

Guest-level script execution depends on the in-guest agent provided by Nutanix Tools, which must be installed and running so Prism Central can issue commands to the guest. Network policy, protection domains, and image placement affect connectivity, backup, and image distribution respectively, but none of them provide the guest command channel.

Question 30Automation Fundamentals and Prism Central Automation Concepts

A platform team maintains one playbook used by several departments. Each department must be able to run the automation against its own VMs while being prevented from viewing or modifying another department's automation objects. Which Prism Central construct should the team use to satisfy both requirements?

  1. A single project with one shared category and a manual trigger that each department invokes on demand
  2. Separate projects per department, with the playbook and category-scoped targets defined inside each project Correct answer.
  3. Separate clusters per department, each registered to the same Prism Central with a shared playbook
  4. A single project with role mapping that hides other departments' VMs from the inventory view

Explanation

Projects provide scoped separation of automation objects and the entities they act on, so placing each department's playbook and category-scoped targets in its own project keeps runs and visibility within that boundary. A shared project, shared cluster, or role mapping alone does not isolate the automation objects themselves.

Question 31Playbooks: Design, Triggers, and Actions

In a Nutanix playbook, which component decides whether the playbook's configured actions should run when an event is received?

  1. The Prism Central role mapping
  2. The action's execution timeout
  3. The trigger's rule conditions and alert matching Correct answer.
  4. The playbook's project assignment

Explanation

A playbook trigger receives events from the alert or event source and evaluates its configured conditions, such as alert type and severity, to decide whether the playbook should run. Actions only execute after the trigger fires and any configured conditions are satisfied. Timeouts and role mappings govern execution behavior and access, not whether the playbook starts.

Question 32Playbooks: Design, Triggers, and Actions

An administrator wants a playbook to run only when a critical disk-space alert is raised on VMs in the Production category. Which playbook design element is used to scope the affected entities?

  1. The action's retry count
  2. The trigger's entity filter Correct answer.
  3. The playbook description field
  4. The notification channel

Explanation

Triggers support filtering so that the playbook is invoked only for events affecting entities that match specified criteria, such as category membership. This keeps the automation scoped to the intended VMs instead of every alert of that type. Retry counts and notification channels affect execution and delivery, not entity scoping.

Question 33Playbooks: Design, Triggers, and Actions

A playbook action must run a script on the guest operating system of an affected VM rather than through Prism Central APIs. Which action type should be selected?

  1. Create a Prism Central alert
  2. Add a category to the VM
  3. Send an email notification
  4. Run a script via the guest agent on the VM Correct answer.

Explanation

Nutanix playbooks can execute scripts inside the guest OS by using the installed guest agent on the target VM. This is the appropriate action when the remediation logic depends on guest-level tooling rather than Prism Central API calls. The other options change metadata or send messages but cannot run guest scripts.

Question 34Playbooks: Design, Triggers, and Actions

A playbook is designed to remediate a VM that is low on disk space by extending its disk, then notify the owner. How should the actions be arranged so the notification reflects the completed remediation?

  1. Place the notification action after the disk action in the same sequential workflow Correct answer.
  2. Place both actions in parallel so they start together
  3. Place the notification action only in the trigger conditions
  4. Place the disk action inside the notification action

Explanation

Actions in a playbook workflow execute in the order defined, so a notification placed after the remediation action runs once that action completes. Ordering matters when later steps depend on the outcome of earlier ones. Trigger conditions and nesting do not provide this sequencing.

Question 35Playbooks: Design, Triggers, and Actions

Which statement best describes the role of an alert in a Nutanix playbook trigger?

  1. It is an event source whose properties can be evaluated to decide whether the playbook runs Correct answer.
  2. It is the credential used by actions to authenticate
  3. It is the log destination for action output
  4. It is the schedule that determines when actions execute

Explanation

Alerts generated by Prism Central are a primary event source for playbook triggers. The trigger inspects alert properties, such as severity and affected entity, and invokes the playbook when conditions match. Credentials, schedules, and log destinations are separate concerns.

Question 36Playbooks: Design, Triggers, and Actions

An administrator needs a playbook to pause for several minutes between a remediation action and a follow-up verification action. Which approach fits the playbook action model?

  1. Set the trigger severity to Warning
  2. Add a second trigger with the same conditions
  3. Reduce the action timeout
  4. Insert a delay or wait step between the two actions Correct answer.

Explanation

Playbooks support wait or delay steps so a workflow can pause before continuing to the next action. This allows dependent systems time to settle before verification runs. Trigger severity, timeouts, and duplicate triggers do not introduce an intentional pause.

Question 37Playbooks: Design, Triggers, and Actions

What is the effect of configuring an approval step in a playbook workflow?

  1. The playbook runs twice to confirm the result
  2. Actions execute with elevated privileges automatically
  3. The trigger is disabled after the first firing
  4. Execution halts until an authorized user approves before subsequent actions run Correct answer.

Explanation

An approval step pauses the workflow and requires an authorized user to approve before the remaining actions proceed. This is used to add human oversight to automated remediation. It does not duplicate runs, disable triggers, or grant elevated privileges.

Question 38Playbooks: Design, Triggers, and Actions

A playbook action fails because the target VM's guest agent is not reporting. Which action configuration is most likely to be the root cause for a guest-script action?

  1. The playbook is assigned to a project
  2. The playbook has no description
  3. The action targets a VM without a functioning guest agent Correct answer.
  4. The trigger severity is set to Critical

Explanation

Guest-script actions depend on the guest agent being installed and communicating with Prism Central. If the agent is not reporting, the action cannot execute inside the guest. Description, severity, and project assignment do not cause this failure mode.

Question 39Playbooks: Design, Triggers, and Actions

Which element of a playbook defines the automated steps that execute after the trigger fires?

  1. The category taxonomy
  2. The trigger condition set
  3. The alert policy
  4. The action list in the playbook workflow Correct answer.

Explanation

The action list, organized as a workflow, contains the concrete steps the playbook performs once invoked. Triggers determine when the playbook runs, while actions determine what it does. Alert policies and categories are supporting constructs, not the execution steps.

Question 40Playbooks: Design, Triggers, and Actions

An administrator wants the playbook to send a notification to the on-call team whenever a critical alert affects a protected VM. Which action type directly fulfills this requirement?

  1. A VM power-cycle action
  2. A category assignment action
  3. A guest script action
  4. A notification action configured with the on-call recipient Correct answer.

Explanation

Notification actions deliver messages to configured recipients such as an on-call address or channel. This matches the requirement to inform the team. Category assignment, guest scripts, and power operations change state rather than notify people.

Question 41Playbooks: Design, Triggers, and Actions

A playbook must only trigger for alerts with Critical severity, but testing shows it also runs for Warning alerts. Which configuration should be reviewed first?

  1. The severity condition in the trigger Correct answer.
  2. The playbook's project scope
  3. The notification template
  4. The action timeout value

Explanation

Severity matching is controlled by conditions in the trigger, so an overly broad or missing severity condition explains why Warning alerts also invoke the playbook. Tightening the trigger condition limits invocation to Critical alerts. Timeouts, templates, and project scope do not control severity matching.

Question 42Playbooks: Design, Triggers, and Actions

What happens when a playbook's trigger conditions match an event but the playbook is disabled?

  1. The actions run but skip notifications
  2. The event is deleted from Prism Central
  3. The playbook does not execute its actions Correct answer.
  4. The trigger is converted to a schedule

Explanation

A disabled playbook does not execute even if its trigger conditions match. Enabling the playbook is required for the workflow to run. Disabling a playbook does not alter action behavior selectively, convert triggers, or delete events.

Question 43Playbooks: Design, Triggers, and Actions

A remediation playbook should only run during a maintenance window to avoid disrupting business hours. Which design approach best meets this requirement?

  1. Shorten the action timeout
  2. Add a second notification action
  3. Add a time-based condition to the trigger so it matches only within the window Correct answer.
  4. Increase the action retry count

Explanation

Trigger conditions can include time-based criteria so the playbook is invoked only during the permitted window. This prevents remediation during business hours. Retry counts, notifications, and timeouts affect execution behavior but not when the playbook is allowed to start.

Question 44Playbooks: Design, Triggers, and Actions

Which practice improves the safety of a playbook that automatically powers off VMs when an alert fires?

  1. Set the action timeout to zero
  2. Remove the trigger conditions
  3. Disable action logging
  4. Require an approval step before the power-off action Correct answer.

Explanation

An approval step inserts human review before a potentially disruptive action such as powering off a VM. This reduces the risk of unintended shutdowns from false positives. Removing conditions, disabling logging, or zeroing timeouts increases risk rather than mitigating it.

Question 45Playbooks: Design, Triggers, and Actions

An administrator wants to confirm that a playbook ran and see which actions succeeded or failed. Where should they look?

  1. The alert policy definitions
  2. The playbook run history and action execution details Correct answer.
  3. The VM's category list
  4. The Prism Central role assignments

Explanation

Playbook run history records each invocation and the outcome of individual actions, which is where success and failure are verified. Categories, role assignments, and alert policies do not contain execution records.

Question 46Playbooks: Design, Triggers, and Actions

A playbook action that calls a Prism Central API fails with an authorization error. Which configuration is the most likely cause?

  1. The trigger severity is too low
  2. The notification channel is misconfigured
  3. The playbook description is empty
  4. The credential configured for the action lacks the required permissions Correct answer.

Explanation

API-calling actions authenticate with a configured credential, so an authorization failure usually means that credential lacks the needed role or privileges. The fix is to grant appropriate permissions to the credential used by the action. Severity, descriptions, and notification channels do not cause authorization errors.

Question 47Playbooks: Design, Triggers, and Actions

Which combination correctly pairs a playbook element with its purpose?

  1. Trigger with notification delivery; action with event filtering
  2. Trigger with event matching; action with the step performed Correct answer.
  3. Trigger with the step performed; action with event matching
  4. Trigger with credential storage; action with alert severity

Explanation

Triggers evaluate events to decide when a playbook runs, and actions define the steps performed when it does. Reversing these roles misrepresents the model. Credentials, severity, and notifications are attributes within these elements rather than their definitions.

Question 48Playbooks: Design, Triggers, and Actions

A playbook should remediate only VMs that belong to a specific category and ignore all others. Which trigger configuration enforces this?

  1. An action timeout sized to the category
  2. An entity filter that matches the target category Correct answer.
  3. A retry policy set to the category count
  4. A notification action listing the category

Explanation

Entity filters in the trigger restrict invocation to events affecting entities that match the specified category. This ensures only intended VMs are remediated. Notifications, timeouts, and retry policies do not filter which entities are in scope.

Question 49Playbooks: Design, Triggers, and Actions

An administrator needs a playbook to run a script that requires parameters supplied at runtime from the triggering alert, such as the affected VM name. How should this be handled?

  1. Create one playbook per possible VM
  2. Hard-code a single VM name in the script
  3. Pass alert attributes into the action as parameters Correct answer.
  4. Remove the trigger conditions

Explanation

Playbook actions can receive values derived from the triggering event, allowing the script to act on the specific affected entity. This avoids hard-coding and scales across many VMs. Hard-coding, per-VM playbooks, and removing conditions do not provide dynamic parameters.

Question 50Playbooks: Design, Triggers, and Actions

A playbook is expected to remediate a recurring alert, but it runs only once and never again. Which cause is most consistent with this behavior?

  1. The notification template is empty
  2. The action timeout is too long
  3. The playbook description is missing
  4. The trigger condition or playbook state prevents subsequent matches Correct answer.

Explanation

If the playbook runs once but not on recurrence, the trigger is likely no longer matching, or the playbook was disabled after the first run. Reviewing trigger conditions and playbook state identifies the cause. Timeouts, templates, and descriptions do not stop repeated invocation.